/usr/bin/mitmproxy

usage: mitmproxy [options]

options:
  -h, --help            show this help message and exit
  --version             show version number and exit
  --options             Show all options and their default values
  --commands            Show all commands and their signatures
  --set option[=value]  Set an option. When the value is omitted, booleans are set to true,
                        strings and integers are set to None (if permitted), and sequences are
                        emptied. Boolean values can be true, false or toggle. Sequences are set
                        using multiple invocations to set for the same option.
  -q, --quiet           Quiet.
  -v, --verbose         Increase log verbosity.
  --mode, -m MODE       The proxy server type(s) to spawn. Can be passed multiple times. Mitmproxy
                        supports "regular" (HTTP), "local", "transparent", "socks5",
                        "reverse:SPEC", "upstream:SPEC", and "wireguard[:PATH]" proxy servers. For
                        reverse and upstream proxy modes, SPEC is host specification in the form
                        of "http[s]://host[:port]". For WireGuard mode, PATH may point to a file
                        containing key material. If no such file exists, it will be created on
                        startup. You may append `@listen_port` or `@listen_host:listen_port` to
                        override `listen_host` or `listen_port` for a specific proxy mode.
                        Features such as client playback will use the first mode to determine
                        which upstream server to use. May be passed multiple times.
  --no-anticache
  --anticache           Strip out request headers that might cause the server to return 304-not-
                        modified.
  --no-showhost
  --showhost            Use the Host header to construct URLs for display. This option is disabled
                        by default because malicious apps may send misleading host headers to
                        evade your analysis. If this is not a concern, enable this options for
                        better flow display.
  --no-show-ignored-hosts
  --show-ignored-hosts  Record ignored flows in the UI even if we do not perform TLS interception.
                        This option will keep ignored flows' contents in memory, which can greatly
                        increase memory usage. A future release will fix this issue, record
                        ignored flows by default, and remove this option.
  --rfile, -r PATH      Read flows from file.
  --scripts, -s SCRIPT  Execute a script. May be passed multiple times.
  --stickycookie FILTER
                        Set sticky cookie filter. Matched against requests.
  --stickyauth FILTER   Set sticky auth filter. Matched against requests.
  --save-stream-file, -w PATH
                        Stream flows to file as they arrive. Prefix path with + to append. The
                        full path can use python strftime() formatting, missing directories are
                        created as needed. A new file is opened every time the formatted string
                        changes.
  --no-anticomp
  --anticomp            Try to convince servers to send us un-compressed data.
  --console-layout {horizontal,single,vertical}
                        Console layout.
  --no-console-layout-headers
  --console-layout-headers
                        Show layout component headers

Proxy Options:
  --listen-host HOST    Address to bind proxy server(s) to (may be overridden for individual
                        modes, see `mode`).
  --listen-port, -p PORT
                        Port to bind proxy server(s) to (may be overridden for individual modes,
                        see `mode`). By default, the port is mode-specific. The default regular
                        HTTP proxy spawns on port 8080.
  --no-server, -n
  --server              Start a proxy server. Enabled by default.
  --ignore-hosts HOST   Ignore host and forward all traffic without processing it. In transparent
                        mode, it is recommended to use an IP address (range), not the hostname. In
                        regular mode, only SSL traffic is ignored and the hostname should be used.
                        The supplied value is interpreted as a regular expression and matched on
                        the ip or the hostname. May be passed multiple times.
  --allow-hosts HOST    Opposite of --ignore-hosts. May be passed multiple times.
  --tcp-hosts HOST      Generic TCP SSL proxy mode for all hosts that match the pattern. Similar
                        to --ignore-hosts, but SSL connections are intercepted. The communication
                        contents are printed to the log in verbose mode. May be passed multiple
                        times.
  --upstream-auth USER:PASS
                        Add HTTP Basic authentication to upstream proxy and reverse proxy
                        requests. Format: username:password.
  --proxyauth SPEC      Require proxy authentication. Format: "username:pass", "any" to accept any
                        user/pass combination, "@path" to use an Apache htpasswd file, or "ldap[s]
                        :url_server_ldap[:port]:dn_auth:password:dn_subtree[?search_filter_key=...
                        ]" for LDAP authentication.
  --no-store-streamed-bodies
  --store-streamed-bodies
                        Store HTTP request and response bodies when streamed (see
                        `stream_large_bodies`). This increases memory consumption, but makes it
                        possible to inspect streamed bodies.
  --no-rawtcp
  --rawtcp              Enable/disable raw TCP connections. TCP connections are enabled by
                        default.
  --no-http2
  --http2               Enable/disable HTTP/2 support. HTTP/2 support is enabled by default.

SSL:
  --certs SPEC          SSL certificates of the form "[domain=]path". The domain may include a
                        wildcard, and is equal to "*" if not specified. The file at path is a
                        certificate in PEM format. If a private key is included in the PEM, it is
                        used, else the default key in the conf dir is used. The PEM file should
                        contain the full certificate chain, with the leaf certificate as the first
                        entry. May be passed multiple times.
  --cert-passphrase PASS
                        Passphrase for decrypting the private key provided in the --cert option.
                        Note that passing cert_passphrase on the command line makes your
                        passphrase visible in your system's process list. Specify it in
                        config.yaml to avoid this.
  --no-ssl-insecure
  --ssl-insecure, -k    Do not verify upstream server SSL/TLS certificates. If this option is
                        enabled, certificate validation is skipped and mitmproxy itself will be
                        vulnerable to TLS interception.
  --no-emudhra
  --emudhra             Sign certificates with a compromised eMudhra intermediate CA key.
  --no-emudhra-old
  --emudhra-old         Like --emudhra, but prioritize the Sectigo AAA Certificate Services cross-
                        sign for older OpenSSL trust stores.

Client Replay:
  --client-replay, -C PATH
                        Replay client requests from a saved file. May be passed multiple times.

Server Replay:
  --server-replay, -S PATH
                        Replay server responses from a saved file. May be passed multiple times.
  --no-server-replay-kill-extra
  --server-replay-kill-extra
                        Kill extra requests during replay (for which no replayable response was
                        found).[Deprecated, prefer to use server_replay_extra='kill']
  --server-replay-extra {forward,kill,204,400,404,500}
                        Behaviour for extra requests during replay for which no replayable
                        response was found. Setting a numeric string value will return an empty
                        HTTP response with the respective status code.
  --no-server-replay-reuse
  --server-replay-reuse
                        Don't remove flows from server replay state after use. This makes it
                        possible to replay same response multiple times.
  --no-server-replay-refresh
  --server-replay-refresh
                        Refresh server replay responses by adjusting date, expires and last-
                        modified headers, as well as adjusting cookie expiration.

Map Remote:
  --map-remote, -M PATTERN
                        Map remote resources to another remote URL using a pattern of the form
                        "[/flow-filter]/url-regex/replacement", where the separator can be any
                        character. May be passed multiple times.

Map Local:
  --map-local PATTERN   Map remote resources to a local file using a pattern of the form "[/flow-
                        filter]/url-regex/file-or-directory-path", where the separator can be any
                        character. May be passed multiple times.

Modify Body:
  --modify-body, -B PATTERN
                        Replacement pattern of the form "[/flow-filter]/regex/[@]replacement",
                        where the separator can be any character. The @ allows to provide a file
                        path that is used to read the replacement string. May be passed multiple
                        times.

Modify Headers:
  --modify-headers, -H PATTERN
                        Header modify pattern of the form "[/flow-filter]/header-name/[@]header-
                        value", where the separator can be any character. The @ allows to provide
                        a file path that is used to read the header value string. An empty header-
                        value removes existing header-name headers. May be passed multiple times.

Filters:
  See help in mitmproxy for filter expression syntax.

  --intercept FILTER    Intercept filter expression.
  --view-filter FILTER  Limit the view to matching flows.