The free and open-source proxy software that I have chosen to use is called simply “ mitmproxy”. In either case the hacker is able to inspect the traffic between your device and the intended destination. In a variation of this scenario the hacker may have previously compromised the CoffeeShop’s real Wi-Fi access point and could be forwarding the traffic from the access point to his machine.

With some effort it is also possible that the hacker can be snooping on your HTTPS traffic. The problem is this access point has nothing to do with the coffee shop, it’s actually running on a device in the pocket of a nearby hacker, and now any non-HTTPS traffic that is sent between your laptop and the websites you visit are visible to the hacker, and can be recorded for later inspection. It may even have a “fake” portal with the same “correct” password that was given to you by a (legitimate) barista. Perhaps you are in a coffee shop and see on your phone that there is an access point called “CoffeeShop FREE Wi-Fi”. This way they could detect someone moving sensitive information outside of the company’s controlled environment, and also attempt to prevent malware from being installed on staff machines.Īn example of a truly malicious MITM proxy would be a Wi-Fi access point that you may connect to thinking it is trustworthy. The majority of large corporate organizations usually employ a MITM proxy to scan and filter digital traffic moving within their internal network and an outside network (such as the internet). It may even manipulate the request being sent, or modify the information coming back.Ī MITM proxy need not be “malicious”, although I guess this depends on your view of information privacy and the implementation of IT security controls. The proxy is able to intercept and parse the information being sent back and forth between the client and the server. a Wi-Fi access point or a network router) in between a client (your phone, your laptop) and the server you intend to communicate with. What is a Man-In-The-Middle ProxyĪn man-in-the-middle proxy is a piece of software running on a device (e.g.

I have repeated much of the original content, especially the overview and explanations, so you do not need to refer back to the original 2019 post. This post is an update to my 2019 page on Running a man-in-the-middle proxy on a Raspberry Pi 3, now revisited and rewritten to accommodate using a Raspberry Pi 4, the current version of mitmproxy (v8.0.0), Raspberry Pi OS (bullseye) as well as changes to how some of the software is installed and configured.

Network traffic monitor raspberry pi