Man-in-the-Middle Network Security Toolkits

Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using custom scripts. It provides a unified command-based interface for manual interaction, enabling users to define custom key bindings, content views, and command-line tools. The engine supports multiple operational modes, including explicit, transparent, reverse, and SOCKS proxying, as well as a userspace WireGuard VPN mode for capturing traffic without requiring client-side configuration changes. Beyond basic interception, the platform includes comprehensive tools for recording and replaying network conversations to simulate complex interactions or automate repetitive tasks. It offers advanced capabilities such as request blocking, header and body modification, and local resource mapping. The system also provides robust support for debugging and performance analysis, including integration with external tools through secret logging and structured data representation. The software is designed for rapid iteration, featuring live script reloading that updates custom logic without restarting the proxy process. It includes extensive documentation for managing certificates, configuring proxy modes, and implementing custom addons through a well-defined programmatic interface.

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-party security tools. The guide covers a broad spectrum of security analysis, including attack surface mapping, authentication and session auditing, and infrastructure configuration reviews. It provides detailed procedures for identifying common vulnerabilities such as injection flaws, broken access control, business logic gaps, and token-based security issues. The project is organized as a collection of manuals and checklists, including a web security audit checklist and a dedicated API security testing manual.

GoodbyeDPI is a censorship circumvention utility designed to bypass deep packet inspection and restrictive network filtering. It functions as a background engine that intercepts and modifies network traffic at the kernel level, allowing users to maintain connectivity in environments where specific protocols or web content are blocked. The tool employs active manipulation techniques to confuse inspection hardware, including TCP stream fragmentation, HTTP header obfuscation, and the injection of out-of-order packets. By altering packet structures and dropping specific redirection patterns, it masks browsing activity and prevents automated systems from identifying or blocking outgoing requests. The application operates as a persistent system service, ensuring that traffic filtering remains active across reboots. Users manage these operations through a command-line interface, which provides granular control over packet modification strategies, DNS redirection, and various bypass parameters.

Evilginx2 is a man-in-the-middle phishing framework designed to proxy authentication traffic between a user and a target web service. By acting as a reverse proxy, the tool intercepts and relays web requests to capture credentials and session tokens in real time, enabling the bypass of multi-factor authentication mechanisms through session cookie hijacking. The platform distinguishes itself by integrating infrastructure orchestration with modular template-driven content injection. It automates the deployment of proxy servers, manages the lifecycle of encryption certificates, and applies content obfuscation to evade detection by security filters. These capabilities allow for the simulation of sophisticated phishing attacks and the assessment of organizational resilience against credential harvesting. The project includes comprehensive traffic management features, such as heuristic bot filtering, to protect the integrity of captured data from automated security scanners. It also provides a unified workflow for managing phishing campaigns, including the coordination of email delivery and the tracking of user interactions. The software is distributed as a command-line tool that handles the end-to-end configuration of network settings and domain resolution.

This project is an automated security testing suite designed to detect and exploit database vulnerabilities. It functions as a command-line utility that streamlines the identification, verification, and exploitation of web application flaws by automating the injection of malicious payloads into input parameters. The tool provides a comprehensive framework for database enumeration, allowing users to extract schema information, user data, and system configurations from identified injection points. What distinguishes this tool is its sophisticated engine for dynamic payload adaptation and heuristic fingerprinting, which adjusts injection techniques in real-time based on server responses. It supports advanced post-exploitation capabilities, including remote command execution on the underlying host operating system and file system access through database-level vulnerabilities. To navigate restricted environments, the software incorporates out-of-band data exfiltration channels and a middleware pipeline for applying user-defined transformations to bypass security filters and web application firewalls. The suite covers a broad range of operational requirements, including stateful session management, anti-CSRF token handling, and extensive request customization. It supports various target specification methods, such as proxy log analysis and remote API management, while offering granular control over scan performance and detection thresholds. The software is distributed as a command-line application, with configuration management supported through external file loading and command-line arguments.

fsociety is a penetration testing framework and security tool orchestrator designed to conduct full security audits. It functions as a wrapper that integrates external security binaries into a unified, menu-driven interface, providing a centralized system for command-line parameter mapping and execution. The project distinguishes itself by organizing specialized utilities into domain-specific collections for structured navigation. It automates the transition between different phases of an audit by chaining reconnaissance and exploitation tools through sequential workflow automation. The framework covers a broad range of security capabilities, including network reconnaissance, web application auditing, and system vulnerability exploitation. It provides dedicated toolsets for credential brute forcing, network traffic interception, wireless security auditing, and post-exploitation management to maintain persistence on compromised systems.

This project is a comprehensive cybersecurity tool collection designed to support security research, penetration testing, and vulnerability assessment. It functions as a unified penetration testing suite, providing a centralized environment where professionals can access a wide range of offensive security utilities to identify system weaknesses and study attack vectors. The platform distinguishes itself through a modular architecture that aggregates disparate security scripts into a single, hierarchical command-line interface. It simplifies the management of these utilities by integrating external repositories, allowing users to fetch and organize third-party tools directly into a structured local directory. By utilizing a categorized menu system and shell-based process execution, the suite enables efficient navigation and direct invocation of specialized tools for tasks ranging from forensic analysis and reverse engineering to exploit development. The toolkit covers a broad spectrum of security domains, including web and wireless attack vectors, cloud security, payload creation, and social media analysis. It also incorporates automated environment setup to handle the installation of necessary system packages and language runtimes, ensuring compatibility across its diverse collection of utilities.

P4wnP1 is a hardware-based USB HID attack platform and peripheral emulator. It functions as a tool for emulating USB keyboards and mice to execute automated keystroke payloads, as well as a WiFi-enabled remote access tool that provides a wireless bridge for network relay and SSH access. The project is distinguished by its ability to establish covert bidirectional communication channels and remote shells using raw HID reports, specifically to bridge air-gapped systems. It further enables wireless network interception and the routing of network traffic over WiFi to facilitate man-in-the-middle operations. The platform includes capabilities for automating password cracking via emulated keyboard input and extracting browser credentials and system data to internal or external mass storage. It also supports executing payloads directly within system memory to avoid leaving a footprint on the target disk.

Pi-hole is a self-hosted network utility that functions as a DNS sinkhole server to provide network-wide ad blocking. By acting as a dedicated network gateway, it intercepts and discards requests for known advertising, tracking, and malicious domains across an entire local network, preventing unwanted content from loading on any connected device. The software operates through a lightweight background daemon that handles high volumes of concurrent DNS queries with minimal resource overhead. It utilizes a host-file injection mechanism to redirect traffic toward its local filtering engine and applies regex-based pattern matching to identify and block specific domain requests. Users manage these operations and monitor network traffic statistics through a centralized, web-based configuration interface. Beyond blocking, the project provides tools for comprehensive DNS traffic management and home network security. By resolving domain names locally, it offers increased visibility into outgoing internet traffic and helps optimize network performance by preventing the download of resource-heavy tracking scripts and advertisements.

The Social-Engineer Toolkit is a social engineering framework and penetration testing suite designed to simulate human-centric security attacks. It serves as a phishing simulation tool and credential harvesting utility to evaluate personnel awareness and organizational resilience. The toolkit provides specialized tooling for phishing campaign testing and credential theft simulation. It enables the creation of deceptive emails and landing pages to identify vulnerabilities in how users handle sensitive account information. The system includes capabilities for security awareness training and broader penetration testing, utilizing site cloning, DNS spoofing, and payload generation to execute various attack vectors.

Shadowsocks-Windows is a desktop proxy manager that provides a graphical interface for configuring system-wide network routing. It functions as a local SOCKS5 or HTTP proxy server, intercepting outbound traffic through system-level injection to route requests through secure, encrypted remote tunnels. The application distinguishes itself through a modular architecture that supports plugin-based transport extensibility, allowing users to integrate external binaries for custom traffic obfuscation and specialized cryptographic protocols. It also enables high-availability networking by automatically rotating between multiple proxy servers based on real-time performance metrics, and supports multi-instance orchestration to manage independent proxy states and configurations simultaneously. Users can exercise granular control over network traffic through custom rule management, including the use of JavaScript-based auto-configuration files and geographic filtering to determine which requests bypass or traverse the proxy. The software further extends its utility by encapsulating connectionless datagrams into stream-oriented tunnels, ensuring that applications requiring UDP can function within the proxy environment.

Ettercap is a network utility tool used for ARP spoofing, packet filtering, traffic interception, passive scanning, and DHCP hijacking. It functions as a network traffic interceptor and man-in-the-middle packet filter to monitor and manipulate live TCP/UDP connections on a local area network. The project provides specialized capabilities for traffic redirection via ARP cache poisoning, DHCP server spoofing, ICMP redirects, and switch port stealing. It also enables the emulation of rogue services and the decryption of SSH1 session streams by substituting public keys. Additional capabilities include network discovery through active host discovery and passive LAN scanning, as well as network topology mapping. The tool supports real-time traffic manipulation by injecting forged data into live streams and filtering network payloads using custom scripts.

Shadowsocks is a secure network tunneling tool designed for censorship circumvention and private internet connectivity. It functions as a proxy system that routes traffic through encrypted tunnels, allowing users to bypass regional network restrictions and protect data from interception across public infrastructures. The project utilizes a lightweight, custom proxy protocol that incorporates stream-based cipher encryption to obfuscate payload content and prevent deep packet inspection. By employing an asynchronous, event-driven networking model, the system manages concurrent connections efficiently. It establishes secure communication through a structured client-server handshake and authentication process, ensuring that all data transmission adheres to defined encryption requirements. The framework provides a modular approach to building and deploying custom proxy infrastructure, featuring a cross-platform socket abstraction layer that ensures consistent traffic routing across different operating systems. This implementation allows for the configuration of specialized connection handlers to manage data flow between local clients and remote server endpoints.

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific executables and mobile application packages to establish remote command sessions. The framework covers a broad surface of capabilities, including web application penetration testing, OSINT reconnaissance, memory and disk forensics, and wireless network auditing. It provides tools for payload generation, credential theft, and the automation of information gathering from public data sources. This project is implemented primarily as a shell-based application.

Masscan is a command-line network scanner designed for large-scale discovery and infrastructure reconnaissance. It identifies open ports across specific network segments or the entire internet by probing vast address ranges with high efficiency. The tool functions as an asynchronous packet engine, bypassing standard operating system kernel networking stacks to transmit raw packets directly from application memory. The project distinguishes itself through a specialized architecture that manages millions of concurrent connections by separating packet transmission and reception into independent execution threads. It utilizes a stateless, index-based mathematical algorithm to randomize target selection, ensuring probes are distributed unpredictably across address spaces. To maintain consistent performance and prevent network congestion, the scanner employs a high-precision timer to regulate transmission rates and uses zero-copy buffer management to minimize memory overhead. The software provides a platform-agnostic interface for raw network access, allowing it to operate consistently across different hardware and operating system environments. It supports the export of collected reconnaissance data into structured formats such as XML, JSON, or plain text for further analysis. The application is distributed as a portable utility, with its core codebase maintained through standardized string handling and automated testing.

Bettercap is an extensible framework for network security testing that provides a unified interface for performing man-in-the-middle attacks, network reconnaissance, and traffic manipulation across WiFi, Bluetooth, and wired networks. It operates through a modular attack module system that loads and executes interchangeable offensive or diagnostic modules, supported by event-driven session management and multi-protocol network spoofing capabilities. The framework distinguishes itself by covering a broad range of network domains, including Bluetooth Low Energy scanning and enumeration, CAN-Bus network analysis for automotive security testing, IPv4/IPv6 host and service discovery, and WiFi security assessment with tools for deauthentication, rogue access points, and packet injection. It also includes wireless HID attack simulation for injecting keystrokes into target computers over wireless connections. Bettercap provides packet-level traffic manipulation through raw socket access and protocol-aware injection, along with network identity spoofing to redirect traffic through an attacker-controlled system. A real-time web UI dashboard streams live attack data and module outputs to a browser-based interface using WebSocket and REST APIs.

Clash-rules provides a standardized, declarative system for managing network traffic routing across desktop and mobile proxy clients. It functions as a centralized configuration provider that uses structured rule sets to categorize outgoing requests, allowing users to define whether specific connections should be proxied, rejected, or routed directly. The project distinguishes itself through its comprehensive, curated rulesets that enable granular control over network behavior. By employing domain-pattern matching, CIDR-based network analysis, and application-specific signatures, it ensures consistent traffic management across diverse environments. It also supports automated synchronization, allowing proxy clients to fetch updated routing logic from external sources without manual intervention. The platform covers a broad range of traffic management capabilities, including regional content access, local network optimization, and malicious traffic filtering. These features allow for the systematic blocking of advertising and tracking domains while ensuring that private, local, and internal network resources bypass proxy tunnels to maintain direct connectivity.

This firmware transforms an ESP32 device into a portable penetration testing platform by combining an embedded JavaScript runtime with multi-protocol wireless attack capabilities, USB and Bluetooth HID emulation, and a menu-driven user interface. It is designed as a unified system that integrates persistent storage, hardware abstraction for external radio modules, a serial command protocol for headless operation, and a web-based remote desktop that streams the device screen and relays button inputs for remote control. The custom JavaScript scripting environment enables users to write and run scripts that orchestrate infrared, radio, serial, and file operations, with support for TypeScript compilation and direct execution of stored payloads. The firmware distinguishes itself through its dual-storage architecture (LittleFS internal flash plus SD card), boot-time state restoration, and a serial command protocol that allows complete external control without a display. The web interface provides file management, screen viewing, serial command sending, and text editing, making the device operable without its physical buttons. Beyond these differentiators, the firmware covers a comprehensive range of attack and reconnaissance functions: WiFi deauthentication, handshake capture and cracking, rogue access point deployment with captive portals, ARP spoofing, and LLMNR/NBT-NS poisoning; Bluetooth scanning, notification spam, and keystroke injection; RFID and iButton reading, writing, cloning, and emulation; infrared send, receive, and replay; sub-GHz and 2.4 GHz RF signal capture, replay, jamming, and spectrum visualization; GPS-enabled wardriving with coordinate logging; LoRa text messaging; and ESP-NOW, Ethernet, WireGuard VPN, and SOCKS4 proxy connectivity. The firmware is installed by flashing an ESP32 device and can be extended via an on-device app store for additional tools.

Clash Meta for Android is a system-level network utility that functions as a rule-based proxy engine for mobile devices. It operates by intercepting system-wide network traffic through a virtual interface, allowing it to route data packets through configurable tunnels based on domain, IP, and geo-location patterns. By acting as a transparent proxy, the application manages connectivity and enhances privacy for all installed software on the device. The project distinguishes itself by utilizing a high-performance, cross-compiled proxy kernel that handles concurrent connections and protocol translation directly on mobile hardware. It supports advanced proxy management, including the ability to handle multiple protocols and load balancing, while providing dynamic configuration hot-reloading to update routing rules and server endpoints in real-time without interrupting the networking service. Beyond core routing, the application provides content filtering and blocking capabilities to restrict unwanted network requests at the device level. It facilitates secure mobile connectivity by encapsulating outgoing data within encrypted tunnels, ensuring privacy when operating across various network environments. The software is distributed as an Android application, utilizing a low-overhead interface to bridge the native user interface with the underlying networking kernel.

This project is a network traffic manipulation tool and proxy designed to intercept, inspect, and modify data streams between mobile applications and their servers. It functions as a scriptable content blocker and traffic router, allowing users to apply custom rules to incoming and outgoing network requests. The tool enables users to bypass regional restrictions and subscription paywalls by injecting configuration rules that override server-side validation. It also provides capabilities for removing advertisements, tracking scripts, and promotional content from mobile applications and web services in real time. Beyond traffic management, the framework supports automated task execution and web content customization. Users can schedule recurring scripts for routine maintenance or information retrieval and inject custom code or styles into web sessions to alter page layouts and remove visual clutter.