drk1wi/Modlishka

Modlishka is an open-source penetration testing tool that acts as a man-in-the-middle proxy. It introduced a new technical approach to handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a single domain, without requiring the installation of any additional certificate on the client. This enables multiple practical use cases.

Modlishka was the first publicly released research tool, in 2019, to demonstrate a novel Adversary-in-the-Middle (AitM) technique capable of bypassing many common 2FA implementations — with the goal of raising awareness and improving real-world defenses.

The project was created to highlight authentication flaws and is intended strictly for authorized research and professional security testing.

From a security perspective, Modlishka can currently be used to:

Modlishka was written as an attempt to overcome standard reverse proxy limitations and as a personal challenge to see what is possible with sufficient motivation and a bit of extra research time. The achieved results appeared to be very interesting and the tool was initially released and later updated with an aim to:

Modlishka was primarily written for security-related tasks. Nevertheless, it can be helpful in other, non-security related, usage scenarios.

"A picture is worth a thousand words":