.\" Automatically generated by Pandoc 2.2.1 .\" .TH "MITMDUMP" "1" "November 2016" "" "" .hy .SH NAME .PP mitmdump \- a man\-in\-the\-middle proxy with a command\-line interface .SH SYNOPSIS .PP mitmdump [\f[I]options\f[]] [\f[I]filter\f[]] .SH DESCRIPTION .PP \f[C]mitmdump\f[] is the command\-line companion to \f[C]mitmproxy\f[]. It provides tcpdump\-like functionality to let you view, record, and programmatically transform HTTP traffic. .SH OPTIONS .SS Positional Arguments: .TP .B \f[I]filter\f[] Filter. .RS .RE .SS Optional Arguments: .TP .B \-h, \-\-help Show this help message and exit. .RS .RE .TP .B \-\-conf \f[I]CONFIG_FILE\f[] Config file path. .RS .RE .TP .B \-\-version Show program's version number and exit. .RS .RE .TP .B \-\-sysinfo Show system info and exit. .RS .RE .TP .B \-\-shortversion Show program's short version number and exit. .RS .RE .TP .B \-\-anticache Strip out request headers that might cause the server to return 304\-not\-modified. .RS .RE .TP .B \-\-cadir \f[I]CA_DIR\f[] Location of the default \f[C]mitmproxy\f[] CA files. (Default: \f[C]~/.mitmproxy\f[]) .RS .RE .TP .B \-\-host Use the Host header to construct URLs for display. .RS .RE .TP .B \-q, \-\-quiet Quiet. .RS .RE .TP .B \-r \f[I]RFILE\f[], \-\-read\-flows \f[I]RFILE\f[] Read flows from file. .RS .RE .TP .B \-s \[lq]script.py \-\-bar\[rq], \-\-script \[lq]script.py \-\-bar\[rq] Run a script. Surround with quotes to pass script arguments. Can be passed multiple times. .RS .RE .TP .B \-t \f[I]FILTER\f[], \-\-stickycookie \f[I]FILTER\f[] Set sticky cookie filter. Matched against requests. .RS .RE .TP .B \-u \f[I]FILTER\f[], \-\-stickyauth \f[I]FILTER\f[] Set sticky auth filter. Matched against requests. .RS .RE .TP .B \-v, \-\-verbose Increase log verbosity. .RS .RE .TP .B \-w \f[I]OUTFILE\f[], \-\-wfile \f[I]OUTFILE\f[] Write flows to file. .RS .RE .TP .B \-a \f[I]OUTFILE\f[], \-\-afile \f[I]OUTFILE\f[] Append flows to file. .RS .RE .TP .B \-z, \-\-anticomp Try to convince servers to send us un\-compressed data. .RS .RE .TP .B \-Z \f[I]SIZE\f[], \-\-body\-size\-limit \f[I]SIZE\f[] Byte size limit of HTTP request and response bodies. Understands k/m/g suffixes, e.g.\ 3m for 3 megabytes. .RS .RE .TP .B \-\-stream \f[I]SIZE\f[] Stream data to the client if response body exceeds the given threshold. If streamed, the body will not be stored in any way. Understands k/m/g suffixes, e.g.\ 3m for 3 megabytes. .RS .RE .TP .B \-\-upstream\-auth \f[I]UPSTREAM_AUTH\f[] Proxy Authentication: \f[C]username:password\f[] .RS .RE .TP .B \-\-keepserving Continue serving after client playback or file read. We exit by default. .RS .RE .TP .B \-d, \-\-detail Increase flow detail display level. Can be passed multiple times. .RS .RE .SS Proxy Modes: .TP .B \-R \f[I]REVERSE_PROXY\f[], \-\-reverse \f[I]REVERSE_PROXY\f[] Forward all requests to upstream HTTP server: \f[C]http[s]://host[:port]\f[]. Clients can always connect both via HTTPS and HTTP, the connection to the server is determined by the specified scheme. .RS .RE .TP .B \-\-socks Set SOCKS5 proxy mode. .RS .RE .TP .B \-T, \-\-transparent Set transparent proxy mode. .RS .RE .TP .B \-U \f[I]UPSTREAM_PROXY\f[], \-\-upstream \f[I]UPSTREAM_PROXY\f[] Forward all requests to upstream proxy server: \f[C]http://host[:port]\f[] .RS .RE .SS Proxy Options: .TP .B \-b \f[I]ADDR\f[], \-\-bind\-address \f[I]ADDR\f[] Address to bind proxy to (defaults to all interfaces). .RS .RE .TP .B \-I \f[I]HOST\f[], \-\-ignore \f[I]HOST\f[] Ignore host and forward all traffic without processing it. In transparent mode, it is recommended to use an IP address (range), not the hostname. In regular mode, only SSL traffic is ignored and the hostname should be used. The supplied value is interpreted as a regular expression and matched on the ip or the hostname. Can be passed multiple times. .RS .RE .TP .B \-\-tcp \f[I]HOST\f[] Generic TCP SSL proxy mode for all hosts that match the pattern. Similar to \f[C]\-\-ignore\f[], but SSL connections are intercepted. The communication contents are printed to the log in verbose mode. .RS .RE .TP .B \-n, \-\-no\-server Don't start a proxy server. .RS .RE .TP .B \-p \f[I]PORT\f[], \-\-port \f[I]PORT\f[] Proxy service port. .RS .RE .TP .B \-\-no\-http2 Explicitly disable HTTP/2 support. If your OpenSSL version supports ALPN, HTTP/2 is enabled by default. .RS .RE .TP .B \-\-raw\-tcp | \-\-no\-raw\-tcp Explicitly enable/disable experimental raw tcp support. Disabled by default. Default value will change in a future version. .RS .RE .TP .B \-\-websockets | \-\-no\-websockets Explicitly enable/disable experimental WebSocket support. Disabled by default as messages are only printed to the event log and not retained. Default value will change in a future version. .RS .RE .TP .B \-\-spoof\-source\-address Use the client's IP for server\-side connections. .RS .RE .SS SSL: .TP .B \-\-cert \f[I]SPEC\f[] Add an SSL certificate. SPEC is of the form \f[C]"[domain=]path"\f[]. The domain may include a wildcard, and is equal to \f[C]"*"\f[] if not specified. The file at path is a certificate in PEM format. If a private key is included in the PEM, it is used, otherwise the default key in the conf dir is used. The PEM file should contain the full certificate chain, with the leaf certificate as the first entry. Can be passed multiple times. .RS .RE .TP .B \-\-ciphers\-client \f[I]CIPHERS_CLIENT\f[] Set supported ciphers for client connections. (OpenSSL Syntax) .RS .RE .TP .B \-\-ciphers\-server \f[I]CIPHERS_SERVER\f[] Set supported ciphers for server connections. (OpenSSL Syntax) .RS .RE .TP .B \-\-client\-certs \f[I]CLIENT_CERTS\f[] Client certificate file or directory. .RS .RE .TP .B \-\-no\-upstream\-cert Don't connect to upstream server to look up certificate details. .RS .RE .TP .B \-\-add\-upstream\-certs\-to\-client\-chain Add all certificates of the upstream server to the certificate chain that will be served to the proxy client, as extras. .RS .RE .TP .B \-\-insecure Do not verify upstream server SSL/TLS certificates. .RS .RE .TP .B \-\-upstream\-trusted\-cadir \f[I]CA_DIR\f[] Path to a directory of trusted CA certificates for upstream server verification prepared using the \f[C]c_rehash\f[] tool. .RS .RE .TP .B \-\-upstream\-trusted\-ca \f[I]CA_CERT\f[] Path to a PEM formatted trusted CA certificate. .RS .RE .TP .B \-\-ssl\-version\-client {\f[C]all\f[]|\f[C]TLSv1_2\f[]|\f[C]secure\f[]|\f[C]TLSv1_1\f[]|\f[C]TLSv1\f[]|\f[C]SSLv3\f[]|\f[C]SSLv2\f[]} Set supported SSL/TLS versions for client connections. \f[C]SSLv2\f[], \f[C]SSLv3\f[] and \f[C]all\f[] are INSECURE. Defaults to \f[C]secure\f[], which is TLS1.0+. .RS .RE .TP .B \-\-ssl\-version\-server {\f[C]all\f[]|\f[C]TLSv1_2\f[]|\f[C]secure\f[]|\f[C]TLSv1_1\f[]|\f[C]TLSv1\f[]|\f[C]SSLv3\f[]|\f[C]SSLv2\f[]} Set supported SSL/TLS versions for server connections. \f[C]SSLv2\f[], \f[C]SSLv3\f[] and \f[C]all\f[] are INSECURE. Defaults to \f[C]secure\f[], which is TLS1.0+. .RS .RE .SS Onboarding App: .TP .B \-\-noapp Disable the \f[C]mitmproxy\f[] onboarding app. .RS .RE .TP .B \-\-app\-host \f[I]HOST\f[] Domain to serve the onboarding app from. For transparent mode, use an IP when a DNS entry for the app domain is not present. (Default: \f[C]mitm.it\f[]) .RS .RE .TP .B \-\-app\-port \f[I]PORT\f[] Port to serve the onboarding app from. (Default: \f[C]80\f[]) .RS .RE .SS Client Replay: .TP .B \-c \f[I]PATH\f[], \-\-client\-replay \f[I]PATH\f[] Replay client requests from a saved file. .RS .RE .SS Server Replay: .TP .B \-S \f[I]PATH\f[], \-\-server\-replay \f[I]PATH\f[] Replay server responses from a saved file. .RS .RE .TP .B \-k, \-\-replay\-kill\-extra Kill extra requests during replay. .RS .RE .TP .B \-\-server\-replay\-use\-header \f[I]HEADER\f[] Request header to be considered during replay. Can be passed multiple times. .RS .RE .TP .B \-\-norefresh Disable response refresh, which updates times in cookies and headers for replayed responses. .RS .RE .TP .B \-\-no\-pop Disable response pop from response flow. This makes it possible to replay same response multiple times. .RS .RE .TP .B \-\-replay\-ignore\-content Ignore request's content while searching for a saved flow to replay. .RS .RE .TP .B \-\-replay\-ignore\-payload\-param \f[I]PARAM\f[] Request's payload parameter (\f[C]application/x\-www\-form\-urlencoded\f[] or \f[C]multipart/form\-data\f[]) to be ignored while searching for a saved flow to replay. Can be passed multiple times. .RS .RE .TP .B \-\-replay\-ignore\-param \f[I]PARAM\f[] Request's parameter to be ignored while searching for a saved flow to replay. Can be passed multiple times. .RS .RE .TP .B \-\-replay\-ignore\-host Ignore request's destination host while searching for a saved flow to replay. .RS .RE .SS Replacements: .PP Replacements are of the form \f[C]"/pattern/regex/replacement"\f[], where the separator can be any character. Please see the documentation for more information. .TP .B \-\-replace \f[I]PATTERN\f[] Replacement pattern. .RS .RE .TP .B \-\-replace\-from\-file \f[I]PATH\f[] Replacement pattern, where the replacement clause is a path to a file. .RS .RE .SS Set Headers: .PP Header specifications are of the form \f[C]"/pattern/header/value"\f[], where the separator can be any character. Please see the documentation for more information. .TP .B \-\-setheader \f[I]PATTERN\f[] Header set pattern. .RS .RE .SS Proxy Authentication: .PP Specify which users are allowed to access the proxy and the method used for authenticating them. .TP .B \-\-nonanonymous Allow access to any user long as a credentials are specified. .RS .RE .TP .B \-\-singleuser \f[I]USER\f[] Allows access to a a single user, specified in the form \f[C]username:password\f[]. .RS .RE .TP .B \-\-htpasswd \f[I]PATH\f[] Allow access to users specified in an Apache htpasswd file. .RS .RE .SH FILES .TP .B ~/.mitmproxy/mitmdump.conf Settings for \f[C]mitmdump\f[]. This file can contain any options supported by \f[C]mitmdump\f[]. .RS .RE .TP .B ~/.mitmproxy/common.conf Settings shared between all command\-line tools. Settings in this file are overridden by those in the tool\-specific files. Only options shared by \f[C]mitmproxy\f[] and \f[C]mitmdump\f[] should be used in this file. .RS .RE .PP Options that start with \f[C]\-\-\f[] (e.g. \f[C]\-\-version\f[]) can also be set in a config file (\f[C]~/.mitmproxy/common.conf\f[] or \f[C]~/.mitmproxy/mitmdump.conf\f[] or specified via \f[C]\-\-conf\f[]). Config file syntax allows: .IP .nf \f[C] key=value,\ flag=true,\ stuff=[a,b,c] \f[] .fi .PP (for details, see syntax at ). If an option is specified in more than one place, then command\-line values override config file values which override defaults. .SH AUTHORS .PP \f[C]mitmdump\f[] was written by Aldo Cortesi. .PP This manual page was written for the Debian GNU/Linux system, but its use elsewhere is encouraged. .SH SEE ALSO .PP \f[C]mitmdump\f[] documentation and examples are available online at .