July 8th, 2024

Inspect TLS encrypted traffic using mitmproxy and Wireshark

The article details inspecting TLS traffic with mitmproxy and Wireshark, highlighting challenges and setup steps. It explains using wireguard-tools for connection and decrypting traffic for real-time validation. The author encourages community engagement.

Read original articleLink Icon
Inspect TLS encrypted traffic using mitmproxy and Wireshark

The article discusses the process of inspecting TLS encrypted traffic using mitmproxy and Wireshark. The author describes the need to inspect traffic flowing out of an application and the challenges faced due to limited documentation. The guide outlines the steps involved in setting up a container using systemd-nspawn, running mitmproxy for man-in-the-middle interception, and using Wireshark to decrypt the traffic. The author explains the use of wireguard-tools to establish a connection between the container and mitmproxy. The process involves creating a transparent proxy to intercept and decrypt the TLS traffic for live inspection. By configuring Wireshark to decrypt the traffic based on the SSLKEYLOGFILE, the author successfully inspects and validates code changes in real-time. Despite the complexity of the setup, the author hopes the information provided will be useful for others attempting to inspect TLS encrypted traffic. The article concludes with an invitation to engage with the Koyeb Community and explore the log exporter functionality on the platform.

Link Icon 3 comments
By @Drygord - 5 months
If you’re using wire shark you don’t also need mitm proxy. Mitmproxy is similar to fiddler/burpsuite in that they are high level traffic capturing tools whereas the with Wireshark you can inspect the actual TCP packets. It takes more setup as you’ve seen
By @janosdebugs - 5 months
This seems awfully complicated. A lot of applications will happily respect system proxy settings and connect to mitmproxy directly.
By @sciencesama - 5 months
Miproxy for https adblocking works great fyi