Back to docs
Rust LibraryTokio • Hyper • rustls

hexbuffer-proxy

High-performance HTTPS Man-in-the-Middle (MITM) proxy library for Rust built on Tokio, Hyper, and rustls. Features connection pooling, WebSocket frame-level interception, and dynamic TLS certificate forging.

Feature Flags

FeatureDefaultDescription
decoderEnabledApplication-level request/response body decompression (decode_request, decode_response), re-encoding (encode_body), and DecodeHandler plugin for gzip, deflate, brotli, and zstd.

Quick Start — Minimal Proxy

Set up a pass-through HTTPS proxy server listening on 127.0.0.1:8080 in under 20 lines of Rust code.

src/main.rs
Note: Configure your application or browser to proxy traffic through 127.0.0.1:8080 and trust cert/ca.pem for HTTPS interception.

Architecture & Pipeline Flow

Understand how hexbuffer-proxy handles TCP connections, TLS certificate forging, HTTP handler chains, and WebSocket upgrades.

hexbuffer-proxy Execution Lifecycle

Click any phase in the pipeline flow to inspect runtime hooks and behavior.

Tokio • Hyper • rustls
Step 1

TLS Interception Check

Security & TLS

Evaluates `should_intercept_tls(host)` and `is_enabled()`. If false, raw TCP tunneling bypasses decryption (ideal for cert-pinned domains). If true, on-the-fly CA certificate forging generates dynamic DER certificates via rcgen.

Primary Hook:HttpHandler::should_intercept_tls(&self, host: &str)

Public API Reference

Re-exports (Crate Root)

SymbolKindModuleDescription
ProxyBuilderstructbuilderBuilder-pattern proxy configuration and assembly
ProxystructbuilderReady-to-run proxy instance
CertificationAuthoritystructcaCA certificate authority & per-domain certificate forging
HttpHandlertraithandlerTrait for inspecting/modifying HTTP requests & responses
WebSocketHandlertraithandlerTrait for inspecting/modifying WebSocket frames
NoopHandlerstructhandlerPass-through HttpHandler implementation (default)
NoopWebSocketHandlerstructhandlerPass-through WebSocketHandler implementation
HttpContextstructhandlerMetadata for an intercepted HTTP request/response pair
BodyenumhandlerHTTP body representation (Streaming or Full)
RequestOrResponseenumhandlerReturn value of handle_request (forward vs short-circuit)
DirectionenumhandlerWebSocket frame direction (ClientToServer / ServerToClient)
WebSocketMessagetypehandlerRe-export of tokio_tungstenite::tungstenite::Message
full_bodyfnhandlerHelper function creating Full<Bytes> body from bytes
ProxyErrorenumerrorError variants returned by proxy operations
Result<T>typeerrorAlias for std::result::Result<T, ProxyError>
decodermoduledecoderApplication-level body decompression/re-encoding module

ProxyBuilder

Builder struct for assembling and configuring a Proxy.

Proxy

A fully assembled proxy server instance created by ProxyBuilder::build.

CertificationAuthority

Handles self-signed CA generation, file persistence, and dynamic per-host TLS certificate forging.

HttpHandler (trait)

Core trait for inspecting or mutating HTTP traffic flowing through the proxy pipeline.

WebSocketHandler (trait)

Trait for frame-level inspection and modification of WebSocket traffic.

ProxyError & Result

Comprehensive error variants returned by proxy operations.

Usage Recipes

Select a recipe below to view common implementation patterns and handler code.

1. Request & Response Logging

Inspect incoming HTTP method, URI, and outgoing response status with atomic request ID tracking.

Graceful Shutdown

Handle Ctrl+C signals gracefully using tokio::select!:

Ready to Intercept Traffic with hexbuffer-proxy?

Integrate high-speed MITM proxy capabilities into your security tools, web fuzzers, or test automation suites today.