ssh-mitm/ssh-mitm
Ssh Mitm
Acest proiect este un framework de tip proxy transparent conceput pentru interceptarea, analiza și manipularea traficului secure shell (SSH). Prin terminarea independentă a conexiunilor client și server, acesta oferă vizibilitate completă asupra sesiunilor criptate, permițând monitorizarea fluxurilor de autentificare, a transferurilor de fișiere și a execuției de comenzi în timp real.
Instrumentul se distinge printr-o arhitectură modulară, bazată pe plugin-uri, care permite utilizatorilor să injecteze logică personalizată de interceptare în fluxul de lucru al proxy-ului. Suportă crearea de medii efemere și agenți mock în memorie, facilitând simularea scenariilor de securitate și testarea robusteții autentificării fără a necesita infrastructură externă.
Framework-ul acoperă o suprafață largă de capabilități, inclusiv auditarea comportamentului de securitate al clientului, capturarea credențialelor de autentificare și inspecția protocoalelor de rețea încapsulate, cum ar fi tunelurile și operațiunile de gestionare la distanță. De asemenea, oferă controale operaționale pentru gestionarea sesiunilor concurente și menținerea parității sesiunii prin redirecționarea semnalelor de terminal.
Features
- Transparent Interception Proxies - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Man-in-the-Middle Frameworks - Terminates client and server connections independently to provide full visibility into encrypted session data and authentication flows.
- Traffic Proxying and Interception - Acts as a modular tool for intercepting and modifying secure shell traffic, including file transfers and network tunnels.
- Proxy Security Auditors - Serves as a transparent proxy for auditing authentication flows and client security behavior in real time.
- Interception Proxies - Inspects and manipulates authentication flows to capture credentials or force interactive fallbacks.
- Authentication Testing - Probes remote servers and simulates client responses to evaluate the robustness of authentication methods and multi-factor security.
- SSH Security Tools - Analyzes client and server authentication behavior to identify vulnerabilities and weak configurations in remote access implementations.
- Tunneling and Proxying - Enables remote port forwarding and proxy jump capabilities to facilitate complex network traversal.
- NETCONF Subsystem Interceptions - Provides real-time inspection and modification of NETCONF operations within secure shell tunnels.
- SSH Session Simulations - Facilitates testing of authentication robustness by simulating SSH environments entirely in memory.
- Interception Proxies - Intercepts file transfers to store copies or replace files on the fly during active sessions.
- Traffic Protocol Inspection - Parses and manipulates encapsulated data streams including network tunnels, file transfers, and terminal output during active sessions.
- Application-Layer Protocol Inspections - Captures and parses encapsulated traffic like NETCONF, SOCKS tunnels, and file transfers within secure shell connections.
- Authentication Credential Captures - Intercepts passwords and public key authentication attempts to audit how sensitive credentials are handled.
- Bypass Testing - Exploits authentication negotiation vulnerabilities to circumvent hardware-based security requirements during testing.
- Authentication Method Auditing - Probes remote servers for supported authentication methods and validates public keys to identify security misconfigurations.
- Client Behavior Auditing - Identifies potential vulnerabilities in authentication handling by analyzing how clients respond to manipulated server responses.
- Multi-Factor Authentication Bypass Testing - Intercepts authentication requests to establish sessions using basic credentials, bypassing hardware-based multi-factor confirmations.
- Encapsulated Traffic Inspection - Captures and inspects TCP tunnels, SOCKS forwarding, and remote command sessions to monitor encapsulated communications.
- Session Auditing - Decrypts and displays live terminal output while logging command execution and state transitions for security auditing.
- SSH Agent Forwarding - Utilizes forwarded authentication agents to establish connections to remote servers after session interception.
- Host Key Auto-Generators - Supports multiple host key algorithms and persists generated keys to maintain consistent server identity.
- Vulnerability Analysis - Evaluates connecting software security by observing key negotiation and protocol behaviors to detect implementation weaknesses.
- Security Testing and Auditing - Examines negotiation behavior during connection attempts to identify known vulnerabilities and security weaknesses in remote session software.
- Asynchronous Session Management - Manages concurrent sessions as asynchronous coroutines to ensure stable performance during high-volume traffic analysis.
- Plugin-Based Extensibility - Enables developers to inject custom interception logic and automated responses into the proxy workflow through modular plugins.
- Live User Session Mirroring - Mirrors active sessions to enable real-time monitoring and command injection while remaining transparent to the user.
