Modlishka: Open Source Networking & Connectivity

What is Modlishka?

Modlishka is an open-source, GPL-3.0-licensed man-in-the-middle reverse proxy written in Go, intended for authorised security researchers and professional penetration testers who study how browser-based authentication and two-factor schemes can be bypassed.

What it is

Modlishka is a penetration testing tool that acts as a man-in-the-middle proxy and introduced a new technical approach to handling browser-based HTTP traffic flow. It transparently proxies multi-domain destination traffic, both TLS and non-TLS, over a single domain, without requiring the installation of any additional certificate on the client. It runs on Windows, macOS, Linux and BSD, is licensed under GPL-3.0, and has accumulated around 5,400 stars and 959 forks. In 2019 it was the first publicly released research tool to demonstrate a novel Adversary-in-the-Middle technique capable of bypassing many common 2FA implementations, a step the project frames as raising awareness and improving real-world defences.

The concrete problem it solves is the manual work that conventional 2FA audits and phishing simulations demand. No website templates are required, because the destination application is handled automatically in most cases, and no certificate has to be installed on the client, because Modlishka terminates and re-originates TLS itself. The same mechanism doubles as a general transparent reverse proxy for other projects and for wrapping legacy websites in TLS, which places it in the open-source Go security-tooling ecosystem rather than in any single product category.

Key capabilities

Point-and-click HTTP and HTTPS reverse proxying of arbitrary domains, with transparent handling of multi-domain TLS and non-TLS traffic over a single domain and no client-side certificate installation.
Traffic-forcing modes: -forceHTTP strips all TLS and proxies over HTTP only, while -forceHTTPS strips clear-text, with -allowSecureCookies available for HTTPS sessions using SameSite=None cookies.
Out-of-the-box support for the majority of 2FA authentication schemes.
A Client Domain Hooking attack implementation enabled with -dynamicMode, together with a diagnostic plugin.
Credential harvesting with URL parameter-based context through -credParams, which takes base64-encoded username and password regexes with matching groups.
A beta web panel plugin for credential management and session impersonation, protected by -controlCreds in user:pass format and reached through -controlURL, whose default value is SayHello2Modlishka.
Pattern-based JavaScript payload injection, automatic TLS certificate generation from a self-signed CA, JSON configuration via -config, a stateless design that scales behind a DNS load balancer, and extensibility through modular plugins.

Who uses it and how

Penetration testers and red teams running ethical phishing penetration tests, relying on the automated reverse proxy and the universal 2FA bypass support.
Security researchers who need to demonstrate weaknesses in 2FA schemes, a use case the project describes as driving better industry security solutions.
Operators who wrap legacy websites with TLS and add authentication and security headers without rewriting the underlying site.
Site owners and defenders who use it to confuse crawler bots and automated scanners.
Projects that need a universal transparent reverse proxy; because the design is stateless, deployments can be scaled behind a DNS load balancer, and the binary runs across Windows, macOS, Linux and BSD.

Getting started

Installation is done with go install github.com/drk1wi/Modlishka@latest on Go 1.24 or newer, or by cloning the repository and running make, which produces the ./dist/proxy binary; source zip and tar archives are also published.

How it compares

The facts name no paid products or comparable tools that Modlishka replaces, so it stands alone in this registry, filed under Infrastructure & Operations / Networking & Connectivity alongside the educational, mitm, penetration-testing-tools, poc, reverse-proxy and security-tools topics. Its distinguishing property, as described, is that it proxies cross-origin, multi-domain TLS and non-TLS traffic through a single domain without installing a certificate on the client.

When to use it — and when not to

A self-hoster must run the proxy binary and supply the cryptographic material directly, since -cert, -certKey and -certPool all take base64-encoded values and the automatic certificate generation plugin expects a self-signed CA, after which configuration is driven by command-line flags or a JSON -config file. It should not be used without explicit authorisation, and the -disableSecurity switch that turns off anti-SSRF protections deserves particular caution. The web panel for credential management and session impersonation is still labelled beta, so it should not be treated as a finished component.

project readme (upstream, from github) — read inline

..Modlishka..

Modlishka is an open-source penetration testing tool that acts as a man-in-the-middle proxy. It introduced a new technical approach to handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a single domain, without requiring the installation of any additional certificate on the client.

In 2019, Modlishka was the first publicly released research tool to demonstrate a novel Adversary-in-the-Middle (AitM) technique capable of bypassing many common 2FA implementations — with the goal of raising awareness and improving real-world defenses.

Note: This project is intended strictly for authorized research and professional security testing.

Use Cases

Security Testing:

Ethical phishing penetration tests with transparent, automated reverse proxy and universal 2FA bypass support
Highlight 2FA scheme weaknesses to drive better industry security solutions

General:

Wrap legacy websites with TLS
Confuse crawler bots and automated scanners
Universal transparent reverse proxy for other projects

Features

General:

Point-and-click HTTP and HTTPS reverse proxying of arbitrary domains
Full control of cross-origin TLS traffic flow without client certificate installation
Easy configuration through command line options and JSON configuration files
Pattern-based JavaScript payload injection
TLS wrapping, authentication, and security headers for legacy websites
Stateless design for easy scaling via DNS load balancer
Extensible through modular plugins
Automatic TLS certificate generation plugin (requires self-signed CA)
Cross-platform: Windows, macOS, Linux, BSD

Security:

Support for majority of 2FA authentication schemes out of the box
Client Domain Hooking attack implementation with diagnostic plugin
User credential harvesting with URL parameter-based context
Web panel plugin for credential management and session impersonation (beta)
No website templates required — automatic handling in most cases

Demo

Modlishka in action against an example 2FA scheme (SMS-based bypass):

Installation

Latest source code: zip | tar

Using go install:

go install github.com/drk1wi/Modlishka@latest

Manual build:

git clone https://github.com/drk1wi/Modlishka.git
cd Modlishka
make

Usage

./dist/proxy -h

Usage of ./dist/proxy:

  -cert string
      base64 encoded TLS certificate
  -certKey string
      base64 encoded TLS certificate key
  -certPool string
      base64 encoded Certification Authority certificate
  -config string
      JSON configuration file. Convenient instead of using command line switches.
  -controlCreds string
      Username and password to protect the credentials page. user:pass format
  -controlURL string
      URL to view captured credentials and settings. (default "SayHello2Modlishka")
  -credParams string
      Credential regexp with matching groups. e.g.: base64(username_regex),base64(password_regex)
  -debug
      Print debug information
  -disableSecurity
      Disable proxy security features like anti-SSRF. Disable at your own risk.
  -disableDynamicSubdomains
      Translate URL domain names to be the proxy domain
  -dynamicMode
      Enable dynamic mode for 'Client Domain Hooking'
  -forceHTTP
      Strip all TLS from the traffic and proxy through HTTP only
  -forceHTTPS
      Strip all clear-text from the traffic and proxy through HTTPS only
  -allowSecureCookies
      Allow secure cookies to be set. Useful when using HTTPS and cookies have SameSite=None
  -ignoreTranslateDomains string
      Comma separated list of domains to never translate and proxy
  -jsRules string
      Comma separated list of URL patterns and JS base64 encoded payloads that will be injected
      e.g.: target.tld:base64(alert(1))
  -listeningAddress string
      Listening address (default "127.0.0.1")
  -listeningPortHTTP int
      Listening port for HTTP requests (default 80)
  -listeningPortHTTPS int
      Listening port for HTTPS requests (default 443)
  -log string
      Local file to which fetched requests will be written (appended)
  -pathHostRules string
      Comma separated list of URL path patterns and target domains
      e.g.: /path/:example.com,/path2:www.example.com
  -plugins string
      Comma separated list of enabled plugin names (default "all")
  -postOnly
      Log only HTTP POST requests
  -proxyAddress string
      Proxy that should be used (socks/https/http) e.g.: http://127.0.0.1:8080
  -proxyDomain string
      Proxy domain name that will be used e.g.: proxy.tld
  -rules string
      Comma separated list of string patterns and their replacements
      e.g.: base64(old):base64(new),base64(older):base64(newer)
  -staticLocations string
      Comma separated list of FQDNs in location headers that should be preserved
  -target string
      Target domain name e.g.: target.tld
  -targetRes string
      Comma separated list of domains that were not translated automatically
      e.g.: static.target.tld
  -terminateTriggers string
      Comma separated list of URLs from target's origin which will trigger session termination
  -terminateUrl string
      URL to which a client will be redirected after session termination
  -trackingCookie string
      Name of the HTTP cookie used to track the client (default "id")
  -trackingParam string
      Name of the HTTP parameter used to track the client (default "id")

License

Modlishka is licensed under the GNU General Public License v3.0.

Commercial use is permitted under the terms of the GPLv3. If you would like to discuss support or commercial arrangements, feel free to contact the author.

Credits

Author: Modlishka was designed and implemented by Piotr Duszyński (@drk1wi).

See the list of contributors who participated in this project.

Disclaimer

This tool is made only for educational purposes and can be used in legitimate penetration tests or research only. Author does not take any responsibility for any actions taken by its users.

Frequently asked questions

Is Modlishka free to use?

Modlishka is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Modlishka do?

Modlishka. Reverse Proxy.

What is Modlishka written in?

Modlishka is primarily written in Go. Its source is publicly available at https://github.com/drk1wi/Modlishka, and it has 5,415 GitHub stars.