PHPackages                             sskaje/mitm - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. sskaje/mitm

ActiveLibrary

sskaje/mitm
===========

MiTM Proxy by sskaje

1096PHP

Since Apr 27Pushed 9y ago2 watchersCompare

[ Source](https://github.com/sskaje/mitm)[ Packagist](https://packagist.org/packages/sskaje/mitm)[ RSS](/packages/sskaje-mitm/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependenciesVersions (1)Used By (0)

PHP-MiTM
========

[](#php-mitm)

**PHP** **M**an-**i**n-**T**he-**M**iddle TCP Proxy based on ReactPHP.

This proxy is not for *SSL to plain* or *SSL to SSL* hijacking.

Author: sskaje ()

Install
-------

[](#install)

### Clone Code

[](#clone-code)

```
$ git clone git@github.com:sskaje/mitm.git

```

or

```
$ git clone https://github.com/sskaje/mitm.git

```

### Composer Install Dependencies

[](#composer-install-dependencies)

```
$ cd mitm
$ php composer.phar install

```

Try out
-------

[](#try-out)

**examples/proxy.php** is a simple implementation of PHP-MiTM sending logs to stderr.

**examples/verbose.php** does the same and dumps traffic data to stderr.

### Usage

[](#usage)

```
php examples/proxy.php LISTEN_PORT CONNECT_HOST CONNECT_PORT [RESOLVER]

```

### Examples

[](#examples)

1. Forward TCP DNS requests to 127.0.0.1:53 to 114.114.114.114:53

This requires ROOT permission, you must know why.

If not, try 5353 as the first argument of **bin/proxy.php**.

```
php examples/proxy.php 53 114.114.114.114 53
```

```
# direct tcp dns query to 114.114.114.114
$ dig +tcp @114.114.114.114
# query 127.0.0.1:53
$ dig +tcp @127.0.0.1
# query port to 5353 if you bind proxy to 127.0.0.1:5353
$ dig +tcp -p 5353 @127.0.0.1

```

2. Forward HTTP Request

```
php examples/proxy.php  15920 118.184.180.46 80

```

```
curl 127.0.0.1:15920 -H 'Host: ip.cn'
当前 IP：39.166.202.153 来自：江西省九江市 移动

```

3. Hijack and modify HTTP Traffic

Change http requests from sskaje.me to ip.rst.im

```
php examples/hijack.php  15920 104.31.70.199 80

```

```
curl 127.0.0.1:15920 -H 'Host: sskaje.me'

```

You'll see

```
[1] [HIJACK] sskaje.me FOUND in HTTP Header
[1] [HIJACK] replaced to ip.rst.im

```

More
----

[](#more)

### Hijacking Traffic on Router

[](#hijacking-traffic-on-router)

If you have a Linux Router, or Linux box with *net.ipv4.ip\_forward=1*:

```
iptables -t nat -A PREROUTING -p tcp --dst {CONNECT_HOST} --dport {CONNECT_PORT} -j REDIRECT --to-port {LISTEN_PORT}

```

\## EOF

###  Health Score

23

—

LowBetter than 27% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity14

Limited adoption so far

Community11

Small or concentrated contributor base

Maturity41

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/0dbe9955efa3afbd9ac7ddd90d5b8399495ad0c545eede3e4e8f3c85287da01f?d=identicon)[sskaje](/maintainers/sskaje)

---

Top Contributors

[![sskaje](https://avatars.githubusercontent.com/u/208950?v=4)](https://github.com/sskaje "sskaje (3 commits)")

### Embed Badge

![Health badge](/badges/sskaje-mitm/health.svg)

```
[![Health](https://phpackages.com/badges/sskaje-mitm/health.svg)](https://phpackages.com/packages/sskaje-mitm)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)