Mitmproxy tampering GET and POST request/response in one script

问题

A POST request to a certain url(http://test.com) is like:

{

"messageType": "OK",
"city": {
    "Name": "Paris",
    "Views": {
        "1231": {
            "id": 4234,
             "enableView": false
        },
    },
    "Views": [5447, 8457],
    "messages": [{
        "id": "message_6443",
        "eTag": 756754338
    }]
},
"client": {
    "Id": 53,
    "email": "test@test.us",
    "firstName": "test",
    "lastName": "test",
    "id": 52352352,
    "uuid": "5631f-grdeh4",
    "isAdmin": false,

I need to intercept that and change "isAdmin" to true.

And a GET request to a certain url (https://test.com/profiles/{Random_Numbers}/id}) has a 'response' [decoded gzip] JSON

{
"id": 0, 
"Code": "Admin", 
"display": "RRRR"
}

I need to change "id" value to 5.

So Basically I need to write one script that will do these two.

So far I have tried to take help of the example codes in Github, but I have had no expected result. (I'm a complete noob :\ ) and hoping someone here can help me get started. Thanks in advance!

Edit: As per the example codes in Github, modify_response_body.py :

from libmproxy.protocol.http import decoded

def start(context, argv):
  if len(argv) != 3:
   raise ValueError('Usage: -s "modify-response-body.py old new"')
    context.old, context.new = argv[1], argv[2]


def response(context, flow):
    with decoded(flow.response):  # automatically decode gzipped responses.
      flow.response.content = flow.response.content.replace(context.old, context.new)`

How do I implement this for my senario?

Probably using the libmproxy to get http-request and response would be a better idea, maybe.

回答1:

The script you posted and Python's JSON module should get you pretty far:

def response(context, flow):
    if flow.request.url == "...": # optionally filter based on some criteria...
        with decoded(flow.response):  # automatically decode gzipped responses.
            data = json.loads(flow.response.content)
            data["foo"] = "bar"
            flow.response.content = json.dumps(data)

来源：https://stackoverflow.com/questions/29881998/mitmproxy-tampering-get-and-post-request-response-in-one-script

标签

python

regex

proxy

mitmproxy

inline-scripting