Mitmproxy vs Opera about oprah-proxy

[spaze]

Most probably.

[nampud]

There's not much to analyze, the protocol is practically the same, except the change from password headers to digest authorization, and the change of urls from /v2/ to /v4/. And you cannot get the digest auth password by dumping the network traffic, because the hash that gets sent is different every time (this is why digest auth is more secure). I couldn't find the key in the binary, but found some obfuscated strings. I was too lazy to analyze the deobfuscation with disassemblers, so I ended up dumping the API key from the RAM, and it actually works, the obtaining of proxies and proxy username/passwords works fine after editing the oprahProxy script.
Yes, it's certificate pinning, and I couldn't disable it yet. The net-internals page is showing ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN. BTW you can analyze the protocol using chrome://net-internals (into address bar) with the event tab.