How to Install and Use mitmproxy in Linux to Intercept and Inspect HTTP Traffic

Debugging Web services, mobile application backends, and third-party API integrations often requires examining exactly what payloads, cookies, and HTTP headers leave your machine. While browser Developer Tools handle basic client-side web inspection, they cannot capture traffic generated by headless background daemons, command-line utilities like curl, or mobile apps running on connected devices.

mitmproxy is a premier open-source, interactive SSL/TLS-capable intercepting HTTP proxy for Linux. Operating as a Man-in-the-Middle (MITM) proxy, it provides a powerful terminal-based interface (TUI) to intercept, inspect, modify, and replay HTTP/1, HTTP/2, and WebSocket traffic on the fly. Whether you are conducting security penetration tests, debugging REST APIs, or capturing raw WebSocket streams, mitmproxy is an indispensable toolkit. This tutorial explains how to install mitmproxy on Linux, trust its root certificate authority, intercept secure HTTPS traffic, and edit payloads in real time.

mitmproxy Tool Suite Overview

When you install mitmproxy, it delivers three distinct interfaces sharing a common core:

• mitmproxy: An interactive, console-based TUI designed for interactive inspection and quick keyboard-driven flow editing.
• mitmweb: A clean, browser-based graphical web interface ideal for users who prefer point-and-click inspection and visual diffs.
• mitmdump: A headless, non-interactive command-line tool similar to tcpdump, perfect for scripting, packet logging, and automated traffic filtering.

Installing mitmproxy on Linux

mitmproxy is packaged across major Linux package managers and as standalone static binaries.

Method 1: Install via Native Repositories

Ubuntu and Debian:

sudo apt update
sudo apt install mitmproxy

Arch Linux:

sudo pacman -S mitmproxy

Fedora:

sudo dnf install mitmproxy

Method 2: Install via Standalone Binary

To guarantee the newest release without dependency conflicts, download the official pre-compiled standalone binary archive:

wget https://downloads.mitmproxy.org/latest/mitmproxy-latest-linux-x86_64.tar.gz
tar -zxvf mitmproxy-latest-linux-x86_64.tar.gz
sudo mv mitmproxy mitmweb mitmdump /usr/local/bin/

Verify that the proxy tools execute correctly:

mitmproxy --version

Starting mitmproxy and Routing Traffic

By default, mitmproxy listens on port 8080 across all local network interfaces:

1. Launch the interactive proxy in your terminal:

   mitmproxy

2. In a second terminal window, route an outbound command-line request through the proxy using standard environment variables:

   curl --proxy http://127.0.0.1:8080 http://httpbin.org/ip

3. Return to the first terminal window. An entry representing the HTTP request appears instantly in the mitmproxy flow list.

Trusting the mitmproxy CA Certificate for HTTPS

To intercept encrypted HTTPS traffic without triggering SSL certificate errors, the client device or system trust store must trust mitmproxy’s locally generated Certificate Authority (CA):

1. On first run, mitmproxy automatically generates certificates in your home directory under ~/.mitmproxy/.
2. To install the certificate in Ubuntu/Debian system trust stores:

   sudo cp ~/.mitmproxy/mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy.crt
   sudo update-ca-certificates

3. For web browsers or mobile devices, configure the device Wi-Fi proxy to point to your Linux IP on port 8080, then navigate to http://mitm.it in the client browser to download and install the platform-specific root profile directly.

Navigating and Intercepting Flows in the Terminal Interface

mitmproxy uses intuitive vim-style keyboard navigation:

Key / Command	Action
j / k (or arrows)	Move up and down through captured request flows
Enter	View details of the highlighted request (Request, Response, Detail tabs)
Tab	Switch between Request and Response views
q	Return to the main flow list / Exit prompt
i	Set an intercept filter pattern (e.g. ~u /api/v1/)
e	Edit the currently intercepted request headers, query parameters, or body
a	Resume and forward the paused flow to the server
r	Replay the highlighted request to test server responses

Using mitmweb for a Graphical Browser Interface

If you prefer an interactive web console instead of the command-line interface:

mitmweb --web-port 8081

This command launches the proxy on port 8080 and opens a web interface on http://127.0.0.1:8081. The web UI provides search filtering, payload formatting (JSON, XML, Multipart), and quick one-click replay buttons.