mitmproxy / mitmproxy/mitmproxy

Allow arbitrary replay concurrency (client_replay_concurrency other than 1 and -1)

Open
#6,623 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

kind/feature
Dominant language
Python
Stars
45.1k
Forks
4.7k
Avg merge
21h 12m
Merged PRs (30d)
16

Description

Problem Description

From the docs:
"Client-side replay
Client-side replay does what it says on the tin: you provide a previously saved HTTP conversation, and mitmproxy replays the client requests one by one. Note that mitmproxy serialises the requests, waiting for a response from the server before starting the next request."

I didnt find any way to change this behaviour and simply send out all replays concurrently (or with a limit like 10 concurrent replays). Im building a universal pentest proxy script for mitmproxy and would like to have a fuzzer addon, which replays requests with a number of payloads from a wordlist. This works great but is significantly slower than other tools because there is only one concurrent replayed request at a time. Here is a snippet of my code:

  for word in fuzz_list:
    counter += 1
    modified_flow = flow.copy()
    # path
    modified_flow.request.path = modified_flow.request.path.replace("FUZZ", word)
    # headers
    for header_name in modified_flow.request.headers:
      modified_flow.request.headers[header_name] = modified_flow.request.headers[header_name].replace("FUZZ", word)
    # request body
    if modified_flow.request.content:
      modified_flow.request.content = modified_flow.request.content.decode().replace("FUZZ", word).encode()
    ctx.master.commands.call("replay.client", [modified_flow])
Proposal

I would like to have an option to send all replayed flows in parallel, preferably with a number of concurrent requests/replays allowed (0 being unlimited).

Alternatives

I tried using requests/httpx/urllib3 and some other frameworks but they all have their own problems, especially when you need full control over payload encoding, special characters in uncommon places etc. mitmproxy does this much better, as it simply creates an exact copy of my request send with burp (mitmproxy as upstream proxy).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the client replay behavior described in the issue and the ctx.master.commands.call("replay.client", [modified_flow]) entry point. Define how client_replay_concurrency should handle values other than 1 and -1, including the proposed 0-unlimited behavior, then verify that replayed flows can run concurrently while preserving mitmproxy's request handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.