Moxy

Moxy (Next-Gen Man in the middle proxy) Open-source DAST tool for pentesting powered by agentic AI capabilities (Supporting Ollama). Built on top of browser-use, Moxy streamlines dynamic application security testing.

🚀 INSANELY EASY TO USE

And it's free, who doesn't like free stuff?

Preview Alert:
🚧 Moxy is in active development and currently in preview/beta.
Expect breaking changes, instability, and missing features.
Use at your own risk and follow project updates for latest improvements!

Quick Start

To run this for now, you need to run the frontend and backend separately.

Prerequisites

Before running Moxy, you need to install uv (astral-uv), a fast Python package installer and resolver.

Install uv:

• Follow the official installation guide to install uv on your system.

Note:
uv is required for managing Python dependencies in the backend. If you don't have it installed, the backend commands will fail.

Running the Backend

1. Navigate to the backend directory:

   root@kitploit:~

   cd backend
   

2. Install dependencies and run the backend server:

   root@kitploit:~

   uv sync
   uv run moxy
   

Running the Frontend

1. Navigate to the frontend directory:

   root@kitploit:~

   cd frontend
   

2. Install dependencies:

   root@kitploit:~

   npm install
   

3. Start the frontend development server:

   root@kitploit:~

   npm run moxy
   

Note:
By default, the frontend runs at http://localhost:8080
and the backend runs at http://localhost:5000

Docker Deployment

Moxy can be run using Docker for easier deployment and consistent environments. In this way you can collaborate and install easily.

Quick Start with Docker

Option 1: Using Pre-built Image (Recommended)

projects_data holds all the databases and logs needed. It's the data folder.

Pull and run the pre-built image from GitHub Container Registry:

docker run -d \
  --name moxy \
  -p 5000:5000 \
  -p 8081:8081 \
  -v $(pwd)/projects_data:/app/projects_data \
  ghcr.io/matank001/moxy:latest

Option 2: Build from Source

1. Build and start the container:

   root@kitploit:~

   docker-compose up -d --build
   

2. Access the application:

   • Frontend: http://localhost:5000
   • Proxy: http://localhost:8081

3. Configure your browser to use the proxy:

   When running in Docker, you need to manually configure your browser to use the proxy:

   • Proxy Host: localhost (or 127.0.0.1)
   • Proxy Port: 8081
   • Protocol: HTTP

   Note:
   The proxy runs inside the Docker container but is accessible on localhost:8081 on your host machine.
   You can configure proxy settings in your browser's network settings or use browser extensions for proxy management.

4. View logs:

   root@kitploit:~

   docker-compose logs -f
   

5. Stop the container:

   root@kitploit:~

   docker-compose down
   

Environment Variables

Create a .env file in the project root to configure the application (you need to put it inside the backend/ directory):

Note:
The .env file is optional. Docker Compose automatically loads it if present (no warning if missing).
All project data is persisted in the projects_data directory, which is mounted as a volume.

Agentic Tool

By default, Moxy works without requiring any AI configuration or credentials - even browser-based DAST flows don't use AI unless enabled.

Enabling Agentic AI

Moxy supports both OpenAI's API and Ollama (local AI) for agentic features. To enable AI-powered capabilities:

For local development: Create an .env file in the backend directory with the appropriate configuration.

For Docker: Create a .env file in the project root (same directory as docker-compose.yml).

Option 1: Using OpenAI API

For cloud-based AI processing with OpenAI, configure your .env file as follows:

OPENAI_API_KEY=sk-proj-...             # Your OpenAI API key
MODEL=gpt-4o-mini                       # Optional: defaults to gpt-4o-mini if not specified

Option 2: Using Ollama (Local AI)

For local AI processing with Ollama, configure your .env file as follows:

USE_OLLAMA=true
OPENAI_API_KEY=test                    # Required but value is ignored when using Ollama
OPENAI_BASE_URL=http://localhost:11434/v1/  # Ollama API endpoint
MODEL=qwen3:8b                         # Your preferred Ollama model

Capabilities of the Agent:

• Query prior captured HTTP requests
• Send/modify/resend new requests
• Operate a real browser (using browser-use) for dynamic tests and request creation

The agent uses AI to reason about your application's attack surface, replay or modify traffic, and even drive browser sessions to generate new test scenarios.

Warning:
The agentic AI modes are currently experimental and may be unstable.

Proxy

Moxy leverages MITMproxy as an intercepting HTTP/HTTPS proxy to capture and modify traffic during dynamic application security testing.

By default, the proxy runs on port 8081. You can configure your browser or system to use http://localhost:8081 as a proxy to route traffic through MITMproxy and allow Moxy to analyze and interact with requests in real time.

How to Configure Moxy in Firefox

To analyze HTTP and HTTPS traffic from Firefox through Moxy, you need to configure Firefox to use Moxy's proxy and import the proxy certificate so that browser traffic (including HTTPS) can be properly intercepted.

Step 1: Start Moxy and the Proxy

Make sure Moxy (and its MITMproxy process) is running.

Step 2: Configure Firefox to Use the Proxy

1. Open Firefox.
2. Go to Settings (or Preferences on some systems).
3. Scroll down to the Network Settings section (at the bottom).
4. Click Settings… next to "Network Settings."
5. Choose Manual proxy configuration.
6. Set HTTP Proxy to localhost and Port to 8081.
   • Check Also use this proxy for HTTPS or set SSL Proxy to localhost:8081 as well.
7. Click OK to save.

Now, all browser traffic will be routed through Moxy's proxy at http://localhost:8081.

Step 3: Import the Proxy Certificate

1. In Firefox (with the proxy still enabled), navigate to http://mitm.it.
2. The page will display download links for various certificates. Click the link for Firefox (or "Other" if that's not listed) to download the certificate (e.g., mitmproxy-ca-cert.pem).
3. Go to Settings → Privacy & Security in Firefox.
4. Scroll to the Certificates section and click View Certificates…
5. In the Certificate Manager, go to the Authorities tab.
6. Click Import… and select the certificate file you downloaded.
7. When prompted, check both boxes:
   • Trust this CA to identify websites
   • (Optional) Trust this CA to identify email users
8. Click OK to confirm.
9. Restart Firefox if prompted or if HTTPS sites still fail to load without warnings.

After completing these steps, Firefox will trust HTTPS connections intercepted by Moxy's proxy.
You are now ready to dynamically analyze and test web applications via HTTP and HTTPS without certificate warnings.

For more details, see MITMproxy's certificate docs.

Database Structure

• moxy.db - Main database storing project metadata
• projects_data/{project_name}.db - Individual project databases (named after project, sanitized)
  • Each project gets its own SQLite database file
  • When a project is renamed, its database file is automatically renamed
  • When a project is deleted, its database file is removed

Warning:
At this stage, there is no guarantee of database migration or backward compatibility between versions—future versions may break compatibility with old database files. Use with caution if you plan to upgrade.

Ethical Use Disclaimer

Moxy is designed strictly for ethical security testing and research purposes. It is intended to assist security professionals, developers, and organizations in identifying and remediating vulnerabilities in applications that they own or have explicit permission to test.