Intercept HTTPS traffic on non-standard port

[FabulousCupcake]

Hello!

I am running mitmproxy on transparent mode in Windows and I noticed there are some traffic from the client that I am observing that uses port 5000 to talk to the server. Upon closer look, it seems to just be a standard https traffic.
How do I go about to capture this and process it as it were a standard https traffic through port 443?

[FabulousCupcake]

Transparent mode on Windows seem to only capture traffic through port 80 and 443 (hardcoded), so I made a quick patch to /platform/windows.py to test it out.
While it seems that now mitmproxy sees these traffic, I couldn't get it to use the response event hook in the script I am writing.
Is there a way to tell or configure mitmproxy to treat this as http(s) traffic?

[FabulousCupcake]

Well nevermind me, that quick patch is enough, it just behaves a bit weirdly with --allow-hosts flag.

What I did instead was to listen for TLS ClientHello and ignore anything that is not using port 5000:

def tls_clienthello(data: mitmproxy.tls.ClientHelloData):
    if not data.context.server.address[1] == 5000:
        data.ignore_connection = True
        return

With this (over the --allow-hosts flag), I can now see the requests hitting my response(flow) hook.

[anadius]

tl;dr, use local mode, see the last paragraph

I had the same issue and since @FabulousCupcake deleted their fork I couldn't see their "quick patch". But I assume it had something to do with these lines:

mitmproxy/mitmproxy/platform/windows.py

Lines 424 to 429 in f05c050

	filter: str | None = "tcp.DstPort == 80 or tcp.DstPort == 443",
	) -> None:
	self.proxy_port = proxy_port
	self.filter = (
	filter
	or f"tcp.DstPort != {proxy_port} and tcp.DstPort != {REDIRECT_API_PORT} and tcp.DstPort < 49152"

I first tried changing line 424 to filter: str | None = "",, but line 429 doesn't take into account the web interface port for mitmweb. I could make it work but I wanted a solution that works out of the box, without modifying the source code.

My next idea was wireguard mode, but I wanted to do everything on one machine, so I wasn't sure that would work. And I wanted to use it for just one app. I read somewhere that WireSock (WireGuard client for Windows) supports "selective application tunneling".

But instead of trying that I decided to read the warning you get when running mitmproxy in transparent mode on Windows. It mentions "local redirect mode". I couldn't see anything about that mode in help message, but it wasn't hard to find a page that explains how it works.

So if you're on Windows or Mac (you can track issue #6531 for progress on Linux support) save yourself a trouble and use local mode instead of transparent one. Simply use --mode local or --mode local:<executable name>.