ssh-mitm/ssh-mitm

Health v2 · maintenance only

Adoption not part of the score

1470 stars · 157 forks observed · 2026-09-29

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SSH-MITM is an open-source man-in-the-middle SSH server for authorized security audits and malware analysis. It proxies SSH client-server connections, intercepting sessions, credentials, file transfers, and port forwarding in real time via a plugin system.

Use cases

• intercept ssh sessions during a penetration test
• capture ssh passwords and public keys in cleartext
• hijack a live ssh terminal session and inject commands
• manipulate files transferred over scp or sftp
• test clients for cve-2021-36367 fido2 token bypass
• audit ssh traffic through a transparent proxy
• redirect clients without forwarded agents to a honeypot

When to choose

• you need real-time visibility into ssh sessions during an authorized audit
• you want to intercept or replace scp/sftp file transfers
• you need to demonstrate ssh client vulnerabilities like trivial authentication attacks
• you want an extensible mitm ssh proxy with plugins

When to avoid

• you only need to run a normal ssh server or client
• you lack explicit authorization to test the target systems
• you need tls/https interception rather than ssh

Facets

cli-tool · maturity active

security penetration-testing proxy ssh plugin-system security penetration-testing developer-tools networking windows python cli cross-platform ssh-mitm man-in-the-middle session-hijacking sftp scp security-audit honeypot fido2 linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ssh-mitm/ssh-mitm")