azure-cli-mitm

Proxy to intercept Azure CLI REST communications and append or modify Authorization Bearer tokens per Azure service domain.

Prerequisites

pip install -r requirements.txt

Token domains

Each token applies to hosts matched by suffix (first match wins):

Config key	Host suffixes
MANAGEMENT_TOKEN	.management.azure.com
GRAPH_TOKEN	.graph.microsoft.com
VAULT_TOKEN	.vault.azure.net
STORAGE_TOKEN	.storage.azure.com, .blob.core.windows.net, .file.core.windows.net, .dfs.core.windows.net

Behavior:

• Non-empty token → set Authorization: Bearer <token>
• Empty or unset token → remove the Authorization header
• No matching suffix → pass through unchanged

Usage

Generate the proxy CA certificate

python3 az-mitm.py --gen-cert -o ./certs

This writes cacert.pem (and mitmproxy CA files) under ./certs/.

Start the proxy

Default listening port is 8080 on 127.0.0.1.

Using a configuration file

python3 az-mitm.py -c config.txt [-v] [-p <LISTENING_PORT>]

Configuration File:

# Leave a value empty to remove the Authorization header for matching hosts.
# Omit or comment out keys you do not want to override.
MANAGEMENT_TOKEN=
GRAPH_TOKEN=
VAULT_TOKEN=
STORAGE_TOKEN=

Quick creation:

echo "MANAGEMENT_TOKEN=$(jq -r '."https://management.azure.com/"' /tmp/tokens.json)" >> config.txt
echo "GRAPH_TOKEN=$(jq -r '."https://graph.microsoft.com/"' /tmp/tokens.json)" >> config.txt
echo "VAULT_TOKEN=$(jq -r '."https://vault.azure.net/"' /tmp/tokens.json)" >> config.txt
echo "STORAGE_TOKEN=$(jq -r '."https://storage.azure.com/"' /tmp/tokens.json)" >> config.txt

Passing tokens as parameters (overrides config file values):

python3 az-mitm.py -mt $MANAGEMENT_TOKEN -gt $GRAPH_TOKEN-vt $VAULT_TOKEN -st $STORAGE_TOKEN

Optional flags:

python3 az-mitm.py -c config.example -p 8080 --listen-host 127.0.0.1 --cert-dir ./certs -v

-v logs matched hosts and actions to stderr (never logs token values).

Intercept Azure CLI communications

In a separate terminal, configure the proxy and trust the generated CA:

export REQUESTS_CA_BUNDLE="$(pwd)/certs/cacert.pem"
export HTTPS_PROXY="http://127.0.0.1:8080"
export HTTP_PROXY="http://127.0.0.1:8080"

If trusting the CA is not possible, you can disable SSL verification (less secure):

export PYTHONWARNINGS="ignore:Unverified HTTPS request"
export ADAL_PYTHON_SSL_NO_VERIFY=1
export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1

Then run Azure CLI commands as usual, for example:

az group list
az rest --method get --url https://management.azure.com/subscriptions?api-version=2020-01-01