Mitmproxy Filter

URL containing "google.com"

google\.com

Requests whose body contains the string "test"

~q ~b test

Anything but requests with a text/html content type:

!(~q & ~t "text/html")

Replace entire GET string in a request (quotes required to make it work):

":~q ~m GET:.\*:/replacement.html"

Expressions

-	-
`@all`	All flows
`@focus`	The currently focused flow
`@shown`	All flows currently shown
`@hidden`	All flows currently hidden
`@marked`	All marked flows
`@unmarked`	All unmarked flows
mitmproxy has a set of convenient flow selectors that operate on the current view

-	-
`~a`	Match asset in response: CSS, Javascript, Flash, images.
`~b` `regex`	Body
`~bq` `regex`	Request body
`~bs` `regex`	Response body
`~c` `int`	HTTP response code
`~d` `regex`	Domain
`~dst` `regex`	Match destination address
`~e`	Match error
`~h` `regex`	Header
`~hq` `regex`	Request header
`~hs` `regex`	Response header
`~http`	Match HTTP flows
`~m` `regex`	Method
`~marked`	Match marked flows
`~q`	Match request with no response
`~s`	Match response
`~src` `regex`	Match source address
`~t` `regex`	Content-type header
`~tcp`	Match TCP flows
`~tq` `regex`	Request Content-Type header
`~ts` `regex`	Response Content-Type header
`~u` `regex`	URL
`~websocket`	Match WebSocket flows (and HTTP-WebSocket handshake flows)

-	-

| `f` | Set view filter (on flow view page) |

RegEX cheatsheet (quickref.me) The regex are Python-style, it can be specified as quoted strings

Comments