🔎 MITM Proxies

A Man-In-The-Middle (MITM) proxy is a proxy that sits between the client and the server. While this positioning is common to all proxies, what distinguishes an MITM proxy is its active interpretation of application layer packets. Although it may modify packets as they pass through, its primary function is typically to inspect and track the traffic.

Examples:

• /examples/src/http_mitm_proxy_boring.rs: A minimal HTTP proxy that accepts both HTTP/1.1 and HTTP/2 connections, proxying them to the target host using Boring for TLS.

  • Similar to /examples/src/http_connect_proxy.rs but with MITM capabilities for both HTTP and HTTPS requests.

• /examples/src/http_mitm_relay_proxy_boring.rs: Similar to /examples/src/http_mitm_proxy_boring.rs, but with a more advanced flow, and usually the kind of approach more desired for MITM proxies, especially transparent proxies.

• /examples/src/mitm_ocsp_relay_gate.rs: Test harness behind the MITM OCSP-stapling gate: a local upstream TLS server plus the boring relay proxy, exercising the mirror → issue → staple flow so an external client (curl --cert-status / openssl s_client -status) can validate the stapled leaf. Driven by scripts/ocsp-relay-gate.sh (just test-ocsp-gate).

• /examples/src/http_mitm_proxy_rustls.rs: A minimal HTTP proxy that accepts both HTTP/1.1 and HTTP/2 connections, proxying them to the target host using Rustls for TLS.

  • Similar to /examples/src/http_connect_proxy.rs but with MITM capabilities for both HTTP and HTTPS requests.

Description

An MITM proxy is typically set up as an HTTP Proxy, but it can alternatively be configured as a SOCKS5 proxy.

Transparent Proxies

MITM proxies that only wish to inspect traffic without destructive modification can attempt to mirror the incoming client across various network layers (TCP, TLS, and HTTP). This approach is a form of User-Agent emulation, but it operates based on the original User-Agent rather than emulating a popular one with significant market share.

These proxies are often referred to as transparent proxies, and you may notice network inspection software offering options labeled as “transparent mode” or “hidden.” If such software can still inspect your HTTPS traffic, it’s likely operating as a “transparent proxy.”

Reusable inspection and programmatic control

rama-inspect provides protocol-independent lifecycle, typed interception waits, streamed record storage, and subscriptions for custom interfaces. HTTP, TLS, profile, WebSocket, and encryption adapters live in their owning crates. Combine inspect with the protocol and crypto features you use. See the rama-inspect guide.

The CLI inspector also exposes a machine API on the same authenticated web server. Start rama serve proxy --mitm --inspect-json for JSON readiness information, or use the token in the normal startup link. Send Authorization: Bearer <token> to GET /api for operation discovery and /api/help for the observe → select hosts → intercept → export workflow. No browser session or MCP server is required. A human can continue using the GUI while an agent queries traffic or operates the controls.