RaspberryPi as AccessPoint with 2 Wifi usb running MITMProxy and ParosProxy

Question

I was trying to study the HTTP(s) requests/response that the apps from my phone are sending so this is what I went ahead and created.

I turned my Raspberry Pi as an access point with 2 wifi usb dongles. One for my phone to connect to the "TEST" network and the second connected to the internet. Everything works fine and my phone is able to access internet via my RPi.

Now I setup MITMproxy (in transparent mode) so that I can sniff the traffic to-from from my phone apps. I installed the mitmproxy certificate on the phone and the traffic shows up fine on the mitmproxy console.

Final step - To make the web traffic data analysis part easier I found on the net that Paros Proxy might be able to help (show the traffic from mitmproxy) in a more readable way. - THIS IS NOT HAPPENING

I am assuming there is some setup required for ParosProxy so that it can be linked to mimtProxy / network interfaces which I am not able to achieve. Can any one please help with this?

ParosProxy dashboard doesnt show any traffic. As far as the settings (Tool->Options) the default settings are there ie for local proxy (host = localhost and port = 8080). I couldnt find much documentation about ParosProxy on the web. My network interfaces on the RPi is as follows : wlan0 (connected to internet) - DHCP wlan1 (Access Point to which the phone apps connect to) - static IP (gateway 192.168.10.1)

Just in case there is some other tool that could help me achieve the same (a GUI/better dashboard to analyse mitmproxy traffic in real time) I am pretty open for it.

Answer 1

Yes there is a better option: OWASP ZAP https://www.owasp.org/index.php/ZAP :) It was forked from Paros ~ 5 years ago, is very actively maintained and pretty well documented.

See https://github.com/zaproxy/zaproxy for links to the online user guide, FAQ user and developer groups.

FYI we have info on how to get ZAP runnin on a Pi: https://github.com/zaproxy/zaproxy/wiki/zappi but that doesnt include setting up wiki access - it would be great if we could update that page with the necessary steps :)

Simon (ZAP project lead)