Could you provide an example of using it for injecting code?

[OnkelTem]

Please, could you kindly provide an example of a mitm proxying an https website on a specific domain and injecting some JavaScript file?

I feel like it's gonna take ages for me to come up with a working code.

[pimterry]

It depends a lot of what you want to do, but the basic idea is something like this:

server.forAnyRequest()
    .forHostname('example.com')
    .thenPassThrough({
        beforeResponse: async (req) => {
            console.log('Injecting script');
            let bodyText = await req.body.getText();
            const endOfBodyIndex = bodyText.indexOf('</body>');
            bodyText = bodyText.slice(0, endOfBodyIndex) +
                "<script>alert('hi!');</script>"
                + bodyText.slice(endOfBodyIndex);

            return { body: bodyText };
        }
    });
server.forUnmatchedRequest().thenPassThrough({});

I.e. define one specific rule that matches the traffic you're interested in, proxying it and rewriting the response with beforeResponse, and define a fallback rule (with forUnmatchedRequest()) that just proxies as normal.

[OnkelTem]

@pimterry Thank you very much, I'm gonna try it!

[OnkelTem]

@pimterry Thanks, it works! This is brilliant. Now I can investigate it further.

What for — a good question. I resent the way, browser manufacturers have chosen with regard to the end-user's ability to influence the content they receive. Basically, we cannot control almost anything. We cannot tweak a website in a reasonable scale even with the extensions, because they don't have access to the data site receives. Yet, it's a content that we literally have on our devices and we could program it using open javascript language. I understand it's done in the pursuit of safety. But it is little consolation.

One example. Twitter website is a React app which makes regular requests to the API. It sends back lots of useful information, which gets rendered the way how Twitter programmers saw it fit. That's fine. But I may have another opinion. I may want to render it differently. It's not a big deal once you have access to the already received data. And that's what I plan to do :)

[pimterry]

Ah, I see, that makes sense, I look forward to seeing what you build! Feel free to open more issues if you have any problems with Mockttp at all.