I've been building Cogitator, a terminal-based TLS MITM intercepting
proxy in Rust, primarily as a learning project for both network security
and the language itself. Would appreciate any feedback on architecture
and Rust-specific decisions.

Core stack:

• tokio 1 (full) — async runtime for the proxy core
• ratatui 0.26 + crossterm — TUI with 6 screens
• rcgen 0.13 — on-the-fly per-domain leaf certificate signing
• rustls 0.23 + tokio-rustls 0.26 + webpki-roots — TLS stack
• hyper 1.0 + hyper-util + http-body-util — HTTP layer
• reqwest 0.12 — outbound requests (brotli/gzip/deflate)
• libloading + inventory — external .so plugin system
• tracing + tracing-subscriber (json) — structured logging
• hickory-client — DNS queries

Decisions I'm unsure about and would love feedback on:

• Coexisting the async proxy core with the synchronous ratatui event
  loop via block_in_place / spawn_blocking — is there a cleaner
  pattern for this?
• Per-domain TlsAcceptor cache behind Arc<Mutex<HashMap>> —
  worth switching to DashMap?
• Using hyper 1.0 directly alongside reqwest 0.12 (which uses
  hyper internally) — is there redundancy here worth cleaning up?
• SiteAnalyzer trait for DI in the proxy pipeline — does this feel
  idiomatic or over-engineered for this scale?

What it does:

• TLS MITM with ALPN/HTTP2, WebSocket interception (RFC 6455)
• Frozen mode — pause live requests, edit headers/body, forward/drop
• Active scanner: SQLi (error-based), XSS (reflected/stored),
  Path Traversal
• Repeater, Intruder (Sniper/BatteringRam/Pitchfork/ClusterBomb),
  BFS Spider
• Plugin system with versioned ABI via cogitator-plugin-api crate

GitHub: GitHub - LeechoShoop/cogitator: Terminal TLS MITM intercepting proxy and web security toolkit written in Rust · GitHub

1 post - 1 participant

Read full topic