README

..Modlishka..

!License
!Platform
!Build Status
!Go Version

Modlishka is an open-source penetration testing tool that acts as a man-in-the-middle proxy. It introduced a new technical approach to handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a single domain, without requiring the installation of any additional certificate on the client.

In 2019, Modlishka was the first publicly released research tool to demonstrate a novel Adversary-in-the-Middle (AitM) technique capable of bypassing many common 2FA implementations — with the goal of raising awareness and improving real-world defenses.

 Note: This project is intended strictly for authorized research and professional security testing.

 Use Cases

Security Testing:
- Ethical phishing penetration tests with transparent, automated reverse proxy and universal 2FA bypass support
- Highlight 2FA scheme weaknesses to drive better industry security solutions

General:
- Wrap legacy websites with TLS
- Confuse crawler bots and automated scanners
- Universal transparent reverse proxy for other projects

 Features

General:
- Point-and-click HTTP and HTTPS reverse proxying of arbitrary domains
- Full control of cross-origin TLS traffic flow without client certificate installation
- Easy configuration through command line options and JSON configuration files
- Pattern-based JavaScript payload injection
- TLS wrapping, authentication, and security headers for legacy websites
- Stateless design for easy scaling via DNS load balancer
- Extensible through modular plugins
- Automatic TLS certificate generation plugin (requires self-signed CA)
- Cross-platform: Windows, macOS, Linux, BSD

Security:
- Support for majority of 2FA authentication schemes out of the box
- Client Domain Hooking attack implementation with diagnostic plugin
- User credential harvesting with URL parameter-based context
- Web panel plugin for credential management and session impersonation (beta)
- No website templates required — automatic handling in most cases

 Demo

Modlishka in action against an example 2FA scheme (SMS-based bypass):



 Installation

Latest source code: zip | tar

Using go install:
bash
go install github.com/drk1wi/Modlishka@latest


Manual build:
bash
git clone https://github.com/drk1wi/Modlishka.git
cd Modlishka
make


 Usage


./dist/proxy -h

Usage of ./dist/proxy:

  -cert string
      base64 encoded TLS certificate
  -certKey string
      base64 encoded TLS certificate key
  -certPool string
      base64 encoded Certification Authority certificate
  -config string
      JSON configuration file. Convenient instead of using command line switches.
  -controlCreds string
      Username and password to protect the credentials page. user:pass format
  -controlURL string
      URL to view captured credentials and settings. (default "SayHello2Modlishka")
  -credParams string
      Credential regexp with matching groups. e.g