ssh-mitm/ssh-mitm
Ssh Mitm
Este proyecto es un framework de proxy transparente diseñado para la interceptación, análisis y manipulación de tráfico SSH. Al terminar las conexiones de cliente y servidor de forma independiente, proporciona visibilidad total de las sesiones cifradas, permitiendo monitorear flujos de autenticación, transferencias de archivos y ejecución de comandos en tiempo real.
La herramienta destaca por su arquitectura modular basada en plugins que permite a los usuarios inyectar lógica de interceptación personalizada en el flujo de trabajo del proxy. Admite la creación de entornos efímeros y agentes simulados en memoria, facilitando la simulación de escenarios de seguridad y la prueba de robustez de la autenticación sin necesidad de infraestructura externa.
El framework cubre una amplia superficie de capacidades, incluyendo la auditoría del comportamiento de seguridad del cliente, la captura de credenciales de autenticación y la inspección de protocolos de red encapsulados como túneles y operaciones de gestión remota. También proporciona controles operativos para gestionar sesiones concurrentes y mantener la paridad de sesión mediante el reenvío de señales de terminal.
Features
- Transparent Interception Proxies - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Man-in-the-Middle Frameworks - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Traffic Proxying and Interception - Acts as a modular tool for intercepting and modifying secure shell traffic, including file transfers and network tunnels.
- Proxy Security Auditors - Serves as a transparent proxy for auditing authentication flows and client security behavior in real time.
- Interception Proxies - Inspects and manipulates authentication flows to capture credentials or force interactive fallbacks.
- Authentication Testing - Probes remote servers and simulates client responses to evaluate the robustness of authentication methods and multi-factor security.
- SSH Security Tools - Analyzes client and server authentication behavior to identify vulnerabilities and weak configurations in remote access implementations.
- Tunneling and Proxying - Enables remote port forwarding and proxy jump capabilities to facilitate complex network traversal.
- NETCONF Subsystem Interceptions - Provides real-time inspection and modification of NETCONF operations within secure shell tunnels.
- SSH Session Simulations - Facilitates testing of authentication robustness by simulating SSH environments entirely in memory.
- Interception Proxies - Intercepts file transfers to store copies or replace files on the fly during active sessions.
- Traffic Protocol Inspection - Parses and manipulates encapsulated data streams including network tunnels, file transfers, and terminal output during active sessions.
- Application-Layer Protocol Inspections - Captures and parses encapsulated traffic like NETCONF, SOCKS tunnels, and file transfers within secure shell connections.
- Authentication Credential Captures - Intercepts passwords and public key authentication attempts to audit how sensitive credentials are handled.
- Bypass Testing - Exploits authentication negotiation vulnerabilities to circumvent hardware-based security requirements during testing.
- Authentication Method Auditing - Probes remote servers for supported authentication methods and validates public keys to identify security misconfigurations.
- Client Behavior Auditing - Identifies potential vulnerabilities in authentication handling by analyzing how clients respond to manipulated server responses.
- Multi-Factor Authentication Bypass Testing - Intercepts authentication requests to establish sessions using basic credentials, bypassing hardware-based multi-factor confirmations.
- Encapsulated Traffic Inspection - Captures and inspects TCP tunnels, SOCKS forwarding, and remote command sessions to monitor encapsulated communications.
- Session Auditing - Decrypts and displays live terminal output while logging command execution and state transitions for security auditing.
- SSH Agent Forwarding - Utilizes forwarded authentication agents to establish connections to remote servers after session interception.
- Host Key Auto-Generators - Supports multiple host key algorithms and persists generated keys to maintain consistent server identity.
- Vulnerability Analysis - Evaluates connecting software security by observing key negotiation and protocol behaviors to detect implementation weaknesses.
- Security Testing and Auditing - Examines negotiation behavior during connection attempts to identify known vulnerabilities and security weaknesses in remote session software.
- Asynchronous Session Management - Manages concurrent sessions as asynchronous coroutines to ensure stable performance during high-volume traffic analysis.
- Plugin-Based Extensibility - Enables developers to inject custom interception logic and automated responses into the proxy workflow through modular plugins.
- Live User Session Mirroring - Mirrors active sessions to enable real-time monitoring and command injection while remaining transparent to the user.
