SSH MITM is a penetration testing tool that intercepts SSH connections by modifying the OpenSSH source code to function as a proxy server. The tool captures and logs plaintext passwords and session data to disk during SSH communications. It operates by patching critical regions of the OpenSSH codebase to enable man-in-the-middle attacks against SSH protocols. The tool is designed specifically for security auditing and penetration testing scenarios where intercepting SSH traffic is required. Due to the security vulnerabilities introduced by the ad-hoc modifications to OpenSSH sources, it should only be executed within isolated environments such as virtual machines or containers. SSH MITM provides auditors with the capability to analyze SSH communications and credential usage patterns during security assessments.