search

ProxymanApp / Proxyman

Modern. Native. Delightful Web Debugging Proxy for macOS, iOS, and Android ⚡️
https://proxyman.io
5.49k stars 180 forks source link

Support websocket breakpoints, scripting and compose #2088

Open mprice-banno opened 1 month ago

mprice-banno commented 1 month ago

Description

It appears that Apple has fixed the issue where websockets were not using the system proxy settings. I'm currently able to see websocket traffic again in Proxyman on an iOS 17.5.1 without using Atlantis.

Please add support for breakpoints and scripting for websockets with similar options to the existing feature, i.e. wildcard and regex support on websocket URL matching. Scripting allows automation of some testing scenarios, and would also allow the user to access sharedState variables that could be set outside of the websocket in the existing scripting frameworks. This would be really useful for those of us who have a hybrid websocket and API endpoint flow.

The ability to ignore ping/pong or heartbeat frames would be incredibly useful, so scripts would not have to run on each ping/pong.

In addition to breakpoints and scripting, compose would be very useful as well, to inject a frame onto the websocket in order to generate a response from the server for testing.

Why this feature/change is important?

Burp can do breakpoints, but the configuration and UI is terrible. It can't do scripting, and the whole experience is clunky and time consuming. Adding this support to Proxyman would greatly enhance it's feature set, especially if the breakpoints and scripts were located in the existing UI for those features, alongside API breakpoints and scripts.

NghiaTranUIT commented 1 month ago

Breakpoint and Scripting for WS. Do you mean that you'd like to modify the WS Message by manually sending/receiving each message?

Or modify the Request/Response Header ?

mprice-banno commented 1 month ago

Ideally I'd like to be able to modify the actual WS messages. Modify the JSON, both sending and receiving, same as https payloads. For my use case I don't see much need to modify the request/response headers, but others may have that need.