bidoytu 1.1.0__tar.gz

bidoytu-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bidoytu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bidoytu-1.1.0/PKG-INFO

@@ -0,0 +1,198 @@
+Metadata-Version: 2.4
+Name: bidoytu
+Version: 1.1.0
+Summary: An intercepting HTTP proxy tool built with PySide6 and mitmproxy.
+Author-email: Bidoytu <hello@swarnimbandekar.in>
+License: MIT
+Project-URL: Homepage, https://github.com/Bidoytu/Bidoytu
+Project-URL: Repository, https://github.com/Bidoytu/Bidoytu
+Project-URL: Issues, https://github.com/Bidoytu/Bidoytu/issues
+Keywords: proxy,mitm,http,security,pentest,pyside6,mitmproxy
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: X11 Applications :: Qt
+Classifier: Environment :: Win32 (MS Windows)
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: Proxy Servers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PySide6>=6.6
+Requires-Dist: mitmproxy>=11.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: cryptography>=42.0
+Provides-Extra: dev
+Requires-Dist: pyinstaller>=6.0; extra == "dev"
+Requires-Dist: nuitka>=2.0; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=5.0; extra == "dev"
+Dynamic: license-file
+
+# Bidoytu
+
+An intercepting HTTP proxy tool for inspecting, modifying, and replaying web
+traffic, built in Python. This repository currently contains the **base
+architecture** only - a working skeleton you can run and build on.
+
+## Architecture
+
+| Concern | Choice |
+| --- | --- |
+| Language | Python 3.11+ |
+| Proxy / MITM engine | [mitmproxy](https://mitmproxy.org) used as a library (`DumpMaster`) |
+| Desktop UI | [PySide6](https://doc.qt.io/qtforpython/) (Qt for Python) |
+| Request/response editor | `QPlainTextEdit` + custom `QSyntaxHighlighter` |
+| Database | SQLite via stdlib `sqlite3`, WAL mode, custom `QAbstractTableModel` |
+| Large bodies | Stored as content-addressed files, referenced by path (not BLOBs) |
+| Concurrency | `QThread` hosts mitmproxy on its own asyncio loop; UI updated via signals |
+| Packaging | PyInstaller (dev), Nuitka (release) |
+
+### A note on the editor widget
+
+QScintilla is a Riverbank project bound to PyQt and has **no official PySide6
+binding** (licensing/ABI incompatibility). To keep the whole app on the
+official PySide6 binding, the base uses `QPlainTextEdit` + a custom
+`QSyntaxHighlighter`. This is isolated in `ui/message_view.py` and
+`ui/highlighter.py`, so it can be swapped for a QScintilla or Monaco-in-
+QWebEngineView approach later without touching the rest of the app.
+
+## Features (base)
+
+- **Top-level tabs:** Proxy, Repeater, Intruder.
+- **Proxy tab** with two sub-tabs:
+  - *HTTP History* - live traffic table + request/response detail.
+  - *Intercept* - pause in-flight requests; edit the raw request; **Forward**
+    or **Drop**; a toggle turns interception on/off. Requests queue while one
+    is held.
+- **Repeater** - load a request (from history), edit it, resend via an async
+  `httpx` client, and view the response.
+- **Intruder** - skeleton: request template with `§payload§` markers + payload
+  list. The attack runner is the documented next step.
+- **Send to Repeater (Ctrl+R) / Send to Intruder (Ctrl+I)** via right-click on a
+  history row (or the keyboard shortcut when the table is focused). The Intercept
+  request editor has the same right-click actions.
+- **Soft wrap** on all request/response views, toggleable per detail view.
+- **Pretty-printed bodies** - JSON, XML/HTML, and URL-encoded forms are
+  formatted for display (raw request text stays verbatim for editing).
+- **Configurable listen host/port** from the Proxy tab.
+- **CA certificate export** for trusting HTTPS interception (Proxy tab →
+  *CA Certificate*).
+
+## Project layout
+
+```
+src/bidoytu/
+  app.py               # entry point (QApplication + MainWindow)
+  __main__.py          # python -m bidoytu
+  config.py            # paths + proxy/app configuration
+  http_utils.py        # parse/build raw HTTP text <-> parts
+  proxy/
+    engine.py          # ProxyEngine: QThread hosting mitmproxy DumpMaster
+    capture_addon.py   # flow -> FlowRecord mapping + interception (pause/forward/drop)
+  net/
+    async_sender.py    # AsyncHttpSender: httpx.AsyncClient on its own loop/thread
+  storage/
+    models.py          # FlowRecord dataclass (framework-free)
+    repository.py      # SQLite (WAL) CRUD
+    body_store.py      # content-addressed large-body file store
+  ui/
+    main_window.py     # top-level QTabWidget + wiring
+    proxy_tab.py       # proxy controls + HTTP History / Intercept sub-tabs
+    history_view.py    # traffic table + detail + send-to context menu/shortcuts
+    intercept_view.py  # intercept queue, editor, forward/drop
+    repeater_tab.py    # editable request + send + response
+    intruder_tab.py    # skeleton (template + payloads)
+    detail_view.py     # reusable request|response viewer + soft-wrap toggle
+    flow_table_model.py# custom QAbstractTableModel for history
+    message_view.py    # raw HTTP view/editor (soft wrap + pretty print)
+    highlighter.py     # HTTP QSyntaxHighlighter
+    body_format.py     # content-type-aware body pretty-printer
+    ca_dialog.py       # export/install the proxy CA certificate
+packaging/
+  bidoytu.spec         # PyInstaller (dev)
+  build_release.md     # Nuitka (release) instructions
+scripts/               # headless smoke + live verification tests
+```
+
+### Data flow
+
+```
+Browser ─▶ mitmproxy (proxy thread, asyncio loop)
+                │  CaptureAddon maps flow -> FlowRecord
+                ▼
+        ProxyEngine.flow_captured  (Qt signal, queued to UI thread)
+                ▼
+        MainWindow._on_flow_captured
+                ├─▶ FlowRepository.upsert  (SQLite, big bodies -> BodyStore)
+                └─▶ FlowTableModel.upsert_record  (history table updates live)
+```
+
+## Getting started
+
+```powershell
+# 1. Create a virtual environment
+python -m venv .venv
+.venv\Scripts\Activate.ps1
+
+# 2. Install
+pip install -e .
+
+# 3. Run
+bidoytu
+# or: python -m bidoytu
+```
+
+Click **Start Proxy** on the Proxy tab. It listens on `127.0.0.1:8080` by
+default (host and port are editable). Point a browser or tool at that proxy and
+captured traffic appears in the history table; select a row to view the raw
+request/response.
+
+> **Intercepting HTTPS.** Browsers will reject the proxy's on-the-fly
+> certificates (e.g. Firefox's `MOZILLA_PKIX_ERROR_MITM_DETECTED`) until you
+> trust its CA. Start the proxy once (the CA is generated on first run under
+> `<data_dir>/ca/`), then click **CA Certificate** on the Proxy tab to export
+> the cert and follow the install instructions. Only trust this CA on machines
+> you control, and remove it when you're done. Bidoytu only ever exports the
+> public certificate, never the CA private key.
+
+## Building
+
+- **Development:** `pyinstaller packaging/bidoytu.spec`
+- **Release:** see `packaging/build_release.md` (Nuitka)
+
+## Status / next steps
+
+Base architecture with a working Proxy (history + interception) and Repeater.
+Natural next features:
+
+- Intruder attack runner - iterate payloads through `AsyncHttpSender` and
+  collect results in a table (positions parsing for `§...§` markers).
+- Response interception (currently only requests are paused).
+- Scope filtering, search, and column sorting/filtering on the history view.
+- Match/replace rules and a saved project format.
+
+## Contributing
+
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, the
+testing workflow, and coding conventions, and [CONTRIBUTORS.md](CONTRIBUTORS.md)
+for the list of people who have helped. To report a vulnerability, see
+[SECURITY.md](SECURITY.md).
+
+## Legal / responsible use
+
+Bidoytu is an intercepting proxy intended for testing systems **you own or are
+explicitly authorized to test**. Intercepting traffic or installing a MITM CA on
+machines or networks without permission may be illegal. You are responsible for
+how you use it.
+
+## License
+
+MIT - see [LICENSE](LICENSE).

bidoytu-1.1.0/README.md

@@ -0,0 +1,160 @@
+# Bidoytu
+
+An intercepting HTTP proxy tool for inspecting, modifying, and replaying web
+traffic, built in Python. This repository currently contains the **base
+architecture** only - a working skeleton you can run and build on.
+
+## Architecture
+
+| Concern | Choice |
+| --- | --- |
+| Language | Python 3.11+ |
+| Proxy / MITM engine | [mitmproxy](https://mitmproxy.org) used as a library (`DumpMaster`) |
+| Desktop UI | [PySide6](https://doc.qt.io/qtforpython/) (Qt for Python) |
+| Request/response editor | `QPlainTextEdit` + custom `QSyntaxHighlighter` |
+| Database | SQLite via stdlib `sqlite3`, WAL mode, custom `QAbstractTableModel` |
+| Large bodies | Stored as content-addressed files, referenced by path (not BLOBs) |
+| Concurrency | `QThread` hosts mitmproxy on its own asyncio loop; UI updated via signals |
+| Packaging | PyInstaller (dev), Nuitka (release) |
+
+### A note on the editor widget
+
+QScintilla is a Riverbank project bound to PyQt and has **no official PySide6
+binding** (licensing/ABI incompatibility). To keep the whole app on the
+official PySide6 binding, the base uses `QPlainTextEdit` + a custom
+`QSyntaxHighlighter`. This is isolated in `ui/message_view.py` and
+`ui/highlighter.py`, so it can be swapped for a QScintilla or Monaco-in-
+QWebEngineView approach later without touching the rest of the app.
+
+## Features (base)
+
+- **Top-level tabs:** Proxy, Repeater, Intruder.
+- **Proxy tab** with two sub-tabs:
+  - *HTTP History* - live traffic table + request/response detail.
+  - *Intercept* - pause in-flight requests; edit the raw request; **Forward**
+    or **Drop**; a toggle turns interception on/off. Requests queue while one
+    is held.
+- **Repeater** - load a request (from history), edit it, resend via an async
+  `httpx` client, and view the response.
+- **Intruder** - skeleton: request template with `§payload§` markers + payload
+  list. The attack runner is the documented next step.
+- **Send to Repeater (Ctrl+R) / Send to Intruder (Ctrl+I)** via right-click on a
+  history row (or the keyboard shortcut when the table is focused). The Intercept
+  request editor has the same right-click actions.
+- **Soft wrap** on all request/response views, toggleable per detail view.
+- **Pretty-printed bodies** - JSON, XML/HTML, and URL-encoded forms are
+  formatted for display (raw request text stays verbatim for editing).
+- **Configurable listen host/port** from the Proxy tab.
+- **CA certificate export** for trusting HTTPS interception (Proxy tab →
+  *CA Certificate*).
+
+## Project layout
+
+```
+src/bidoytu/
+  app.py               # entry point (QApplication + MainWindow)
+  __main__.py          # python -m bidoytu
+  config.py            # paths + proxy/app configuration
+  http_utils.py        # parse/build raw HTTP text <-> parts
+  proxy/
+    engine.py          # ProxyEngine: QThread hosting mitmproxy DumpMaster
+    capture_addon.py   # flow -> FlowRecord mapping + interception (pause/forward/drop)
+  net/
+    async_sender.py    # AsyncHttpSender: httpx.AsyncClient on its own loop/thread
+  storage/
+    models.py          # FlowRecord dataclass (framework-free)
+    repository.py      # SQLite (WAL) CRUD
+    body_store.py      # content-addressed large-body file store
+  ui/
+    main_window.py     # top-level QTabWidget + wiring
+    proxy_tab.py       # proxy controls + HTTP History / Intercept sub-tabs
+    history_view.py    # traffic table + detail + send-to context menu/shortcuts
+    intercept_view.py  # intercept queue, editor, forward/drop
+    repeater_tab.py    # editable request + send + response
+    intruder_tab.py    # skeleton (template + payloads)
+    detail_view.py     # reusable request|response viewer + soft-wrap toggle
+    flow_table_model.py# custom QAbstractTableModel for history
+    message_view.py    # raw HTTP view/editor (soft wrap + pretty print)
+    highlighter.py     # HTTP QSyntaxHighlighter
+    body_format.py     # content-type-aware body pretty-printer
+    ca_dialog.py       # export/install the proxy CA certificate
+packaging/
+  bidoytu.spec         # PyInstaller (dev)
+  build_release.md     # Nuitka (release) instructions
+scripts/               # headless smoke + live verification tests
+```
+
+### Data flow
+
+```
+Browser ─▶ mitmproxy (proxy thread, asyncio loop)
+                │  CaptureAddon maps flow -> FlowRecord
+                ▼
+        ProxyEngine.flow_captured  (Qt signal, queued to UI thread)
+                ▼
+        MainWindow._on_flow_captured
+                ├─▶ FlowRepository.upsert  (SQLite, big bodies -> BodyStore)
+                └─▶ FlowTableModel.upsert_record  (history table updates live)
+```
+
+## Getting started
+
+```powershell
+# 1. Create a virtual environment
+python -m venv .venv
+.venv\Scripts\Activate.ps1
+
+# 2. Install
+pip install -e .
+
+# 3. Run
+bidoytu
+# or: python -m bidoytu
+```
+
+Click **Start Proxy** on the Proxy tab. It listens on `127.0.0.1:8080` by
+default (host and port are editable). Point a browser or tool at that proxy and
+captured traffic appears in the history table; select a row to view the raw
+request/response.
+
+> **Intercepting HTTPS.** Browsers will reject the proxy's on-the-fly
+> certificates (e.g. Firefox's `MOZILLA_PKIX_ERROR_MITM_DETECTED`) until you
+> trust its CA. Start the proxy once (the CA is generated on first run under
+> `<data_dir>/ca/`), then click **CA Certificate** on the Proxy tab to export
+> the cert and follow the install instructions. Only trust this CA on machines
+> you control, and remove it when you're done. Bidoytu only ever exports the
+> public certificate, never the CA private key.
+
+## Building
+
+- **Development:** `pyinstaller packaging/bidoytu.spec`
+- **Release:** see `packaging/build_release.md` (Nuitka)
+
+## Status / next steps
+
+Base architecture with a working Proxy (history + interception) and Repeater.
+Natural next features:
+
+- Intruder attack runner - iterate payloads through `AsyncHttpSender` and
+  collect results in a table (positions parsing for `§...§` markers).
+- Response interception (currently only requests are paused).
+- Scope filtering, search, and column sorting/filtering on the history view.
+- Match/replace rules and a saved project format.
+
+## Contributing
+
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, the
+testing workflow, and coding conventions, and [CONTRIBUTORS.md](CONTRIBUTORS.md)
+for the list of people who have helped. To report a vulnerability, see
+[SECURITY.md](SECURITY.md).
+
+## Legal / responsible use
+
+Bidoytu is an intercepting proxy intended for testing systems **you own or are
+explicitly authorized to test**. Intercepting traffic or installing a MITM CA on
+machines or networks without permission may be illegal. You are responsible for
+how you use it.
+
+## License
+
+MIT - see [LICENSE](LICENSE).

bidoytu-1.1.0/pyproject.toml

@@ -0,0 +1,62 @@
+[project]
+name = "bidoytu"
+version = "1.1.0"
+description = "An intercepting HTTP proxy tool built with PySide6 and mitmproxy."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "MIT" }
+authors = [
+    { name = "Bidoytu", email = "hello@swarnimbandekar.in" },
+]
+keywords = ["proxy", "mitm", "http", "security", "pentest", "pyside6", "mitmproxy"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Environment :: X11 Applications :: Qt",
+    "Environment :: Win32 (MS Windows)",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Internet :: Proxy Servers",
+    "Topic :: Security",
+    "Topic :: Software Development :: Testing",
+]
+dependencies = [
+    "PySide6>=6.6",
+    "mitmproxy>=11.0",
+    "httpx>=0.27",
+    "cryptography>=42.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/Bidoytu/Bidoytu"
+Repository = "https://github.com/Bidoytu/Bidoytu"
+Issues = "https://github.com/Bidoytu/Bidoytu/issues"
+
+[project.optional-dependencies]
+dev = [
+    "pyinstaller>=6.0",
+    "nuitka>=2.0",
+    "build>=1.0",
+    "twine>=5.0",
+]
+
+[project.scripts]
+bidoytu = "bidoytu.app:main"
+
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-dir]
+"" = "src"
+
+[tool.setuptools.package-data]
+bidoytu = ["assets/*.png", "assets/*.ico"]

bidoytu-1.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

bidoytu-1.1.0/src/bidoytu/__init__.py

@@ -0,0 +1,11 @@
+"""Bidoytu - an intercepting HTTP proxy tool.
+
+Base architecture:
+    - Proxy/MITM engine: mitmproxy (DumpMaster) running in a QThread.
+    - Desktop UI: PySide6 (Qt for Python).
+    - Storage: SQLite (WAL) + on-disk body file store, exposed to the UI via
+      a custom QAbstractTableModel.
+"""
+
+__version__ = "1.1.0"
+__app_name__ = "Bidoytu"

bidoytu-1.1.0/src/bidoytu/__main__.py

@@ -0,0 +1,5 @@
+"""Enables ``python -m bidoytu``."""
+from bidoytu.app import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

bidoytu-1.1.0/src/bidoytu/app.py

@@ -0,0 +1,65 @@
+"""Application entry point.
+
+Creates the Qt application, builds the main window, and starts the event loop.
+The proxy starts automatically once the window is shown; if the listen port is
+already in use, the window prompts the user to change the port or retry.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+from PySide6.QtGui import QIcon
+from PySide6.QtWidgets import QApplication
+
+from bidoytu import __app_name__
+from bidoytu.config import AppConfig
+from bidoytu.resources import logo_path
+from bidoytu.ui.main_window import MainWindow
+from bidoytu.ui.theme import apply_theme, load_theme
+
+
+def _set_windows_app_id() -> None:
+    """Give Windows an explicit AppUserModelID so the taskbar uses our icon.
+
+    Without this, a Python-hosted app is grouped under python.exe and shows the
+    interpreter's icon on the taskbar instead of the window icon.
+    """
+    if os.name != "nt":
+        return
+    try:
+        import ctypes
+
+        ctypes.windll.shell32.SetCurrentProcessExplicitAppUserModelID(
+            f"{__app_name__}.{__app_name__}"
+        )
+    except Exception:
+        # Non-fatal: the app still runs, just without the custom taskbar group.
+        pass
+
+
+def main() -> int:
+    _set_windows_app_id()
+
+    app = QApplication(sys.argv)
+    app.setApplicationName(__app_name__)
+    app.setOrganizationName(__app_name__)
+
+    # Application/taskbar icon.
+    icon = QIcon(str(logo_path()))
+    if not icon.isNull():
+        app.setWindowIcon(icon)
+
+    # Apply the persisted theme (defaults to dark) before building widgets so
+    # highlighters pick up matching colors from the start.
+    apply_theme(app, load_theme())
+
+    config = AppConfig()
+    window = MainWindow(config)
+    window.show()
+
+    return app.exec()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

bidoytu-1.1.0/src/bidoytu/config.py

@@ -0,0 +1,132 @@
+"""Application configuration and filesystem paths.
+
+Everything the app writes (SQLite DB, large request/response bodies) lives under
+a single data directory so it is easy to locate, back up, or clear.
+"""
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+
+
+def _default_data_dir() -> Path:
+    """Return a per-user, per-OS data directory for Bidoytu."""
+    if os.name == "nt":  # Windows
+        base = os.environ.get("LOCALAPPDATA") or os.path.expanduser("~")
+        return Path(base) / "Bidoytu"
+    # macOS / Linux
+    xdg = os.environ.get("XDG_DATA_HOME")
+    if xdg:
+        return Path(xdg) / "bidoytu"
+    return Path.home() / ".local" / "share" / "bidoytu"
+
+
+@dataclass(slots=True)
+class ProxyConfig:
+    """Listen settings for the mitmproxy engine."""
+
+    listen_host: str = "127.0.0.1"
+    listen_port: int = 8080
+    http2: bool = True
+
+
+# Free, public Interactsh servers operated by ProjectDiscovery. They are tried
+# in order at registration time; the first that accepts the registration wins.
+# Users can add their own (self-hosted) server in the Collaborator tab.
+DEFAULT_OAST_SERVERS = (
+    "oast.pro",
+    "oast.live",
+    "oast.site",
+    "oast.online",
+    "oast.fun",
+    "oast.me",
+)
+
+
+@dataclass(slots=True)
+class CollaboratorConfig:
+    """Settings for the Collaborator (out-of-band interaction) feature.
+
+    Attributes:
+        servers: Ordered list of Interactsh server hostnames to try when
+            registering. The first entry is treated as the preferred server.
+        token: Optional ``Authorization`` token for protected / self-hosted
+            servers (leave empty for the public ones).
+        poll_interval_secs: How often to poll the server for new interactions.
+    """
+
+    servers: list[str] = field(default_factory=lambda: list(DEFAULT_OAST_SERVERS))
+    token: str = ""
+    poll_interval_secs: int = 10
+
+
+@dataclass(slots=True)
+class AppConfig:
+    """Top-level runtime configuration.
+
+    Attributes:
+        data_dir: Root directory for all persisted state.
+        proxy: Proxy listen configuration.
+        body_inline_limit: Bodies at or below this size (bytes) are stored
+            inline in SQLite; larger bodies are written to the file store and
+            referenced by path.
+    """
+
+    data_dir: Path = field(default_factory=_default_data_dir)
+    proxy: ProxyConfig = field(default_factory=ProxyConfig)
+    collaborator: CollaboratorConfig = field(default_factory=CollaboratorConfig)
+    body_inline_limit: int = 64 * 1024  # 64 KiB
+
+    @property
+    def db_path(self) -> Path:
+        return self.data_dir / "bidoytu.db"
+
+    @property
+    def bodies_dir(self) -> Path:
+        return self.data_dir / "bodies"
+
+    @property
+    def repeater_sessions_path(self) -> Path:
+        """JSON file holding persisted Repeater sessions across restarts."""
+        return self.data_dir / "repeater_sessions.json"
+
+    @property
+    def intruder_attack_path(self) -> Path:
+        """JSON file holding the last Intruder attack config across restarts."""
+        return self.data_dir / "intruder_attack.json"
+
+    @property
+    def collaborator_state_path(self) -> Path:
+        """JSON file holding Collaborator session state across restarts.
+
+        Stores the active Interactsh session (server, correlation id, keys),
+        generated payloads, and captured interactions so a running OAST session
+        can be resumed after a restart.
+        """
+        return self.data_dir / "collaborator.json"
+
+    @property
+    def confdir(self) -> Path:
+        """Directory where mitmproxy stores its generated CA and certs.
+
+        We keep it under Bidoytu's data dir (instead of the default
+        ``~/.mitmproxy``) so the CA is predictable and easy to export.
+        """
+        return self.data_dir / "ca"
+
+    @property
+    def ca_cert_pem(self) -> Path:
+        """PEM-encoded CA certificate (for Firefox, curl, most Linux tools)."""
+        return self.confdir / "mitmproxy-ca-cert.pem"
+
+    @property
+    def ca_cert_cer(self) -> Path:
+        """DER/.cer CA certificate (convenient for the Windows cert store)."""
+        return self.confdir / "mitmproxy-ca-cert.cer"
+
+    def ensure_dirs(self) -> None:
+        """Create the data, body, and CA directories if they do not exist."""
+        self.data_dir.mkdir(parents=True, exist_ok=True)
+        self.bodies_dir.mkdir(parents=True, exist_ok=True)
+        self.confdir.mkdir(parents=True, exist_ok=True)