Publications

Citing

If mitmproxy has been significant to a project that leads to a publication, please acknowledge that fact by citing the project.

@misc{mitmproxy,
    author = {Aldo Cortesi and Maximilian Hils and Thomas Kriechbaumer and contributors},
    title  = {{mitmproxy}: A free and open source interactive {HTTPS} proxy},
    year   = {2010--},
    url    = {https://mitmproxy.org/},
    note   = {[Version 11.0]}
}

Aldo Cortesi, Maximilian Hils, Thomas Kriechbaumer, and contributors.
mitmproxy: A free and open source interactive HTTPS proxy, 2010-, https://mitmproxy.org/ [Version 11.0].

mitmproxy has contributed to a variety of academic publications, media reports, talks, blog posts, and more. If you have written about mitmproxy, please add yourself!

Blog Posts

Fake web backend with mitmproxy – HiPhish, Jun 2022.
Running a man-in-the-middle proxy on a Raspberry Pi 4 – Dino Fizzotti, Apr 2022.
Securing Quicklisp through mitmproxy – HiPhish, Mar 2022.
GitHub Release Radar - Mid-year 2021 Edition – Michelle Mannering, GitHub, Aug 2021.
Gorillas: Special offer - unicorn slices, 150g – Zerforschung, May 2021.
mitmproxy filters that will make you a better developer – Sufiyan Yasa, Feb 2021.
How I helped fix Canada's COVID Alert app – Sean Coates, Aug 2020.
Penetration Testing Guide – Lucas Ramage, May 2020.
How to inspect network traffic using mitmproxy – Lucas Legname, Apr 2020.
Automating mitmproxy and Improving Hulu’s Build Loading Tool for Roku – Chandler Underwood, Hulu Tech, Apr 2019.
Running a man-in-the-middle proxy on a Raspberry Pi 3 – Dino Fizzotti, Jan 2019.
Using a man-in-the-middle proxy to scrape data from a mobile app API – Petr Patek, Jul 2019.
Spying on Apps: How to Sleuth Back – Blake Netzeband, Sep 2018.
Grabbing multimedia content with mitmproxy – Alex Skov Jensen, Jul 2018.
GitHub Release Radar - May 2018 – Lee Reilly, GitHub, Jul 2018.
Playing make-believe using proxy server – Sumit Gupta, Mar 2018.
How I gained access to TMobile’s national network for free – Jacob Ajit, Sep 2016.
Mitmproxy: Your D.I.Y. Private Eye – Max Greenwald, Sep 2015.
An Internet X-Ray Machine for the Masses – Paul Ohm, Jun 2015.
Extracting My Data from the Microsoft Band – Jeff Huang, Dec 2014.
Reverse-engineering the Kayak app with mitmproxy – Shubhro Saha, Dec 2014.
Debugging server side REST calls with mitmproxy in Meteor – Pierre-Eric Marchandet, Dec 2014.
WIN any quiz : QuizUp iOS App Security Vulnerability – attify, Dec 2014.
OUYA is watching you – Christian Weiske, Oct 2013.
Reverse engineering network traffic with a Raspberry Pi – Peter B Marks, Aug 2013.
Apple starts using their own mapping service, ditches Google Maps – Holger Eilhard, Mar 2012.
Hipster uploads part of your iPhone address book to its servers – Mark L. Chang, Feb 2012.
Skout: a devastating privacy vulnerability – Aldo Cortesi, Sept 2011.
How UDIDs are used: a survey – Aldo Cortesi, May 2011.
Why the Apple UDID had to die – Aldo Cortesi, May 2011.
De-anonymizing Apple UDIDs with OpenFeint – Aldo Cortesi, May 2011.

Media

Spying on the Dog (or Cat) – Michelle Higgins, The New York Times, Dec 2018.
My phone is spying on me, so I decided to spy on it – Simon Elvery, ABC, Oct 2018.
Sites Sharing Personal Details: The Journal’s Tests – Jeremy Singer-Vine and Jennifer Valentino-DeVries, Wall Street Journal, Dec 2012.
Path uploads your entire iPhone address book to its servers – Arun Thampi, The Verge, Feb 2012.

Talks

Tracking in Apps: Ist das legal? Eine Übersicht über die mobile Trackinglandschaft – Benjamin Altpeter, Lorenz Sieben, Malte Wessels, Dec 2022.
Attacking own APIs to find security bugs – Daniel Neagaru, mytaxi, Jun 2019.
Demonstration of Python HTTP/2 using Hyper-h2 with Twisted and mitmproxy – Cory Benfield, Jan 2016.
Mitmproxy Demo at Honeynet Workshop 2014 – Maximilian Hils, Feb 2014.
mitmproxy - use and abuse of a hackable SSL-capable man-in-the-middle proxy – Jim Cheetham, Jan 2012.

Research

Robin Kirchner, Simon Koch, Noah Kamangar, David Klein, Martin Johns: A Black-Box Privacy Analysis of Messaging Service Providers' Chat Message Processing. PETS'24. Jul 2024.
Ka Lok Wu, Man Hong Hue, Ngai Man Poon, Kin Man Leung, Wai Yin Po, Kin Ting Wong, Sze Ho Hui, Sze Yiu Chau: Back to School: On the (In)Security of Academic VPNs. USENIX Sec'23. Aug 2023.
Simon Koch, Benjamin Altpeter, Martin Johns: The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications. USENIX'23. Aug 2023.
Ka Lok Wu, Man Hong Hue, Ka Fun Tang, Sze Yiu Chau: The Devil is in the Details: Hidden Problems of Client-Side Enterprise Wi-Fi Configurators. WiSec'23. Jun 2023.
Kostas Drakonakis, Sotiris Ioannidis, and Jason Polakis: ReScan: A Middleware Framework for Realistic and Robust Black-box Web Application Scanning. NDSS'23. Mar 2023.
Trung Tin Nguyen, Michael Backes, and Ben Stock: Freely Given Consent? Studying Consent Notice of Third-Party Tracking and Its Violations of GDPR in Android Apps. CCS'22. Nov 2022.
Moumena Chaqfeh, Russell Coke, Jacinta Hu, Waleed Hashmi, Lakshmi Subramanian, Talal Rahwan, and Yasir Zaki: JSAnalyzer: A Web Developer Tool for Simplifying Mobile Web Pages through Non-critical JavaScript Elimination. ACM Trans. Web 16 (4). Nov 2022.
Zikan Dong, Liu Wang, Hao Xie, Guoai Xu, and Haoyu Wang: Privacy Analysis of Period Tracking Mobile Apps in the Post-Roe v. Wade Era. ASE'22. Oct 2022.
Simon Koch, Malte Wessels, Benjamin Altpeter, Madita Olvermann, Martin Johns: Keeping Privacy Labels Honest: Developer conformity to self declared data collection via Apple Privacy Labels. PETS'22. Jul 2022.
Florian Wilkens, Steffen Haas, Johanna Amann, and Mathias Fischer: Passive, Transparent, and Selective TLS Decryption for Network Security Monitoring. IFIP SEC'22. Jun 2022.
Theo von Arx and Kenneth G. Paterson: On the Cryptographic Fragility of the Telegram Ecosystem. Cryptology ePrint Archive. May 2022.
Dhruv Kuchhal and Frank Li: A View into YouTube View Fraud. WWW'22. Apr 2022.
TJ OConnor: HELO DarkSide: Breaking Free From Katas and Embracing the Adversarial Mindset in Cybersecurity Education. SIGCSE'22. Mar 2022.
Darion Cassel, Su-Chin Lin, Alessio Buraggina, William Wang, Andrew Zhang, Lujo Bauer, Hsu-Chun Hsiao, Limin Jia, and Timothy Libert: OmniCrawl: Comprehensive Measurement of Web Tracking With Real Desktop and Mobile Browsers. PETS'22. Jan 2022.
Man Hong Hue, Joyanta Debnath, Kin Man Leung, Li Li, Mohsen Minaei, M. Hammad Mazhar, Kailiang Xian, Endadul Hoque, Omar Chowdhury, and Sze Yiu Chau: All your Credentials are Belong to Us: On Insecure WPA2-Enterprise Configurations. CCS'21. Nov 2021.
Trung Tin Nguyen, Michael Backes, Ninja Marnau, and Ben Stock: Share First, Ask Later (or Never?) - Studying Violations of GDPR's Explicit Consent in Android Apps. USENIX'21. May 2021.
Gordon Meiser, Pierre Laperdrix, and Ben Stock: Careful Who You Trust: Studying the Pitfalls of Cross-Origin Communication. AsiaCCS'21. May 2021.
Timothy Barron, Johnny So, Nick Nikiforakis: Click This, Not That: Extending Web Authentication with Deception. AsiaCCS'21. May 2021.
Douglas J. Leith: Web Browser Privacy: What Do Browsers Say When They Phone Home?. IEEE Access 9. Mar 2021.
Douglas J. Leith and Stephen Farrell: Coronavirus Contact Tracing App Privacy: What Data Is Shared By The Singapore OpenTrace App?. SecureComm 2020. Dec 2020.
Abhishek Tiwari, Jyoti Prakash, Sascha Groß, and Christian Hammer: A Large Scale Analysis of Android — Web Hybridization. Journal of Systems and Software 170. Dec 2020.
Marco Andrea Greco: Home IoT devices: analysis of the communication protocols. Master Thesis. Dec 2020.
Kaizheng Liu, Ming Yang, Zhen Ling, Huaiyu Yan, Yue Zhang, Xinwen Fu, and Wei Zhao: On Manually Reverse Engineering Communication Protocols of Linux-Based IoT Systems. IEEE Internet of Things Journal 8(8). Nov 2020.
Sina Keshvadi, Mehdi Karamollahi, and Carey Williamson: Traffic Characterization of Instant Messaging Apps: A Campus-Level View. LCN 2020. Nov 2020.
Timothy Barron: Addressing the Imbalance between Attackers and Defenders Using Cyber Deception. Dissertation. Aug 2020.
Michalis Diamantaris, Francesco Marcantoni, Sotiris Ioannidis, and Jason Polakis: The Seven Deadly Sins of the HTML5 WebAPI: A Large-scale Study on the Risks of Mobile Sensor-based Attacks. ACM Transactions on Privacy and Security 23(4). Jul 2020.
Jianhua Sun, Kun Sun, and Qi Li: Towards a Believable Decoy System: Replaying Network Activities from Real System. CNS 2020. Jun 2020.
Maximilian Hils and Rainer Böhme: Watching the Weak Link into Your Home: An Inspection and Monitoring Toolkit for TR-069. ACNS'20. Jun 2020.
Blake Janes, Heather Crawford, and TJ OConnor: Never Ending Story: Authentication and Access Control Design Flaws in Shared IoT Devices. SPW 2020. May 2020.
Pubali Datta, Prabuddha Kumar, Tristan Morris, Michael Grace, Amir Rahmati, and Adam Bates: Valve: Securing Function Workflows on Serverless Computing Platforms. WWW'20. Apr 2020.
Sina Keshvadi and Carey Williamson: MoVIE: A Measurement Tool for Mobile Video Streaming on Smartphones. ICPE'20. Apr 2020.
Bryan Pearson, Lan Luo, Cliff Zou, Jacob Crain, Yier Jin, and Xinwen Fu: Building a Low-Cost and State-of-the-Art IoT Security Hands-On Laboratory. IFIPIoT 2019. Oct 2019.
Milan Stute, Sashank Narain, Alex Mariotto, Alexander Heinrich, David Kreitschmann, Guevara Noubir, and Matthias Hollick: A Billion Open Interfaces for Eve and Mallory: MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link. USENIX'19. Aug 2019.
Kamila Ragimova, Vyacheslav Loginov, and Evgeny Khorov: Analysis of YouTube DASH Traffic. BlackSeaCom 2019. Jun 2019.
Shubham Jain, Eden Bensaid, and Yves-Alexandre de Montjoye: UNVEIL: Capture and Visualise WiFi Data Leakages. WWW'19. May 2019.
Gordon Chu, Noah Apthorpe, and Nick Feamster: Security and Privacy Analyses of Internet of Things Children's Toys. IEEE Internet of Things Journal 6(1). Feb 2019.
Alexander Sjösten, Steven Van Acker, Pablo Picazo-Sanchez, and Andrei Sabelfeld: Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks. NDSS'19. Feb 2019.
Rob van Eijk: Web Privacy Measurement in Real-Time Bidding Systems. A Graph-Based Approach to RTB System Classification. Dissertation. Jan 2019.
Steven Van Acker, Daniel Hausknecht, and Andrei Sabelfeld: Raising the Bar: Evaluating Origin-wide Security Manifests. ACSAC'18. Dec 2020.
Zhengping Zhang and Carey Williamson: A Campus-Level View of Outlook Email Traffic. ICNCC 2018. Dec 2018.
Daniel Hausknecht: Web Application Content Security. Dissertation. Aug 2018.
Arvid Viderberg: Security evaluation of smart door locks. Master Thesis. Jul 2019.
Davide Caputo, Luca Verderame, Simone Aonzo, and Alessio Merlo: Droids in Disarray: Detecting Frame Confusion in Hybrid Android Apps. DBSec 2019. Jun 2019.
Rosarioa Giustolisi, Giampaolob Bella, and Gabrielec Lenzini: Invalid certificates in modern browsers: A socio-technical analysis. Journal of Computer Security 26(4). Jul 2018.
Oskari Teittinen: Analysis of cheat detection and prevention techniques in mobile games. Master Thesis. Jun 2018.
Ashwini Rao: Assessing the Impact of Data Practices on User Privacy. Dissertation. Apr 2018.
Sze Yiu Chau, Bincheng Wang, Jianxiong Wang, Omar Chowdhury, Aniket Kate, and Ninghui Li: Why Johnny Can't Make Money With His Contents: Pitfalls of Designing and Implementing Content Delivery Apps. ACSAC'18. Dec 2018.
Vitor A. Cunha, Marcio B. Carvalho, Daniel Corujo, Joao P. Barraca, Diogo Gomes, Alberto E. Schaeffer-Filho, Carlos R. P. dos Santos, Lisandro Z. Granville, and Rui L. Aguiar: An SFC-enabled approach for processing SSL/TLS encrypted traffic in Future Enterprise Networks. IEEE ISCC 2018. Jun 2018.
John Vilk and Emery Berger: BLeak: Automatically Debugging Memory Leaks in Web Applications. PLDI 2018. Jun 2018.
Jenny Knackmuss, Eric Clausing, and Reiner Creutzburg: Investigation of security relevant aspects of Android eHealthApps: permissions, storage properties and data transmission. Electronic Imaging 2017(6). Jun 2017.
Max Van Kleek, Ilaria Liccardi, Reuben Binns, Jun Zhao, Daniel J. Weitzner, and Nigel Shadbolt: Better the Devil You Know: Exposing the Data Sharing Practices of Smartphone Apps. CHI'17. May 2017.
Timothy A. Chadza, Francisco J. Aparicio-Navarro, Konstantinos G. Kyriakopoulos, and Jonathon A. Chambers: A look into the information your smartphone leaks. ISNCC 2017. May 2017.
Ibrahim Altaweel, Maximillian Hils, and Chris Jay Hoofnagle: Privacy on Adult Websites. ConPro'17. Mar 2017.
Georg Merzdovnik, Klaus Falb, Martin Schmiedecker, Artemios G. Voyiatzis, and Edgar Weippl: Whom You Gonna Trust? A Longitudinal Study on TLS Notary Services. IFIP SEC'16. Jul 2016.
Darren Kemp, Mikhail Davidov, and Chris Czub: Out-of-Box Exploitation: A Security Analysis of OEM Updaters. Whitepaper. May 2016.
Martin Husák, Milan Čermák, Tomáš Jirsík, and Pavel Čeleda: HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting. EURASIP 2016(1). Jan 2016.
Jinyan Zang, Krysta Dummit, James Graves, Paul Lisker, and Latanya Sweeney: Who Knows What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third Parties by Mobile Apps. Technology Science 30. Oct 2015.
Christopher Neasbitt, Roberto Perdisci, Kang Li, and Terry Nelms: ClickMiner: Towards Forensic Reconstruction of User-Browser Interactions from Network Traces. CCS'14. Dec 2014.
Robin Mueller, Sebastian Schrittwieser, Peter Fruehwirt, Peter Kieseberg, and Edgar Weippl: Security and privacy of smartphone messaging applications. International Journal of Pervasive Computing and Communications 11(2). Jun 2015.
Martijn Terpstra: WhatsApp & Privacy. Bachelor Thesis. Jul 2013.