// the take
sslstrip is the original tool built around Moxie Marlinspike's 2009 SSL-stripping attack: it sits as a transparent MITM proxy, rewrites HTTPS links to HTTP on the fly, and logs whatever a victim sends unencrypted as a result. It's a penetration-testing and security-research tool for demonstrating downgrade attacks, not something with any legitimate production use.
The codebase is small and readable end to end — a handful of Twisted modules (ServerConnection, SSLServerConnection, URLMonitor) make the actual mechanics of the attack easy to follow rather than hiding them behind abstraction. The CookieCleaner module, which strips secure flags from session cookies, is the genuinely clever part that made the original attack effective in practice. The README's four-step pipeline (ip_forward, iptables NAT redirect, arpspoof, sslstrip) is still a solid teaching example of how ARP spoofing and MITM proxying chain together.
It's Python 2.5-era code on the legacy twisted.web stack — Python 2 has been dead since 2020, so getting this running today means hunting down an old interpreter and a compatible Twisted version rather than just pip installing something. There's been no real maintenance since the last push in 2021, so none of the Twisted API changes since then have been accounted for. The attack itself is largely neutralized on the modern web: HSTS preloading and browsers defaulting to HTTPS-first mean this only bites unpatched sites or old clients, not a realistic attack surface anymore. Running it requires root, manual iptables rules, and arpspoof with no guardrails — there's nothing stopping you from pointing it at a network you don't have permission to test.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →