[cientifico]

One hidden gem.

The closest free alternative is https://www.mitmproxy.org/ that is not even close.

And off course, https://www.wireshark.org/ but that is too generic and with a bigger learning curve.

Worth the money. And no subscription (or there weren't a subscription back then)

[acheong08]

I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a child process (I used https://github.com/AdguardTeam/gomitmproxy) to handle the sniffing and reencryption.

Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/...

I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days.

Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .

[le-mark]

> It's insane that I can't even develop for my own phone without paying an extra fee to Apple.

A Linux phone can’t come fast enough. Yes there is at least one, on ancient hardware. IMO a viable Linux phone requires hardware at most one generation old.

[aeonik]

I do a lot of work in similar areas here.

While vibe coding will get you something that potentially works, I've noticed LLMs are really bad at cleanly abstracting across multiple layers in this area. They usually will insist on parsing and serializing every field at every layer.

If you have the protocols/interfaces well defined up front it is very fast at building extensions, analytics or visualizations though.

[jeroenhd]

mitmproxy/mitmweb offer a WireGuard server implementation to do pretty much this. You can grab any existing WireGuard VPN, scan a QR code to import the VPN config, and start monitoring (after installing the MITM certificate, of course).

The packet tunnel story is crazy. I'm glad Android allows you to just use network APIs without question as a developer.

[chrisweekly]

I had excellent experiences w mitmproxy (and mitmdump) in 2016-17. At that point it was powerful and easily scriptable, making it far superior to charles for my purposes.

[_dark_matter_]

Agreed, I used to have a bunch of mitm commands in my bashrc to easily intercept https messages

[ricardo81]

I'd used mitmproxy to reverse engineer browser extensions and mobile apps and it did the trick. It was quite some time ago.

[efortis]

Burp is free too (community edition)

https://portswigger.net/burp/communitydownload

[OptionOfT]

What I really like about mitmproxy is that it runs on my server with a certificate I trusted on my phone.

I then flip on WireGuard on my phone, pointed to mitmproxy, and seamlessly all traffic from my phone is decrypted and viewable through the website on my computer.

Except of-course all the applications these days that do certificate pinning, which is annoying, but for that we have Frida.

[Fnoord]

mitmproxy isn't the gold standard; it is Burp Suite, sadly.

Burp Suite uses a subscription model. Charles a model like Sublime Text: you buy it and get to keep the version forever, major upgrades available for a discount.

I had to chuckle at this one:

> If you purchased a Charles license prior to 1 May 2008 your existing license key is still valid for Charles 5.

So I guess in past they used a model where you'd have lifetime upgrades.

Which also made me think: I recognize this name! This has to be an older piece of software. Was it published on Freshmeat in the start of this century?

There's also some TUI for Wireshark, such as frontends for tshark. I think [1] looks interesting, since it can be used with a local LLM (via Ollama).

[1] https://github.com/kspviswa/pktai

[jeroenhd]

mitmproxy supports quite a few features that Charles doesn't and vice versa. You could use them as alternatives for basic browser traffic analysis (where they're both fine), but their features and capabilities cover different areas. Charles is user friendly and robust, mitmproxy has advanced scripting capabilities with a decent amount of community examples available. They complement each other.

[29athrowaway]

- mitmproxy (the Docker version is really easy to set up)

- Burp Proxy

- Wireshark, tshark

[dns_snek]

Wireshark is extremely powerful and useful but it lives in a completely different category of tools. It's not a proxy so it can't modify traffic or inspect HTTPS [1], it's used to passively capture and analyze general network traffic and troubleshoot networking issues.

[1] without an elaborate setup, your program needs to be instructed to dump TLS encryption keys for Wireshark to read

[rnewme]

What about ZAP? https://www.zaproxy.org/

[punnerud]

I was a daily user of mitmproxy, until they changed all they keybindings around version 2. Tried a couple of times to get used to the new “TMUX” style, but switched to Charles Proxy.

Have mitmproxy gotten any better in usability over the years?

Just based on the images, is seems to have the same problems?

[NicolaiS]

> Have mitmproxy gotten any better in usability over the years?

The new-ish "Local Capture" and "WireGuard"-mode are quite nice.

And running e.g. `mitmproxy --ignore-hosts '.*' --show-ignored-hosts` [1] for monitoring apps with certificate pinning also a new feature

[1] cmd will turn mitmproxy into a "non-MITM proxy" but do show domains (SNI) the app is connecting to.

[jeroenhd]

I generally prefer mitmweb, the web frontend for mitmproxy. I don't have much of a problem with their tmux-like UI, but I find mitmweb a lot easier to use than the keyboard shortcut based terminal navigation.

[leptons]

Fiddler is superior to Charles and always has been.

https://www.telerik.com/fiddler

[crossroadsguy]

Did you just call Charles Proxy a "hidden" gem? :)