Edit on GitHub

#  Filter expressions

Many commands in the mitmproxy tool make use of filter expressions. Filter expressions consist of the following operators:

~aMatch asset in response: CSS, Javascript, Flash, images.
~b regexBody
~bq regexRequest body
~bs regexResponse body
~c intHTTP response code
~d regexDomain
~dst regexMatch destination address
~eMatch error
~h regexHeader
~hq regexRequest header
~hs regexResponse header
~httpMatch HTTP flows
~m regexMethod
~markedMatch marked flows
~qMatch request with no response
~sMatch response
~src regexMatch source address
~t regexContent-type header
~tcpMatch TCP flows
~tq regexRequest Content-Type header
~ts regexResponse Content-Type header
~u regexURL
~websocketMatch WebSocket flows
!unary not
&and
|or
(...)grouping

#  View flow selectors

In interactive contexts, mitmproxy has a set of convenient flow selectors that operate on the current view:

@allAll flows
@focusThe currently focused flow
@shownAll flows currently shown
@hiddenAll flows currently hidden
@markedAll marked flows
@unmarkedAll unmarked flows

These are frequently used in commands and key bindings.

#  Examples

URL containing “google.com”:

google\.com

Requests whose body contains the string “test”:

~q ~b test

Anything but requests with a text/html content type:

!(~q & ~t "text/html")