A penetration testing tool that intercepts SSH connections to log plaintext passwords and full sessions.
SSH MITM is a penetration testing tool that intercepts SSH connections to capture plaintext passwords and log full shell and SFTP sessions. It modifies OpenSSH to act as a proxy between clients and servers, demonstrating the security risks of ignoring SSH key change warnings. The tool is designed for security professionals to audit network vulnerabilities and educate users about SSH security flaws.
Security auditors, penetration testers, and network administrators who need to demonstrate SSH interception vulnerabilities in controlled environments. It is also suitable for educational purposes in cybersecurity training.
Developers choose SSH MITM because it provides a comprehensive, easy-to-deploy solution for intercepting and logging SSH traffic, including full session capture and SFTP support. Its Docker integration and target discovery scripts streamline the setup process for security testing.
SSH man-in-the-middle tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a pre-built Docker image for isolated, easy setup, as shown in the README with step-by-step instructions for pulling and running the container.
Logs full SSH shell sessions and SFTP transfers to disk, including plaintext passwords and commands, with HTML logs for SFTP files as demonstrated in sample results.
Includes JoesAwesomeSSHMITMVictimFinder.py to scan LANs for active SSH connections, simplifying victim identification with tunable parameters for network load.
Clearly demonstrates the risks of ignoring SSH key warnings through real-time interception, making it ideal for security training and audits.
The README warns that ad-hoc edits to OpenSSH sources introduce serious vulnerabilities, requiring execution only in VMs or containers to avoid compromise.
Requires root access, IP forwarding, iptables rules, and ARP spoofing, which can be error-prone and network-intensive, as noted in the target discovery section.
Only intercepts SSH traffic; not suitable for auditing other common protocols like HTTPS or RDP, restricting its use to SSH-specific security testing.