MITMf V0.9.6

Framework for Man-In-The-Middle attacks

Quick tutorials, examples and dev updates at http://sign0f4.blogspot.it

This tool is based on sergio-proxy and is an attempt to revive and update the project.

Before submitting issues please read the appropriate section.

(Another) Dependency change!

As of v0.9.6, the fork of the python-netfilterqueue library is no longer required.

If MITMf is not in your distros repo or you just want the latest version:

clone this repository
run the setup.sh script
run the command pip install -r requirements.txt to install all python dependencies

Responder - LLMNR, NBT-NS and MDNS poisoner
SSLstrip+ - Partially bypass HSTS
Spoof - Redirect traffic using ARP Spoofing, ICMP Redirects or DHCP Spoofing and modify DNS queries
Sniffer - Sniffs for various protocol login and auth attempts
BeEFAutorun - Autoruns BeEF modules based on clients OS or browser type
AppCachePoison - Perform app cache poison attacks
SessionHijacking - Performs session hijacking attacks, and stores cookies in a firefox profile
BrowserProfiler - Attempts to enumerate all browser plugins of connected clients
CacheKill - Kills page caching by modifying headers
FilePwn - Backdoor executables being sent over http using bdfactory
Inject - Inject arbitrary content into HTML content
JavaPwn - Performs drive-by attacks on clients with out-of-date java browser plugins
jskeylogger - Injects a javascript keylogger into clients webpages
Replace - Replace arbitary content in HTML content
SMBAuth - Evoke SMB challenge-response auth attempts
Upsidedownternet - Flips images 180 degrees

Addition of DNSChef, the framework is now a IPv4/IPv6 (TCP & UDP) DNS server ! Supported queries are: 'A', 'AAAA', 'MX', 'PTR', 'NS', 'CNAME', 'TXT', 'SOA', 'NAPTR', 'SRV', 'DNSKEY' and 'RRSIG'
Addition of the Sniffer plugin which integrates Net-Creds currently supported protocols are: FTP, IRC, POP, IMAP, Telnet, SMTP, SNMP (community strings), NTLMv1/v2 (all supported protocols like HTTP, SMB, LDAP etc..) and Kerberos
Integrated Responder to poison LLMNR, NBT-NS and MDNS, and act as a WPAD rogue server.
Integrated SSLstrip+ by Leonardo Nve to partially bypass HSTS as demonstrated at BlackHat Asia 2014
Addition of the SessionHijacking plugin, which uses code from FireLamb to store cookies in a Firefox profile
Spoof plugin can now exploit the 'ShellShock' bug when DHCP spoofing!
Spoof plugin now supports ICMP, ARP and DHCP spoofing
Usage of third party tools has been completely removed (e.g. ettercap)
FilePwn plugin re-written to backdoor executables and zip files on the fly by using the-backdoor-factory and code from BDFProxy
Added msfrpc.py for interfacing with Metasploits rpc server
Added beefapi.py for interfacing with BeEF's RESTfulAPI
Addition of the app-cache poisoning attack by Krzysztof Kotowicz (blogpost explaining the attack here http://blog.kotowicz.net/2010/12/squid-imposter-phishing-websites.html)

If you have questions regarding the framework please email me at byt3bl33d3r@gmail.com

If you find a bug please open an issue and include at least the following in the description:

Also remember: Github markdown is your friend!

apt-get install mitmf