ssh-mitm/ssh-mitm
Ssh Mitm
This project is a transparent proxy framework designed for the interception, analysis, and manipulation of secure shell traffic. By terminating client and server connections independently, it provides full visibility into encrypted sessions, allowing for the monitoring of authentication flows, file transfers, and command execution in real time.
The tool distinguishes itself through a modular, plugin-based architecture that enables users to inject custom interception logic into the proxy workflow. It supports the creation of ephemeral environments and mock agents in memory, facilitating the simulation of security scenarios and the testing of authentication robustness without requiring external infrastructure.
The framework covers a broad capability surface, including the auditing of client security behavior, the capture of authentication credentials, and the inspection of encapsulated network protocols such as tunnels and remote management operations. It also provides operational controls for managing concurrent sessions and maintaining session parity through terminal signal forwarding.
Features
- Transparent Interception Proxies - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Man-in-the-Middle Frameworks - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Traffic Proxying and Interception - Acts as a modular tool for intercepting and modifying secure shell traffic, including file transfers and network tunnels.
- Proxy Security Auditors - Serves as a transparent proxy for auditing authentication flows and client security behavior in real time.
- Interception Proxies - Inspects and manipulates authentication flows to capture credentials or force interactive fallbacks.
- Authentication Testing - Probes remote servers and simulates client responses to evaluate the robustness of authentication methods and multi-factor security.
- SSH Security Tools - Analyzes client and server authentication behavior to identify vulnerabilities and weak configurations in remote access implementations.
- Tunneling and Proxying - Enables remote port forwarding and proxy jump capabilities to facilitate complex network traversal.
- NETCONF Subsystem Interceptions - Provides real-time inspection and modification of NETCONF operations within secure shell tunnels.
- SSH Session Simulations - Facilitates testing of authentication robustness by simulating SSH environments entirely in memory.
- Interception Proxies - Intercepts file transfers to store copies or replace files on the fly during active sessions.
- Traffic Protocol Inspection - Parses and manipulates encapsulated data streams including network tunnels, file transfers, and terminal output during active sessions.
- Application-Layer Protocol Inspections - Captures and parses encapsulated traffic like NETCONF, SOCKS tunnels, and file transfers within secure shell connections.
- Authentication Credential Captures - Intercepts passwords and public key authentication attempts to audit how sensitive credentials are handled.
- Bypass Testing - Exploits authentication negotiation vulnerabilities to circumvent hardware-based security requirements during testing.
- Authentication Method Auditing - Probes remote servers for supported authentication methods and validates public keys to identify security misconfigurations.
- Client Behavior Auditing - Identifies potential vulnerabilities in authentication handling by analyzing how clients respond to manipulated server responses.
- Multi-Factor Authentication Bypass Testing - Intercepts authentication requests to establish sessions using basic credentials, bypassing hardware-based multi-factor confirmations.
- Encapsulated Traffic Inspection - Captures and inspects TCP tunnels, SOCKS forwarding, and remote command sessions to monitor encapsulated communications.
- Session Auditing - Decrypts and displays live terminal output while logging command execution and state transitions for security auditing.
- SSH Agent Forwarding - Utilizes forwarded authentication agents to establish connections to remote servers after session interception.
- Host Key Auto-Generators - Supports multiple host key algorithms and persists generated keys to maintain consistent server identity.
- Vulnerability Analysis - Evaluates connecting software security by observing key negotiation and protocol behaviors to detect implementation weaknesses.
- Security Testing and Auditing - Examines negotiation behavior during connection attempts to identify known vulnerabilities and security weaknesses in remote session software.
- Asynchronous Session Management - Manages concurrent sessions as asynchronous coroutines to ensure stable performance during high-volume traffic analysis.
- Plugin-Based Extensibility - Enables developers to inject custom interception logic and automated responses into the proxy workflow through modular plugins.
- Live User Session Mirroring - Mirrors active sessions to enable real-time monitoring and command injection while remaining transparent to the user.
