Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
mitmproxy intercepts HTTP/1, HTTP/2, HTTP/3 and WebSocket traffic, including TLS-protected traffic once its certificate authority is trusted by the client. Captured flows can be inspected, modified and replayed from three front ends: a console interface, a browser-based interface and a non-interactive dump mode.
Its Python add-on API is the main reason security testers and developers use it: a few lines of Python can rewrite requests, record API traffic or automate checks. It is commonly used to inspect mobile app and IoT traffic as well as web applications.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
7 published advisories for mitmproxy in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.
GHSA-527g-3w9m-29hvCVE-2026-40606medium2026-04-12
LDAP Injection in mitmproxy
GHSA-63cx-g855-hvv4CVE-2025-57804medium2025-08-25
Vulnerable python-hyper/h2 dependency embedded in mitmproxy binaries
GHSA-63cx-g855-hvv4moderate2025-08-25
mitmproxy binaries embed a vulnerable python-hyper/h2 dependency
GHSA-wg33-5h85-7q5pCVE-2025-23217high2025-02-06
Mitmweb API Authentication Bypass Using Proxy Server
GHSA-gcx2-gvj7-pxv3CVE-2022-24766medium2022-03-19
Insufficient Protection against HTTP Request Smuggling in mitmproxy
GHSA-22gh-3r9q-xf38CVE-2021-39214medium2021-09-16
Lacking Protection against HTTP Request Smuggling in mitmproxy
GHSA-6m53-c78q-7qmgCVE-2018-14505critical2018-07-31
Mitmweb in mitmproxy allows DNS Rebinding attacks
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Asynchronous TCP port scanner for large ranges
Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.
Fast port scanner that hands results to Nmap
Port scanner written in Rust that finds open ports quickly and then pipes them into Nmap for service detection, with a scripting engine of its own.
