Capturing traffic

Wirescry sees the traffic of programs that send it through its proxy. The Setup tab has three ways to do that: browsers, terminals, and manual setup for anything else.

Browsers

Wirescry looks for Google Chrome, Chromium, Microsoft Edge, Brave and Firefox (including Firefox Developer Edition, and on macOS Nightly) when it starts. Launch in the toolbar, or in Setup → Browsers, opens one set up to use the proxy.

• Chrome, Chromium, Edge and Brave open with a fresh temporary profile that uses the proxy and trusts Wirescry's certificate. Nothing about your usual profile changes, and the temporary one is deleted when the browser closes. That also means you start signed out of every site.
• Firefox can't be told to trust a certificate when it starts, so Wirescry keeps one Firefox profile of its own in its data folder. The first launch opens a page at http://wirescry.internal/ with an Install certificate button: when Firefox asks, tick Trust this CA to identify websites and click OK. Later launches go straight to browsing, and sign-ins in that profile persist.

Requests to localhost from these browsers go through Wirescry too. HTTP/3 is turned off in them, so traffic uses HTTP/1.1 or HTTP/2, which Wirescry can decrypt.

Wirescry looks for browsers when it starts. If you install one while it's running, click Rescan under Setup → Browsers.

Terminals

Setup → Terminals opens a terminal whose programs send their HTTP and HTTPS traffic through Wirescry:

• macOS: Terminal, and iTerm if it's installed.
• Windows: PowerShell (and PowerShell 7 if it's installed) and Command Prompt.
• Linux: your default terminal, GNOME Terminal, Konsole, Xfce Terminal, kitty, Alacritty, WezTerm, foot or XTerm, whichever are installed.

A terminal that's already open

Under Set up a terminal that's already open, pick your shell and copy the one line shown into the terminal. On macOS with bash or zsh it looks like this, with your own path:

. '/Users/you/Library/Application Support/Wirescry/terminal-config/env/wirescry.sh'

The line runs a small script Wirescry keeps up to date in its data folder. It covers only that terminal, until it closes. Show what this sets lists the variables, if you'd rather set them yourself.

Command Prompt can't safely run that script when Wirescry's data folder path has characters outside plain ASCII or any of % & ^ | < > !, for example a user name with an accent. Wirescry then says so; use PowerShell, or open a Command Prompt with the button above it.

What's covered

Tool	Covered
Node.js 24 and later, and 22.21 and later	fetch, http and https.
Python	urllib, requests and httpx. aiohttp needs trust_env=True.
Ruby	Net::HTTP and most gems.
Go	net/http. On Windows, Go trusts only the Windows certificate store, so HTTPS needs the certificate installed there. Elsewhere, requests to localhost skip the proxy.
PHP	The curl extension and libraries built on it, such as Guzzle.
Java 8 and later	HttpURLConnection, the java.net.http client, and libraries built on them such as OkHttp and Spring's RestTemplate. Apache HttpClient needs its system-properties builder. Each java command prints a "Picked up JAVA_TOOL_OPTIONS" line: that is the JVM confirming the setup.
curl and git	Both. On Windows, curl.exe in these terminals reads Wirescry's own curl config, so your _curlrc isn't read there and certificate revocation checks are off.

On macOS, the Python and Ruby that come with the system (/usr/bin/python3, /usr/bin/ruby) ignore the certificate setting, so their standard libraries won't trust Wirescry; Python requests still works. Python and Ruby from Homebrew, pyenv, python.org, uv, rbenv or asdf work fully.

Programs that ignore proxy settings, or use only the system certificate store, won't show up. For those, see the next section.

Anything else

For any other program on your computer, Setup → Manual setup gives you:

• Proxy: 127.0.0.1:<port>, for the program's HTTP and HTTPS proxy settings.

• Certificate: Save certificate… saves the public certificate (never its key). Through the proxy, http://wirescry.internal/certificate serves it too.

• curl, one request: a ready-made command, for example

  curl --proxy http://127.0.0.1:8000 --cacert "$HOME/Library/Application Support/Wirescry/ca.pem" https://example.com/

To decrypt HTTPS, the program has to trust the certificate. Many programs use the system's certificate store: see Trusting the certificate.

The proxy port

Wirescry normally takes the first free port from 8000 upward, so the port can change between launches if another program has 8000. To keep it the same, choose Always use port under Setup → Proxy port (1024 to 65535). Changing it restarts the proxy, so relaunch any browsers and terminals you opened.

Not supported yet

• Other devices, such as phones on your network: the proxy accepts connections only from this computer.
• HTTP/3 (QUIC): not decrypted. Browsers Wirescry opens use HTTP/2 instead.
• Programs that pin certificates: they refuse any certificate but their own, so they fail rather than show their traffic.