droe/sslsplit

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1876 stars · 331 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SSLsplit is a transparent SSL/TLS interception proxy for man-in-the-middle attacks against encrypted network connections. It terminates TLS connections redirected via NAT, forges certificates on the fly, and logs decrypted traffic to files, PCAPs, or a network interface.

Use cases

• intercept and inspect HTTPS traffic on a network for forensics
• perform man-in-the-middle TLS attacks during penetration testing
• analyze application security by decrypting TLS connections
• log decrypted traffic to PCAP files for later analysis
• intercept SMTP STARTTLS and other plaintext-to-TLS upgrades
• mirror decrypted traffic to a network interface for monitoring tools

When to choose

• you need transparent TLS interception without configuring client proxies
• you want on-the-fly forged certificates with SNI support
• you need IPv4/IPv6 support for TCP, SSL, HTTP, and HTTPS interception
• you require defenses against HSTS, HPKP, and Certificate Transparency during testing

When to avoid

• you need a browser-configurable HTTP or SOCKS proxy
• you want to intercept modern TLS 1.3 or QUIC/HTTP2 connections
• you lack the ability to install a trusted CA certificate on target devices
• you need a pure passive traffic sniffer without interception

Facets

cli-tool · maturity maintenance

proxy networking security penetration-testing logging security networking penetration-testing privacy bsd cli c tls-interception mitm transparent-proxy ssl tls sni starttls network-forensics pcap-logging linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="droe/sslsplit")