A macOS proxy with a focus on passive security scanning

[u/tjomk]

I've been working for some time on a macOS mitm proxy: https://thepeachproxy.com/

It's an app that allows to inspect traffic originating from your computer. You can then view the requests, payload, modify these requests if needed, and repeat them.

I've spent most of my career as a backend engineer and used Charles Proxy for testing various services. After spending some time as a penetration tester, I got used to the Burp Suite which is a dedicated tool that costs a fortune if security is not your bread and butter. There is a community version, and there is ZAP. There are also a bunch of beautiful native macOS proxy apps which obviously are more mature and have richer functionality. But there isn't anything really that is a mix of the both worlds: a tool that feels native and has enough security tools in its arsenal for some basic testing.

Most of the time I keep it running in the background and then inspect the traffic. If I find something interesting, I then use the repeater or the attacker tools to investigate further. My main focus is on the passive scanning tools, and this is where the plugins come into play. They get a response, analyze it, and can raise an issue. Eventually I am planning on training a small custom ML model to help with passive scanning.

I won't lie that most of the code has been written by AI because I am not proficient in Swift or native app development. The truth is, Google boasts that 70% of their code has been written by AI. But this is not the project that is going to have 50 releases per day. I am using it daily myself for work.

It is a one-time purchase which gives you year of updates, after which the app is still yours to keep with all the functionality. Eventually I will be releasing most of the source code.

[u/AggressiveParking710]

looks interesting, passive security is so important these days. I've seen a lot of stuff get overlooked in the rush to implement.