Lion Cipher Lab
Inspect your own traffic with mitmproxy
- AppSec / DevSecOps
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Almost everything your devices do is HTTP(S) under the hood, and most people never actually see it — they trust that their apps send what they claim and nothing more. An intercepting proxy is how you check. Sitting in the middle of your OWN traffic with mitmproxy shows you the real requests your browser and apps make: the exact headers, the parameters, the tokens, the data leaving your machine. That is a foundational skill for web security, privacy auditing, and debugging alike. Just as important, this lab teaches the single most misunderstood idea in everyday security by making you do it:…
What you'll learn
- what a proxy and an intercepting proxy are
- how HTTPS interception works and why it needs a trusted CA
- installing and running mitmproxy / mitmweb
- configuring a browser or device to use a proxy
- installing (and trusting) a CA certificate on a device you own
- reading a request's headers and parameters
- editing and replaying a captured request
- why a certificate warning is the last line of defense against a real MITM
Steps in this lab
- The one rule, and the three words you need
- How HTTPS interception works (and why it needs your trust)
- Install mitmproxy
- Start mitmweb and point your browser at it
- Install mitmproxy's CA certificate — the deliberate act
- Watch your own traffic flow in mitmweb
- Inspect a request, then edit and replay it
- Put the proxy away — and keep the lesson