Iron Proxy is a programmable egress proxy designed for securing and monitoring outbound traffic from untrusted workloads. It functions as a Man-in-the-Middle (MITM) proxy with built-in DNS interception, capable of inspecting and transforming HTTP/HTTPS, TCP tunnels, and PostgreSQL traffic. The system features a pluggable transform pipeline for access control, secret injection, authentication (AWS/GCP/OAuth), LLM-based policy enforcement, and Model Context Protocol (MCP) filtering. Architecture includes modular components for proxy handling, DNS server, transform pipeline, configuration management, and optional control plane synchronization. Deployment options range from standalone mode to managed mode via control plane, with support for Docker, Helm, and nftables enforcement. Key capabilities include structured JSON audit logging, OpenTelemetry integration, TLS MITM with dynamic certificate generation, and secret resolution from multiple backends (environment, AWS, 1Password).
Keydd is an HTTP(s) proxy tool that performs sensitive information detection and AI-driven API business logic analysis. It acts as a MITM proxy to intercept traffic, matches content against 30+ regex patterns for credentials/API keys, and optionally uses LLMs to analyze API endpoints for business purpose, sensitivity, and penetration priority. The architecture features separate layers for proxy handling, rule-based detection, AI analysis (with rate limiting, token tracking, and metrics), database persistence (SQLite/MySQL/PostgreSQL), and notifications. Key entry points include main.go for startup, proxy/handler.go for traffic processing, and cmd/match_rules.go for sensitive pattern matching.
SLRP is a rotating open proxy multiplexer that automatically discovers, validates, and rotates proxies from dozens of online sources. It runs as a single Go binary with an embedded Web UI and provides both a REST API and an MITM HTTP/HTTPS proxy endpoint. Internally, it uses a modular architecture with components for source scraping, proxy checking, pool management, request history recording, and IP geolocation. It features a custom query language for filtering proxy pool, history, and blacklist data, and includes a code generator to create type-safe dataset accessors from Go struct definitions. The system persists state to disk and can be configured via YAML or environment variables.
OWTF (Offensive Web Testing Framework) is a full-stack web application for automated and manual penetration testing. The Python/Tornado backend exposes a JWT-protected REST API for managing targets, sessions, plugin worklists, workers, reports, and proxy history, while the React/Redux frontend provides dashboards, data tables, plugin marketplace, and proxy controls. The application also includes a customizable intercepting HTTP/HTTPS proxy with SSL certificate generation, an interceptor chain for header/body/URL/delay modification, transaction history, a repeater, and live interception - comparable in scope to a Burp Suite-style tool. Execution is plugin-driven: built-in Python plugins covering web, network, and auxiliary tests, plus wrappers around external tools like Nikto and Arachni, are run by multiprocessing workers. Community plugins can be uploaded after AST-based static validation that blocks dangerous imports and execution patterns. The system stores plugin outputs, deduplicates them via SHA-256 fingerprints, tracks execution metrics, and supports HTML reporting. User authentication includes JWT, email verification, OTP, and admin role management. Architecturally, this is a monolith with modular managers and a REST API, not microservices. Deployment targets Docker Compose, Kubernetes, and cloud Terraform. The codebase contains genuinely reusable components: AST-based plugin validation, cross-platform file locking, output fingerprint deduplication, structured logging, and SQLAlchemy query helpers. However, it also carries significant legacy debt: old frontend patterns (React 16 class components, Redux 3, Redux-Saga 0.16), Python 2 remnants in scripts, hardcoded secrets in compose files, and several stub or placeholder external plugins. The repository is fundamentally an application rather than a data research project; bundled dictionaries and execution metrics serve the security workflow but do not define its primary character.
cursor-vip is a client-side Go/TUI application that lets users share Cursor IDE Pro accounts. At runtime it presents a terminal wizard: it fingerprints the machine (MAC-based device ID + machine-id), contacts a private licensing backend (hardcoded hosts: cursor.jeter.eu.org), prints the user's promotion stats, expiry, and payment links, then starts one of several "modes" that make the locally installed Cursor app authenticate as a shared Pro user. Mode 1 is the minimalist mode; modes 2-4 run a local MITM proxy (go-mitmproxy fork) that requires the user to install a trusted root certificate and intercepts Cursor's API traffic, with mode 3 doing free-trial account rotation and mode 4 providing a dedicated "exclusive" account. The core Cursor-manipulation code lives in an `auth/` package absent from this snapshot - go.mod shows it vendors local forks of `machineid` and `go-mitmproxy` - so the visible code is only the client shell, payment flow, and OS plumbing. Architecturally it is a monolith split into packages: `tui` (terminal UI with embedded i18n locale files for 7 languages), `tui/client` (HTTP client using beego v1's httplib against the private API), `tui/shortcut` (a global keyboard hook recognizing typed 3-letter codes like `sm1`/`u3d`/`buy` to switch modes, refresh accounts, or buy access), and `tui/tool` (OS utilities: locale detection, system-proxy configuration for Windows/macOS/Linux, flock-based single-instance enforcement, and MAC fingerprinting). The build script targets 3 OSes x 3 architectures and obfuscates most binaries with `garble`, consistent with a grey-market licensing tool that expects to be reverse-engineered. The project is actively maintained (last commit March 2026) and clearly works for its user base, but the code is average quality: global mutable state in a `params` package, string-concatenated endpoint paths, no tests or CI, an unconditional `mode = 3` override bug in `GetConfig`, and deprecated dependencies (beego v1, dgrijalva/jwt-go v3.x). It also has a questionable security posture - it instructs Mac users to disable SIP, asks for a trusted root CA for the MITM proxy, and requires Windows admin privileges. Engineers should not reuse this codebase as-is for legitimate licensing work; the genuinely extractable parts are the cross-platform OS utilities (locale detection, proxy toggling, single-instance lock, device fingerprinting).
This is an Android application for network traffic capture and diagnostics, functioning as a mobile proxy similar to Fiddler. The core functionality revolves around intercepting HTTP/HTTPS traffic via a locally running BrowserMobProxy instance, capturing requests/responses in HAR format, and providing tools for modifying traffic (via response injection rules), exporting captures, and performing network diagnostics (ping, DNS, traceroute). The architecture follows standard Android patterns with Activities, Fragments, Services, and Utils classes, but integrates deeply with modified versions of Netty, BrowserMob Proxy, and LittleProxy for MITM capabilities. Key entry points include MainActivity (UI launcher), SysApplication (proxy initialization), MyVpnService (system-wide traffic capture via VPN), and LDNetDiagnoService (diagnostic tasks). The application requires manual installation of a CA certificate for HTTPS interception and stores configuration in SharedPreferences. While functional, the codebase exhibits maintenance challenges including reflection-heavy Android version-specific code, complex SSL/TLS management, static state risks, and dependencies on forked libraries that may lag upstream.