[RE] mitmproxy FIFA 23 FUT Session Capture + Endpoint Map #1

New Issue

2026-06-26T05:05:35Z

funman300 commented

2026-06-26 05:05:35 +00:00

Overview

Capture real FIFA 23 FUT traffic using mitmproxy to document the complete endpoint map. This is the foundation for accurate mapper implementation in the Bridge.

Prerequisites

FIFA 23 (PC or RPCS3) installed and launchable
mitmproxy 10+ (pip install mitmproxy or from package manager)
Network access from the FIFA 23 host to the mitmproxy machine

Steps

1. Install and start mitmproxy

pip install mitmproxy
mitmweb --listen-host 0.0.0.0 --listen-port 8080
# mitmweb opens a browser UI at http://localhost:8081

2. Route FIFA 23 traffic through the proxy

PC: Set system proxy in Windows Settings → Network → Proxy to <mitmproxy-ip>:8080

RPCS3: Settings → Network → Proxy → <mitmproxy-ip>:8080

3. Trust the mitmproxy CA certificate

Browse to http://mitm.it from the FIFA 23 machine while the proxy is active
Download and install the appropriate certificate for your OS
For Windows: install to "Trusted Root Certification Authorities"
For RPCS3: place the cert where RPCS3 looks for CA bundles (check RPCS3 docs)

If FIFA 23 rejects the cert (SSL error in mitmproxy), see issue "Certificate Pinning Research".

4. Launch FIFA 23 and capture a full FUT session

Perform each of the following actions, confirming each appears in the mitmproxy capture:

Log in (FUT auth flow)
Open FUT hub / home screen
View your club overview
Open your active squad
Open a pack (free pack or coins pack)
Browse the transfer market (search + buy + list a card)
Submit an SBC
Submit a match result (play a match)
View objectives page
View season info

5. Export captures in bridge-compatible format

From mitmweb, export the session as HAR, then convert:

# Or save directly using the bridge format if already running the bridge:
# Each capture JSON file in captures/ is: { method, path, status, request_headers, response_body }

Save files as captures/session_YYYYMMDD.json.

6. Document all observed endpoints in `docs/endpoint-map.md`

For each captured endpoint, record:

## METHOD /path/to/endpoint
- **Purpose:** what it does
- **Required headers:** X-UT-SID, X-UT-PHISHING-TOKEN, ...
- **Request body:** (summarise or paste truncated JSON)
- **Response envelope:** (key fields)
- **Bridge status:** Mapped ✅ / Unmapped ❌
- **Mandatory for FUT to load:** Yes / No

7. Document the auth flow in `docs/auth-flow.md`

Token format (JWT or opaque string?)
Where is the SID set and for how long?
What headers must all subsequent requests include?
Does the phishing token rotate per session or per request?

8. Identify mandatory-for-startup endpoints

Note which endpoints FIFA 23 calls before showing the FUT hub. Anything not on this list can be safely stubbed with a placeholder 200.

Deliverables

captures/session_YYYYMMDD.json with at least one full FUT session
docs/endpoint-map.md listing all observed endpoints
docs/auth-flow.md documenting token lifecycle
Mandatory-startup endpoint list noted in docs/endpoint-map.md

## Overview Capture real FIFA 23 FUT traffic using mitmproxy to document the complete endpoint map. This is the foundation for accurate mapper implementation in the Bridge. ## Prerequisites - FIFA 23 (PC or RPCS3) installed and launchable - mitmproxy 10+ (`pip install mitmproxy` or from package manager) - Network access from the FIFA 23 host to the mitmproxy machine ## Steps ### 1. Install and start mitmproxy ```bash pip install mitmproxy mitmweb --listen-host 0.0.0.0 --listen-port 8080 # mitmweb opens a browser UI at http://localhost:8081 ``` ### 2. Route FIFA 23 traffic through the proxy **PC:** Set system proxy in Windows Settings → Network → Proxy to `<mitmproxy-ip>:8080` **RPCS3:** Settings → Network → Proxy → `<mitmproxy-ip>:8080` ### 3. Trust the mitmproxy CA certificate - Browse to `http://mitm.it` from the FIFA 23 machine while the proxy is active - Download and install the appropriate certificate for your OS - For Windows: install to "Trusted Root Certification Authorities" - For RPCS3: place the cert where RPCS3 looks for CA bundles (check RPCS3 docs) If FIFA 23 rejects the cert (SSL error in mitmproxy), see issue "Certificate Pinning Research". ### 4. Launch FIFA 23 and capture a full FUT session Perform each of the following actions, confirming each appears in the mitmproxy capture: - [ ] Log in (FUT auth flow) - [ ] Open FUT hub / home screen - [ ] View your club overview - [ ] Open your active squad - [ ] Open a pack (free pack or coins pack) - [ ] Browse the transfer market (search + buy + list a card) - [ ] Submit an SBC - [ ] Submit a match result (play a match) - [ ] View objectives page - [ ] View season info ### 5. Export captures in bridge-compatible format From mitmweb, export the session as HAR, then convert: ```bash # Or save directly using the bridge format if already running the bridge: # Each capture JSON file in captures/ is: { method, path, status, request_headers, response_body } ``` Save files as `captures/session_YYYYMMDD.json`. ### 6. Document all observed endpoints in `docs/endpoint-map.md` For each captured endpoint, record: ```markdown ## METHOD /path/to/endpoint - **Purpose:** what it does - **Required headers:** X-UT-SID, X-UT-PHISHING-TOKEN, ... - **Request body:** (summarise or paste truncated JSON) - **Response envelope:** (key fields) - **Bridge status:** Mapped ✅ / Unmapped ❌ - **Mandatory for FUT to load:** Yes / No ``` ### 7. Document the auth flow in `docs/auth-flow.md` - Token format (JWT or opaque string?) - Where is the SID set and for how long? - What headers must all subsequent requests include? - Does the phishing token rotate per session or per request? ### 8. Identify mandatory-for-startup endpoints Note which endpoints FIFA 23 calls before showing the FUT hub. Anything not on this list can be safely stubbed with a placeholder 200. ## Deliverables - [ ] `captures/session_YYYYMMDD.json` with at least one full FUT session - [ ] `docs/endpoint-map.md` listing all observed endpoints - [ ] `docs/auth-flow.md` documenting token lifecycle - [ ] Mandatory-startup endpoint list noted in `docs/endpoint-map.md`

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: funman300/OpenFUT-Bridge#1

[RE] mitmproxy FIFA 23 FUT Session Capture + Endpoint Map #1