Back to OWASP Foundation
GSoC 2026

MiTM Proxy Upgrade for OWTF

OWTF's proxy silently drops every HTTPS transaction, blocks the entire event loop during live interception, and is written in deprecated Tornado coroutine syntax that prevents proper asyncio integration. I plan to fix this by rewriting the proxy core to use async/await throughout, replacing the threading-based CONNECT tunnel with a proper asyncio-native forwarding pipeline, and routing decrypted HTTPS traffic through the same CacheHandler and TransactionLogger chain that HTTP already uses. The result will be a proxy that records all traffic (HTTP and HTTPS), supports request and response modification hooks for both protocols, and does not freeze under concurrent load. Deliverables: async/await rewrite of proxy.py and main.py, working HTTPS transaction recording with PostgreSQL entries, fixed interceptor hook pipeline applying to both protocols, binary response handling using a bytes buffer instead of string accumulation, in-memory LRU cert caching, upstream cert CN/SAN mirroring, and functional tests covering each of these.

Project details

Contributor

saurabh42

Mentors

Not available

Technologies

Not listed in the archive