PRINT
PRINT
SEND MAIL
SEND MAIL
2FA AuthenticationCommand LineJavaScriptMITMModlishkaNEW TOOLSParameterTLS

Modlishka – An Open Source Phishing Tool With 2FA Authentication

Want create site? Find Free WordPress Themes and plugins.

Modlishka is a flexible and powerful reverse proxy, that will take your phishing campaigns to the next level (with minimal effort required from your side).
Enjoy 🙂

Features
Some of the most important ‘Modlishka’ features :

  • Support for majority of 2FA authentication schemes (by design).
  • No website templates (just point Modlishka to the target domain – in most cases, it will be handled automatically).
  • Full control of “cross” origin TLS traffic flow from your victims browsers.
  • Flexible and easily configurable phishing scenarios through configuration options.
  • Pattern based JavaScript payload injection.
  • Striping website from all encryption and security headers (back to 90’s MITM style).
  • User credential harvesting (with context based on URL parameter passed identifiers).
  • Can be extended with your ideas through plugins.
  • Stateless design. Can be scaled up easily for an arbitrary number of users – ex. through a DNS load balancer.
  • Web panel with a summary of collected credentials and user session impersonation (beta).
  • Written in Go.


Action
“A picture is worth a thousand words”:
Modlishka in action against an example 2FA (SMS) enabled authentication scheme:

Note: google.com was chosen here just as a POC.

Installation
Latest source code version can be fetched from here (zip) or here (tar).
Fetch the code with ‘go get’ :

$ go get -u github.com/drk1wi/Modlishka

Compile the binary and you are ready to go:

$ cd $GOPATH/src/github.com/drk1wi/Modlishka/
$ make

# ./dist/proxy -h


Usage of ./dist/proxy:

-cert string
base64 encoded TLS certificate

-certKey string
base64 encoded TLS certificate key

-certPool string
base64 encoded Certification Authority certificate

-config string
JSON configuration file. Convenient instead of using command line switches.

-credParams string
Credential regexp collector with matching groups. Example: base64(username_regex),base64(password_regex)

-debug
Print debug information

-disableSecurity
Disable security features like anti-SSRF. Disable at your own risk.

-jsRules string
Comma separated list of URL patterns and JS base64 encoded payloads that will be injected.

-listeningAddress string
Listening address (default "127.0.0.1")

-listeningPort string
Listening port (default "443")

-log string
Local file to which fetched requests will be written (appended)

-phishing string
Phishing domain to create - Ex.: target.co

-plugins string
Comma seperated list of enabled plugin names (default "all")

-postOnly
Log only HTTP POST requests

-rules string
Comma separated list of 'string' patterns and their replacements.

-target string
Main target to proxy - Ex.: https://target.com

-targetRes string
Comma separated list of target subdomains that need to pass through the proxy

-terminateTriggers string
Comma separated list of URLs from target's origin which will trigger session termination

-terminateUrl string
URL to redirect the client after session termination triggers

-tls
Enable TLS (default false)

-trackingCookie string
Name of the HTTP cookie used to track the victim (default "id")

-trackingParam string
Name of the HTTP parameter used to track the victim (default "id")

Usage

  • Check out the wiki page for a more detailed overview of the tool usage.
  • FAQ (Frequently Asked Questions)
  • Blog post

Credits
Thanks for helping with the code go to Giuseppe Trotta (@Giutro)

Did you find apk for android? You can find new Free Android Games and apps.
Tags: