Comments (15)
It's replacing the target domain with the phishing domain, because it's actually what makes it work against most of the websites. it's a bit more than just a standard RP ;-) ... there are also few other tricks inside the code.
Why are you setting these (usually they are not required to handle that type of fqdns)? Try removing them and run the tool:
"targetResources": "abc.mytargetcdn.com",
"targetRules": "YWJjLm15dGFyZ2V0Y2RuLmNvbQ==:YWJjLm15cGlzaGRvbS5jb20=:",
from modlishka.
I need to replace referer header on requests cause I do referer check on cdn site for each request :) If I try removing the above two configs and try, I get 403 response code due to referer control.
from modlishka.
Hm, Referer header should be also automatically handled and sent as the target domain.
Basically I am stripping all possible information from the headers that could indicate that the traffic is proxied - works like a charm for red teaming :D
-rules parameter currently only replaces content in HTTP response body
If you want to modify the requests, you can do this through a plugin. there's a template inside plugins/ dir. Just define your function and enable it in your config:
//process HTTP request
s.HTTPRequest = func(req *http.Request, context HTTPContext) {}
from modlishka.
This is the log of cdn webserver that shows referer header is the still same and not replaced with target domain.. Referer info should be same with target domain info in this scenario to pass referer control in cdn side.
x.x.x.x - - [16/Jan/2019:15:11:18 +0100] "GET /xxx/app/xx.js?v=fdfdf28 HTTP/1.1" 403 192 "https://mypishdom.com/" "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" "x.x.x.x"
from modlishka.
It seems like a bug.
In the debug log, do you have any entry like this:
Patching request Referer [%s] -> [%s]" ?
from modlishka.
I see. No out is displayed when debug mod is on.
./dist/proxy -config myconf.json -debug
..
.
Listening on: [x.x.x.x:443]
Proxying [mypishdom.com":443] via --> [https://mytargetdom.com]
from modlishka.
You have to enable it in the JSON config.
from modlishka.
Attached log
subdom.txt
from modlishka.
[Wed Jan 16 15:00:45 2019] DBG Patching request Referer [https://mytargetdom.com/] -> [https://mytargetdom.com/]
All of the Referer headers seem to be set properly.
Do you have an HTTP redirect when you access the page?
from modlishka.
There is no redirection configured at cdn and target domain side and there are some css files that are not displayed debug logs too.
Only logged file in debug "type[application/javascript]" is also downloaded from targetdomain not from cdn. I think files (in cdn location) that are returned 403 are not logged.
from modlishka.
weird. I would need more info to understand the exact cause of this. if possible please PM your config and I will see what's going on.
from modlishka.
Sure I will.
Thanks
from modlishka.
By the way, I could not see your email on your profile :)
from modlishka.
What I've realized that Issues are closed without being solved here..
from modlishka.
please PM on twitter or paste your full config here. Currently there's no bug in the tool based on the what you have sent...
from modlishka.
Related Issues (20)
- !!! x509: malformed certificate . Terminating. HOT 7
- error 509 certificate malformed
- "JsRule": "
- how to make links to social networks do not change?
- Invalid IP address & redirect HOT 1
- Is it possible to use a preloaded cookie?
- RPC executor service threw an error! HOT 1
- Mod
- How to use regex with rules replace HOT 1
- All Request Forwarded
- TLS Handshake Error Unknown Certificate
- Idle. Not Working. Everything seems set HOT 8
- Stuck on re-direction
- How to stop the Target URL in the body being replaced with the Phishing URL HOT 1
- control panel
- Error.
- TLS error
- modlishka socks5 ip not working
- getting undefined: core function HOT 4
- http: superfluous response.WriteHeader call from net/http/httputil.(*ReverseProxy).ServeHTTP (reverseproxy.go:504) HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from modlishka.