KittyProxy In Depth

Two Proxies, Two Use Cases

KittySploit exposes two network capture mechanisms that are often confused:

KittyProxy Installation and Verification

KittyProxy is distributed as a marketplace application:

market search kittyproxy
market install kittyproxy

Required Python dependency for mitmproxy:

pip install mitmproxy

If proxy start fails with a missing import, install mitmproxy then restart. In headless CLI mode, no KittyProxy web interface is started --- unlike launch_kittyproxy.py launched standalone.

Start and Stop --- proxy start|stop|status

Starting the Headless Proxy

proxy start
proxy start --host 127.0.0.1 --port 8080
proxy start --host 127.0.0.1 --port 8080 -v

Expected output (success):

[+] KittyProxy started on 127.0.0.1:8080 (headless mode)

With -v, the framework displays the proxy URL configured for internal modules (e.g.\ http://127.0.0.1:8080).

Checking Status

proxy status

Useful fields: Running, Host, Port, Uptime. If a proxy is already active, proxy start displays a warning without launching a second instance.

Stopping Cleanly

proxy stop

Stopping restores the previous framework proxy configuration if it was saved at startup. Always run proxy stop at the end of a test session to prevent subsequent modules from transiting through a dead proxy.

Browser Configuration and TLS Certificate

System or Browser Proxy

Configure the HTTP/HTTPS proxy to 127.0.0.1:8080 (or the chosen port). On Linux:

export http_proxy=http://127.0.0.1:8080
export https_proxy=http://127.0.0.1:8080

For Firefox: Settings → Manual proxy → HTTP and SSL to 127.0.0.1:8080.

HTTPS and mitmproxy Certificate

Without an installed certificate, HTTPS sites display TLS warnings. For plain HTTP DVWA, this is not blocking. As soon as you test https:// or TLS isolated test environments:

1. Start KittyProxy once.
2. Retrieve the mitmproxy CA certificate (usual location /.mitmproxy/).
3. Import it as a trusted authority in the dedicated test test browser.

Never import this certificate into a personal browser used for everyday browsing.

Interactive Mode --- proxy interactive

Interactive mode provides a text console without GUI to browse captured flows.

Launch

proxy interactive
proxy interactive --auto-start
proxy interactive --auto-start --host 127.0.0.1 --port 8080

Without an active proxy, proxy interactive alone displays a warning; --auto-start starts KittyProxy with the provided parameters.

Commands at the kittyproxy> Prompt

kittyproxy> help
kittyproxy> status
kittyproxy> list
kittyproxy> list 25
kittyproxy> show <flow_id>
kittyproxy> clear
kittyproxy> stop
kittyproxy> start
kittyproxy> exit

• list [limit] --- table of recent flows (ID, method, status, host, URL).
• show <flow_id> --- detail: URL, duration, request/response sizes.
• clear --- empties the flow_manager (start fresh on a clean session).
• stop / start --- proxy control without leaving interactive mode.

Typical Interactive Workflow

1. proxy interactive --auto-start
2. Browse DVWA: login, open vulnerabilities/sqli/, submit a form.
3. list 15 --- identify the POST request to sqli/.
4. show <id> --- note parameters, cookies, response code.
5. Copy observations into the workspace or launch the agent (next section).

HTTP Flow Data Model

Each flow captured by KittyProxy is stored in the flow_manager with notably:

• unique identifier (id) --- prefix displayed in list;
• HTTP method, full URL, status code;
• request/response headers and bodies (accessible depending on tool);
• duration (duration_ms), host, content lengths.

The framework also persists ProxyFlow models in the database for certain integrations (agent, API import). The agent reads these flows via kittyproxy.flow_manager when --reuse-proxy-auth is active.

http Command --- Manual Requests via the Proxy

The http command sends HTTP requests from the console, curl-style. It respects the framework proxy if KittyProxy was started via proxy start.

Basic Syntax

http http://127.0.0.1/
http http://127.0.0.1/login.php -I
http http://127.0.0.1/vulnerabilities/sqli/ -H "Cookie: security=low; PHPSESSID=abc123"
http http://127.0.0.1/vulnerabilities/sqli/ -X POST -d "id=1&Submit=Submit" -i

Advanced Options

http https://target.local/api -k -L
http http://127.0.0.1/ -A "KittySploit-Isolated test environment/1.0"
http http://127.0.0.1/ --timeout 30
http http://127.0.0.1/report.pdf -o /tmp/report.pdf
http http://127.0.0.1/ --proxy http://127.0.0.1:8080

• -I / --head --- HEAD request (headers only).
• -i / --include --- displays response headers with the body.
• -k / --insecure --- disables TLS verification (isolated test environment only).
• -L / --location --- follows redirects.
• -d / --data --- raw body; -j / --json --- JSON body.
• --proxy --- forces a proxy for this request only.

Proxy + http Chaining

proxy start --port 8080
http http://127.0.0.1/login.php -X POST \
  -d "username=admin&password=password&Login=Login" -i
proxy interactive --auto-start
kittyproxy> list 5

Verify that the login POST request appears in list with the session Set-Cookie.

Agent Integration --- --reuse-proxy-auth

The autonomous agent can import KittyProxy flows to reconstruct application state: cookies, discovered endpoints, forms, fuzzable parameters.

Recommended Sequence

workspace use owasp-dvwa-scan
proxy start --port 8080

Browse manually for ten to fifteen minutes on DVWA (login, SQLi, XSS, upload, logout/login).

proxy status
agent http://127.0.0.1 --no-exploit --reuse-proxy-auth --proxy-flow-limit 40

• --no-exploit --- reconnaissance and analysis without destructive modules.
• --reuse-proxy-auth --- seeds cookies and context from KittyProxy.
• --proxy-flow-limit 40 --- bounds the number of flows analyzed (adjust according to RAM).

Agent + Proxy Variants

agent http://127.0.0.1 --no-exploit --reuse-proxy-auth --plan-only --verbose
agent http://127.0.0.1 --no-exploit --reuse-proxy-auth --goal recon --safety-profile discreet
agent http://127.0.0.1 \
  --reuse-proxy-auth \
  --http-replay safe \
  --http-replay-max 3

--plan-only displays the plan without execution --- useful to audit what the agent would do with your flows. --http-replay safe replays requests without aggressive mutations; active mode requires --approve-active-replay.

Validation with Risk Approval

In the isolated test environment, after manual review of flows:

agent http://127.0.0.1 \
  --goal validate \
  --reuse-proxy-auth \
  --approve-risk active \
  --max-modules 15 \
  --threads 5

Document each --approve-risk in the report (read-only → active → intrusive according to mandate).

Debug Proxy --- debug_proxy

debug_proxy intercepts traffic generated by KittySploit modules (scanners, exploits, auxiliaries), not necessarily the browser. Default port 8888 (distinct from KittyProxy 8080).

Start and Status

debug_proxy start
debug_proxy start --host 127.0.0.1 --port 8888
debug_proxy start --mode socks --port 1080
debug_proxy status
debug_proxy stop

status displays: HTTP/SOCKS mode, number of captured requests, capture flags (HTTP, HTTPS, TCP, UDP).

List and Inspect

debug_proxy list
debug_proxy list --limit 30
debug_proxy list --method POST
debug_proxy list --protocol HTTPS
debug_proxy show <request_id>
debug_proxy show <request_id> --raw

show details: timestamp, URL, headers, truncated body (500 characters except with --raw), response code, duration.

Binary Analysis and Replay

debug_proxy hexdump <request_id>
debug_proxy hexdump <request_id> --request
debug_proxy hexdump <request_id> --response
debug_proxy replay <request_id>

Hexdump helps with binary uploads, compressed responses, or ambiguous encodings. replay resends the request via the proxy manager --- practical for reproducing module behavior.

Export and Purge

debug_proxy export /tmp/capture_lab.json --format json
debug_proxy export /tmp/capture_lab.har --format har
debug_proxy clear

HAR format is interoperable with Chrome DevTools, Burp (import), and api_import:

api_import /tmp/capture_lab.har --type traffic --kind scanner --force

KittyProxy vs debug_proxy --- When to Use Which

Combined professional workflow:

1. proxy start + manual navigation (business context).
2. debug_proxy start + use scanner/... ; run (technical debug).
3. Correlation of both captures in the report (same endpoint, different parameters).

Step-by-Step DVWA Workflow

Phase 1 --- Initialization

lab start dvwa-basics
workspace create dvwa-proxy-isolated test environment
workspace use dvwa-proxy-isolated test environment
scope add 127.0.0.1
proxy start --port 8080 -v
proxy status

Phase 2 --- Authentication

1. Configure the browser to 127.0.0.1:8080.
2. Open http://127.0.0.1/setup.php on first install; otherwise /login.php.
3. Log in admin / password.
4. Set DVWA Security to Low.

Parallel console verification:

proxy interactive --auto-start
kittyproxy> list 10

Identify the login.php POST flow and note the PHPSESSID.

Phase 3 --- Vulnerability Walkthrough

Visit each module at least once submitting an innocuous payload (1, test):

• Brute Force --- observe absent rate limiting.
• Command Injection --- ip parameter.
• CSRF --- form without robust token.
• File Inclusion --- page parameter.
• SQL Injection --- id parameter.
• SQL Injection (Blind) --- inference.
• Weak Session IDs --- predictable generation.
• XSS (DOM) --- client-side fragment.
• XSS (Reflected) --- reflected parameter.
• XSS (Stored) --- database persistence.
• CSP Bypass --- depending on level.

Every minute, in the console:

kittyproxy> list 20

Phase 4 --- Targeted Inspection

Choose the most informative SQLi POST flow:

kittyproxy> show a1b2c3d4e5f6

Transcribe: URL, POST parameters, cookies (security=low), code 200, possible SQL error indicator.

Manual replay with http:

http "http://127.0.0.1/vulnerabilities/sqli/?id=1&Submit=Submit" \
  -H "Cookie: security=low; PHPSESSID=VOTRE_SESSION" -i

Phase 5 --- Enriched Agent

agent http://127.0.0.1 --no-exploit --reuse-proxy-auth --proxy-flow-limit 50 --verbose
agent explain <run_id>

Analyze explain: which endpoints derived from flows? which scanner modules proposed?

Phase 6 --- Closure

proxy stop
debug_proxy stop
workspace save
campaign --preview

Advanced Use Cases

Multi-Port and Binding

proxy start --host 0.0.0.0 --port 8080

0.0.0.0 exposes the proxy on all interfaces --- useful if DVWA runs in a VM and the browser on the host. Limit to the isolated test environment; do not bind on the Internet without a firewall.

Correlation with scanner

After proxy capture of an /admin/ endpoint:

use scanner/http/admin_panel_detect
set rhost 127.0.0.1
run

debug_proxy list --method GET
debug_proxy show <id>

Compare the module request with your navigation: User-Agent, paths followed, redirects.

Tor and External Proxy

If Tor is active in the framework, http may use it by default. To force local KittyProxy:

proxy start --port 8080
http http://127.0.0.1/ --proxy http://127.0.0.1:8080

External Traffic Import

Traffic captured in Burp or another tool:

api_import burp_export.xml --type traffic --kind scanner
api_import session.har --type traffic --kind scanner --force

Then chain an agent or manual analysis of imported endpoints.

Common Troubleshooting

KittyProxy Won't Start

market install kittyproxy
pip install mitmproxy
proxy start -v

Verify that no other service occupies the port (8080).

No Flows in list

• Browser misconfigured (proxy disabled, wrong port).
• HTTPS traffic without mitmproxy certificate --- connection fails before capture.
• Application ignores proxy (hardcoded, Electron with system proxy disabled).

Minimal test:

proxy start
http http://127.0.0.1/ --proxy http://127.0.0.1:8080
proxy interactive --auto-start
kittyproxy> list 5

Agent Ignores Flows

• Premature proxy stop before agent.
• Forgotten --reuse-proxy-auth.
• --proxy-flow-limit too low --- increase (e.g.\ 80).
• Accidental clear in interactive mode.

Port Conflict proxy / debug_proxy

Use distinct ports:

proxy start --port 8080
debug_proxy start --port 8888

Operational Best Practices

1. One session, one objective --- clear before each distinct capture.
2. Timestamping --- note capture start/end time in the workspace.
3. Minimization --- do not capture data outside scope (scope).
4. Export encryption --- HAR/JSON files stored encrypted if real credentials.
5. Explicit stop --- proxy stop at end of mission.

Complementarity with OWASP Scanners

The previous chapter maps OWASP via scanner. KittyProxy fills blind spots:

• parameters not discovered by wordlist (list after real usage);
• conditional headers (authenticated vs anonymous);
• CSRF tokens and session cookies for --reuse-proxy-auth;
• multi-step chains (cart, checkout, business workflow).

Typical chaining:

scanner -u http://127.0.0.1 --module security_headers_detect
proxy start
# authenticated DVWA navigation
agent http://127.0.0.1 --no-exploit --reuse-proxy-auth
vuln list
campaign --preview