hexbuffer-proxy
High-performance HTTPS Man-in-the-Middle (MITM) proxy library for Rust built on Tokio, Hyper, and rustls. Features connection pooling, WebSocket frame-level interception, and dynamic TLS certificate forging.
Feature Flags
| Feature | Default | Description |
|---|---|---|
| decoder | Enabled | Application-level request/response body decompression (decode_request, decode_response), re-encoding (encode_body), and DecodeHandler plugin for gzip, deflate, brotli, and zstd. |
Quick Start — Minimal Proxy
Set up a pass-through HTTPS proxy server listening on 127.0.0.1:8080 in under 20 lines of Rust code.
127.0.0.1:8080 and trust cert/ca.pem for HTTPS interception.Architecture & Pipeline Flow
Understand how hexbuffer-proxy handles TCP connections, TLS certificate forging, HTTP handler chains, and WebSocket upgrades.
hexbuffer-proxy Execution Lifecycle
Click any phase in the pipeline flow to inspect runtime hooks and behavior.
TLS Interception Check
Evaluates `should_intercept_tls(host)` and `is_enabled()`. If false, raw TCP tunneling bypasses decryption (ideal for cert-pinned domains). If true, on-the-fly CA certificate forging generates dynamic DER certificates via rcgen.
HttpHandler::should_intercept_tls(&self, host: &str)Public API Reference
Re-exports (Crate Root)
| Symbol | Kind | Module | Description |
|---|---|---|---|
| ProxyBuilder | struct | builder | Builder-pattern proxy configuration and assembly |
| Proxy | struct | builder | Ready-to-run proxy instance |
| CertificationAuthority | struct | ca | CA certificate authority & per-domain certificate forging |
| HttpHandler | trait | handler | Trait for inspecting/modifying HTTP requests & responses |
| WebSocketHandler | trait | handler | Trait for inspecting/modifying WebSocket frames |
| NoopHandler | struct | handler | Pass-through HttpHandler implementation (default) |
| NoopWebSocketHandler | struct | handler | Pass-through WebSocketHandler implementation |
| HttpContext | struct | handler | Metadata for an intercepted HTTP request/response pair |
| Body | enum | handler | HTTP body representation (Streaming or Full) |
| RequestOrResponse | enum | handler | Return value of handle_request (forward vs short-circuit) |
| Direction | enum | handler | WebSocket frame direction (ClientToServer / ServerToClient) |
| WebSocketMessage | type | handler | Re-export of tokio_tungstenite::tungstenite::Message |
| full_body | fn | handler | Helper function creating Full<Bytes> body from bytes |
| ProxyError | enum | error | Error variants returned by proxy operations |
| Result<T> | type | error | Alias for std::result::Result<T, ProxyError> |
| decoder | module | decoder | Application-level body decompression/re-encoding module |
ProxyBuilder
Builder struct for assembling and configuring a Proxy.
Proxy
A fully assembled proxy server instance created by ProxyBuilder::build.
CertificationAuthority
Handles self-signed CA generation, file persistence, and dynamic per-host TLS certificate forging.
HttpHandler (trait)
Core trait for inspecting or mutating HTTP traffic flowing through the proxy pipeline.
WebSocketHandler (trait)
Trait for frame-level inspection and modification of WebSocket traffic.
ProxyError & Result
Comprehensive error variants returned by proxy operations.
Usage Recipes
Select a recipe below to view common implementation patterns and handler code.
1. Request & Response Logging
Inspect incoming HTTP method, URI, and outgoing response status with atomic request ID tracking.
Graceful Shutdown
Handle Ctrl+C signals gracefully using tokio::select!:
Ready to Intercept Traffic with hexbuffer-proxy?
Integrate high-speed MITM proxy capabilities into your security tools, web fuzzers, or test automation suites today.