HTTP debugging proxies compared: mitmproxy, Charles, Fiddler, Burp and ZAP

Five tools dominate HTTP debugging: mitmproxy, Charles, Fiddler, Burp Suite and OWASP ZAP. They do the same core job, sit between a client and a server, decrypt HTTPS, and let you read and change the traffic, so the choice comes down to how you work. Write Python and automate: mitmproxy. Debug a mobile app on a desktop: Charles or Fiddler. Run an authorised security test: Burp or ZAP. This piece compares them on the things that decide it, TLS interception, scripting, price, and chaining to an upstream proxy, and links to a full setup guide for each.

#What they share, and the one trick they all use

Every tool here is a man-in-the-middle proxy. For plain HTTP that is trivial: the proxy reads the request. For HTTPS, the tool installs its own root certificate on your machine, then issues a certificate for each site on the fly so your client trusts the connection to the tool, which opens a second, real connection to the site. That is why all of them need a certificate step before they show anything inside HTTPS, and why they work only on devices and apps you control. Two consequences fall out of it, and they apply to all five:

• The TLS handshake the site sees is the tool's, not your client's. We confirmed this against a test server: the set of key-exchange groups a plain curl offered differed from the set the server saw through mitmproxy. A target that scores the TLS fingerprint can behave differently with any of these proxies in the path.
• Certificate pinning defeats them. An app that checks the server's key against a built-in copy rejects the tool's issued certificate whatever the device trusts. A pinned curl request failed through mitmproxy and passed through a plain forwarding proxy in our test.

Keep both in mind before you blame a provider for a block that only appears while a debugger is attached.

#The quick decision

#TLS interception and certificates

All five decrypt HTTPS the same way; they differ in how you install the certificate and how finely you choose what to decrypt.

• mitmproxy writes its CA to ~/.mitmproxy/ on first run. You trust it per client with --cacert, REQUESTS_CA_BUNDLE or NODE_EXTRA_CA_CERTS, or fetch it from http://mitm.it in a proxied browser.
• Charles installs its root certificate from Help > SSL Proxying > Install Charles Root Certificate, and you add only the hosts you want decrypted in SSL Proxying Settings. Everything else stays an opaque tunnel.
• Fiddler Everywhere trusts its CA from Settings > HTTPS, where Capture HTTPS traffic is off until you do. It can export the certificate in DER, PEM or PKCS 12 for a phone or another tool.
• Burp gives its embedded browser a trusted certificate automatically; an external browser downloads the CA from http://burp.
• ZAP generates a CA on first run, exported from Options > Network > Server Certificates.

Charles's per-host decryption list is the gentlest for app work, because you decrypt one API and leave the rest tunnelled. The security tools lean the other way, decrypting broadly within a defined scope.

#Scripting and automation

This is the sharpest divide.

• mitmproxy is built for it. An addon is a Python file with functions like def response(flow): that receive each flow as a mutable object. In our test an eight-line addon logged every request that came back 403, 407 or 429 with the headers the client sent. mitmdump runs headless, which is what you want in CI.
• Burp has the Montoya API for Java extensions and a large catalogue of community BApps, plus Repeater, Intruder and the scanner for interactive work.
• ZAP scripts in JavaScript and other JVM languages, exposes a full REST API (we drove its proxy configuration entirely over that API), and runs headless for automation.
• Fiddler Everywhere added a beta Scripting tab with C# hooks (OnBeforeRequest, OnBeforeResponse and more), one active script at a time, alongside a visual Rules builder.
• Charles has rewrite rules, breakpoints and throttling, but no general scripting language. It is the one to skip if programmatic control is the point.

#Price model

No figures here, because they change; the shapes are what matter.

• mitmproxy and OWASP ZAP are free and open source, ZAP maintained under the OWASP umbrella.
• Burp Suite has a free Community Edition with the core manual tools, and a paid Professional sold as a per-user subscription for a multi-year term.
• Fiddler Everywhere is a per-user subscription with Lite, Pro and Enterprise plans. The older Fiddler Classic is free for non-commercial use and Windows only.
• Charles is paid software with a free trial download.

If budget is the deciding factor and you are not doing security testing, mitmproxy covers almost everything the paid tools do, minus the GUI polish.

#Chaining to an upstream provider

The reason this comparison lives on a proxy site: each tool can forward its own traffic through a commercial proxy, so requests reach the target from the provider's IP while you still read them locally. That lets you reproduce a geo-specific bug, or debug the exact traffic your scraper sends on the pool it runs on.

• mitmproxy: --mode upstream:http://HOST:PORT --upstream-auth USER:PASS. The upstream must be HTTP; it rejects a SOCKS upstream. See the mitmproxy guide.
• Charles: external proxy settings in the Proxy menu, separate HTTP, HTTPS and SOCKS entries, each with credentials. See the Charles guide.
• Fiddler Everywhere: Settings > Gateway > Manual proxy configuration. Its Gateway has no credential field, so for a username and password you put a small local forwarder in front of the proxy, as the Fiddler guide shows.
• Burp: a rule under Upstream proxy servers, or the SOCKS proxy setting. See the Burp guide.
• ZAP: the HTTP Proxy or SOCKS Proxy section under Network > Connection. See the OWASP ZAP guide.

For the HTTP versus SOCKS choice in any of them, HTTP vs SOCKS5 proxies has the detail; the short version is that the HTTP port is the simpler default and SOCKS5 carries non-HTTP traffic.

#So which one?

• Automating or working from a terminal: mitmproxy.
• Debugging a phone or desktop app's API, decrypting a few hosts: Charles, or Fiddler Everywhere if you want a team subscription and a Rules builder.
• Authorised web-security testing: Burp if you have the budget and want its scanner and extensions, ZAP if you want open source and a REST API.

Whichever you pick, chaining it to a static exit makes a location-specific bug reproducible. A datacenter IP gives a tolerant target a fixed address, and an ISP proxy gives you a static consumer-carrier address when the target scores the network; both list HTTP, HTTPS and SOCKS5 with username and password authentication, which every tool here accepts.