sslstrip

No entries match these filters. Clear filters

1. 5.0.0 Aug 28, 2026 · issue 058

   sslstrip 5.0.0: full Python 3.14 rewrite with new CLI subcommands, nftables lifecycle management, and gated traffic logging

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.0 https://github.com/L1ghtn1ng/sslstrip.git
   # already have the repo? check out this version:
   $ git checkout 5.0.0

   └──▷ TRY IT
   Run a pre-flight check to verify the environment is correctly configured before launching a strip session.
   copy

   $ sslstrip doctor

   Capture unredacted HTTP traffic to a file during a strip session — useful for post-session credential review in a lab.
   copy

   $ sslstrip run --traffic-log --traffic-log-file /tmp/strip-session.log

   Supply a lab CA bundle so the shared Twisted Agent can verify TLS to upstream servers that use a private PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets..
   copy

   $ sslstrip run --ca-file /etc/lab/ca-bundle.pem

   • Adds sslstrip run, sslstrip doctor, sslstrip cleanup, and sslstrip --version subcommands replacing the old monolithic entry point.
   • Adds --ca-file flag to supply extra lab certificate authorities for TLS verification in controlled environments.
   • Adds --traffic-log and --traffic-log-file flags for gated, unredacted traffic logging (both flags required to enable).
   • Adds managed nftables lifecycle with exclusive /run/sslstrip lock, atomic JSON nft operations, privilege drop, and automatic forwarding restore — replacing iptables-only setup.
   • Adds native gzip, Brotli 1.2.0, and stdlib Zstandard decompression including stacked encodings, with an 8 MiB decoded-body limit.

   +4 more show less

   • Adds TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. (30-minute) and LRU (10,000-entry) bounds on the secure-link store.
   • Adds a shared Twisted Agent with verified TLS policy and connection pool, orchestrated via native async def and Deferred.fromCoroutine.
   • Adds structured HTTP error responses: missing Host header → 400, CONNECT → 405, protocol upgrades → 426, upstream/DNS/TLS failures → 502, timeouts → 504.
   • Packaging now requires Python 3.14+ (requires-python = ">=3.14") with exact pins for Twisted[tls] and Brotli via uv_build and a locked uv.lock.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Requires Python 3.14 or later (requires-python = ">=3.14"); any existing environment running Python 3.x < 3.14 will not work.
   • !The top-level sslstrip.py entry point is removed; invocation is now via the sslstrip CLI subcommands (run, doctor, cleanup).
   • !iptables-based managed path is removed; nftables is now the first-class managed firewall backend.
   • !Twisted HTTPClient, factory, DnsCache client stack, and global singletons are removed.
   • !Dynamic import shim and camelCase modules are removed; any code or scripts referencing them will break.
   • !Favicon substitution and the hard-coded E*TRADE expression are removed.
   • !mypy is replaced by strict ty; mypy-based CI or type-checking workflows will break.