ssh-mitm/ssh-mitm
Ssh Mitm
Dieses Projekt ist ein transparentes Proxy-Framework, das für das Abfangen, Analysieren und Manipulieren von SSH-Datenverkehr entwickelt wurde. Durch die unabhängige Terminierung von Client- und Serververbindungen bietet es volle Transparenz über verschlüsselte Sitzungen und ermöglicht die Überwachung von Authentifizierungsabläufen, Dateiübertragungen und Befehlsausführungen in Echtzeit.
Das Tool zeichnet sich durch eine modulare, Plugin-basierte Architektur aus, die es Benutzern ermöglicht, eigene Interzeptionslogik in den Proxy-Workflow einzubinden. Es unterstützt die Erstellung ephemerer Umgebungen und Mock-Agenten im Arbeitsspeicher, was die Simulation von Sicherheitsszenarien und das Testen der Authentifizierungsrobustheit ohne externe Infrastruktur erleichtert.
Das Framework deckt ein breites Spektrum an Funktionen ab, einschließlich der Prüfung des Client-Sicherheitsverhaltens, der Erfassung von Authentifizierungsdaten und der Inspektion gekapselter Netzwerkprotokolle wie Tunnel und Remote-Management-Operationen. Es bietet zudem operative Kontrollen zur Verwaltung gleichzeitiger Sitzungen und zur Aufrechterhaltung der Sitzungsparität durch Terminal-Signal-Weiterleitung.
Features
- Transparent Interception Proxies - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Man-in-the-Middle Frameworks - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Traffic Proxying and Interception - Acts as a modular tool for intercepting and modifying secure shell traffic, including file transfers and network tunnels.
- Proxy Security Auditors - Serves as a transparent proxy for auditing authentication flows and client security behavior in real time.
- Interception Proxies - Inspects and manipulates authentication flows to capture credentials or force interactive fallbacks.
- Authentication Testing - Probes remote servers and simulates client responses to evaluate the robustness of authentication methods and multi-factor security.
- SSH Security Tools - Analyzes client and server authentication behavior to identify vulnerabilities and weak configurations in remote access implementations.
- Tunneling and Proxying - Enables remote port forwarding and proxy jump capabilities to facilitate complex network traversal.
- NETCONF Subsystem Interceptions - Provides real-time inspection and modification of NETCONF operations within secure shell tunnels.
- SSH Session Simulations - Facilitates testing of authentication robustness by simulating SSH environments entirely in memory.
- Interception Proxies - Intercepts file transfers to store copies or replace files on the fly during active sessions.
- Traffic Protocol Inspection - Parses and manipulates encapsulated data streams including network tunnels, file transfers, and terminal output during active sessions.
- Application-Layer Protocol Inspections - Captures and parses encapsulated traffic like NETCONF, SOCKS tunnels, and file transfers within secure shell connections.
- Authentication Credential Captures - Intercepts passwords and public key authentication attempts to audit how sensitive credentials are handled.
- Bypass Testing - Exploits authentication negotiation vulnerabilities to circumvent hardware-based security requirements during testing.
- Authentication Method Auditing - Probes remote servers for supported authentication methods and validates public keys to identify security misconfigurations.
- Client Behavior Auditing - Identifies potential vulnerabilities in authentication handling by analyzing how clients respond to manipulated server responses.
- Multi-Factor Authentication Bypass Testing - Intercepts authentication requests to establish sessions using basic credentials, bypassing hardware-based multi-factor confirmations.
- Encapsulated Traffic Inspection - Captures and inspects TCP tunnels, SOCKS forwarding, and remote command sessions to monitor encapsulated communications.
- Session Auditing - Decrypts and displays live terminal output while logging command execution and state transitions for security auditing.
- SSH Agent Forwarding - Utilizes forwarded authentication agents to establish connections to remote servers after session interception.
- Host Key Auto-Generators - Supports multiple host key algorithms and persists generated keys to maintain consistent server identity.
- Vulnerability Analysis - Evaluates connecting software security by observing key negotiation and protocol behaviors to detect implementation weaknesses.
- Security Testing and Auditing - Examines negotiation behavior during connection attempts to identify known vulnerabilities and security weaknesses in remote session software.
- Asynchronous Session Management - Manages concurrent sessions as asynchronous coroutines to ensure stable performance during high-volume traffic analysis.
- Plugin-Based Extensibility - Enables developers to inject custom interception logic and automated responses into the proxy workflow through modular plugins.
- Live User Session Mirroring - Mirrors active sessions to enable real-time monitoring and command injection while remaining transparent to the user.
