jtesta/ssh-mitm

Health v2 · maintenance only

Flags: archived no_license

Adoption not part of the score

1740 stars · 213 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A penetration testing tool that intercepts SSH connections by running a patched OpenSSH v7.5p1 server as a proxy between a victim and their intended SSH server. It logs plaintext passwords, shell sessions, and SFTP sessions to disk, relying on users ignoring host key change warnings.

Use cases

• intercept ssh connections during a penetration test
• capture ssh passwords on a lan with arp spoofing
• log ssh shell and sftp sessions of targets
• demonstrate ssh man-in-the-middle attack risks
• find potential ssh targets on a local network
• audit whether users ignore ssh host key warnings

When to choose

• you are an authorized auditor testing ssh credential exposure on a lan
• you need a ready-made dockerized ssh mitm proxy with session logging
• you want to demonstrate host-key-warning fatigue to clients

When to avoid

• you need a general-purpose ssh proxy or bastion for production use
• you want a maintained tool with recent updates and broad platform support
• you are not authorized to test the target network
• you need a pure-python or easily extensible mitm framework

Facets

cli-tool · maturity maintenance

penetration-testing security networking proxy logging security penetration-testing networking cli ssh mitm man-in-the-middle arp-spoofing openssh credential-capture sftp linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="jtesta/ssh-mitm")