Modlishka - An Opened Upwards Rootage Phishing Tool Alongside 2Fa Authentication

Modlishka is a flexible too powerful contrary proxy, that volition stimulate got your phishing campaigns to the adjacent marking (with minimal endeavor required from your side).
Enjoy :-)

Features
Some of the near of import 'Modlishka' features :

• Support for bulk of 2FA authentication schemes (by design).
• No website templates (just indicate Modlishka to the target domain - inwards near cases, it volition hold upwardly handled automatically).
• Full command of "cross" root TLS traffic period of time from your victims browsers.
• Flexible too easily configurable phishing scenarios through configuration options.
• Pattern based JavaScript payload injection.
• Striping website from all encryption too safety headers (back to 90's MITM style).
• User credential harvesting (with context based on URL parameter passed identifiers).
• Can hold upwardly extended alongside your ideas through plugins.
• Stateless design. Can hold upwardly scaled upwardly easily for an arbitrary publish of users - ex. through a DNS charge balancer.
• Web panel alongside a summary of collected credentials too user session impersonation (beta).
• Written inwards Go.

Action
"A motion painting is worth a yard words":
Modlishka inwards activity against an instance 2FA (SMS) enabled authentication scheme:

Note: google.com was chosen hither simply every bit a POC.

Installation
Latest source code version tin hold upwardly fetched from here (zip) or here (tar).
Fetch the code alongside 'go get' :

$ teach start out -u github.com/drk1wi/Modlishka

Compile the binary too y'all are laid to go:

$ cd $GOPATH/src/github.com/drk1wi/Modlishka/ $ make

# ./dist/proxy -h   Usage of ./dist/proxy:          -cert string      base64 encoded TLS certificate      -certKey string      base64 encoded TLS certificate commutation      -certPool string      base64 encoded Certification Authority certificate      -config string      JSON configuration file. Convenient instead of using command describe of piece of occupation switches.      -credParams string        Credential regexp collector alongside matching groups. Example: base64(username_regex),base64(password_regex)    -debug      Print debug information      -disableSecurity      Disable safety features similar anti-SSRF. Disable at your ain risk.      -jsRules string      Comma separated listing of URL patterns too JS base64 encoded payloads that volition hold upwardly injected.       -listeningAddress string      Listening address (default "127.0.0.1")      -listeningPort string      Listening port (default "443")      -log string      Local file to which fetched requests volition hold upwardly written (appended)      -phishing string      Phishing domain to create - Ex.: target.co      -plugins string      Comma seperated listing of enabled plugin names (default "all")      -postOnly      Log entirely HTTP POST requests      -rules string      Comma separated listing of 'string' patterns too their replacements.       -target string      Main target to proxy - Ex.: https://target.com      -targetRes string      Comma separated listing of target subdomains that necessitate to exceed through the  proxy       -terminateTriggers string      Comma separated listing of URLs from target's root which volition trigger session outcome      -terminateUrl string      URL to redirect the customer later session outcome triggers      -tls      Enable TLS (default false)      -trackingCookie string      Name of the HTTP cookie used to rail the victim (default "id")      -trackingParam string      Name of the HTTP parameter used to rail the victim (default "id")

Usage

• Check out the wiki page for a to a greater extent than detailed overview of the tool usage.
• FAQ (Frequently Asked Questions)
• Blog post

Credits
Thanks for helping alongside the code teach to Giuseppe Trotta (@Giutro)

Download Modlishka