diff options
| author | srdusr <[email protected]> | 2026-06-24 14:40:00 +0200 |
|---|---|---|
| committer | srdusr <[email protected]> | 2026-06-24 14:40:00 +0200 |
| commit | e01afcbf0de00af52fe90959ba77288679e3303d (patch) | |
| tree | 073ff1430af629e28556a6f651ee47f6989376da /README.md | |
| parent | 23c8ab359c2108654d57176e233d2c099b398f31 (diff) | |
| download | mitmux-e01afcbf0de00af52fe90959ba77288679e3303d.tar.gz mitmux-e01afcbf0de00af52fe90959ba77288679e3303d.zip | |
SOCKS5 upstream proxy chaining
Extends -upstream-proxy to accept a socks5://[user:pass@]host:port
prefix, using golang.org/x/net/proxy (already an indirect dependency
via http2, so no new module) rather than hand-rolling the client side
of RFC 1928/1929. parseSOCKS5 is the single place that decides which
kind of upstream a given UpstreamProxy string names; dialViaProxy
(CONNECT/TLS path) and dialUpstreamPlain (plain-HTTP path) both check
it first and fall through to the existing HTTP CONNECT behavior
otherwise. SOCKS5 needs no absolute-form request adjustment on the
plain-HTTP path the way HTTP-proxy chaining does, since it tunnels
straight to the target rather than expecting a proxy-aware request.
Tested against a real, minimal SOCKS5 server built for the test suite
(exercises dialSOCKS5's actual wire behavior, not a mock of the
client library), plus live against a real standalone SOCKS5 relay
process: both a plain HTTP and an HTTPS request through mitmux were
confirmed, via the relay's own log, to have actually traversed it.
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -204,7 +204,9 @@ another *intercepting* proxy needs that proxy's own CA trusted too - it terminates and re-signs the connection with its own CA, which mitmux's outbound TLS client has no reason to trust otherwise; you'll see a clear certificate-verification error in history rather than a -silent failure. SOCKS5 upstreams aren't implemented. +silent failure. `-upstream-proxy socks5://[user:pass@]host:port` +chains through a SOCKS5 proxy instead - Tor, `ssh -D`, or any other +SOCKS5 relay - with optional username/password auth. ## Usage @@ -557,8 +559,6 @@ reasoning behind each: - `mitmuxd -install-ca` prints per-OS trust-store install steps; it never runs them for you (see Quick start above for why) - No WebSocket interception -- Upstream proxy chaining (`-upstream-proxy`) is HTTP CONNECT only, no - SOCKS5 - No active or passive vulnerability scanning, no plugin system - this is a manual-testing tool, not a scanner |