Modlishka Documentation

Modlishka is a reverse proxy designed for specific use cases. The main entrypoint initializes configuration, logging, plugins, and the core runtime before starting the server. The execution flow follows these steps:

1. Parse configuration via config.ParseConfiguration().
2. Initialize logging based on Debug and LogPostOnly flags.
3. Configure and enable plugins via plugin.SetPluginRuntimeConfig and plugin.Enable.
4. Verify configuration requirements via conf.VerifyConfiguration().
5. Set up core and server runtime configurations.
6. Prepare regexes via runtime.MakeRegexes().
7. Start the server using core.RunServer().

// The main entrypoint executes the following sequence:
package main

func main() {
	conf := Configuration{
		config.ParseConfiguration(),
	}

	conf.initLogging()
	plugin.SetPluginRuntimeConfig(conf.Options)
	plugin.Enable(conf.Options)
	conf.VerifyConfiguration()
	runtime.SetCoreRuntimeConfig(conf.Options)
	core.SetServerRuntimeConfig(conf.Options)
	runtime.MakeRegexes()
	core.RunServer()
}

The following command-line options are available for the ./dist/proxy binary:

  -cert string
      base64 encoded TLS certificate
  -certKey string
      base64 encoded TLS certificate key
  -certPool string
      base64 encoded Certification Authority certificate
  -config string
      JSON configuration file. Convenient instead of using command line switches.
  -controlCreds string
      Username and password to protect the credentials page. user:pass format
  -controlURL string
      URL to view captured credentials and settings. (default "SayHello2Modlishka")
  -credParams string
      Credential regexp with matching groups. e.g.: base64(username_regex),base64(password_regex)
  -debug
      Print debug information
  -disableSecurity
      Disable proxy security features like anti-SSRF. Disable at your own risk.
  -disableDynamicSubdomains
      Translate URL domain names to be the proxy domain
  -dynamicMode
      Enable dynamic mode for 'Client Domain Hooking'
  -forceHTTP
      Strip all TLS from the traffic and proxy through HTTP only
  -forceHTTPS
      Strip all clear-text from the traffic and proxy through HTTPS only
  -allowSecureCookies
      Allow secure cookies to be set. Useful when using HTTPS and cookies have SameSite=None
  -ignoreTranslateDomains string
      Comma separated list of domains to never translate and proxy
  -jsRules string
      Comma separated list of URL patterns and JS base64 encoded payloads that will be injected
      e.g.: target.tld:base64(alert(1))
  -listeningAddress string
      Listening address (default "127.0.0.1")
  -listeningPortHTTP int
      Listening port for HTTP requests (default 80)
  -listeningPortHTTPS int
      Listening port for HTTPS requests (default 443)
  -log string
      Local file to which fetched requests will be written (appended)
  -pathHostRules string
      Comma separated list of URL path patterns and target domains
      e.g.: /path/:example.com,/path2:www.example.com
  -plugins string
      Comma separated list of enabled plugin names (default "all")
  -postOnly
      Log only HTTP POST requests
  -proxyAddress string
      Proxy that should be used (socks/https/http) e.g.: http://127.0.0.1:8080
  -proxyDomain string
      Proxy domain name that will be used e.g.: proxy.tld
  -rules string
      Comma separated list of string patterns and their replacements
      e.g.: base64(old):base64(new),base64(older):base64(newer)
  -staticLocations string
      Comma separated list of FQDNs in location headers that should be preserved
  -target string
      Target domain name e.g.: target.tld
  -targetRes string
      Comma separated list of domains that were not translated automatically
      e.g.: static.target.tld
  -terminateTriggers string
      Comma separated list of URLs from target's origin which will trigger session termination
  -terminateUrl string
      URL to which a client will be redirected after session termination
  -trackingCookie string
      Name of the HTTP cookie used to track the client (default "id")
  -trackingParam string
      Name of the HTTP parameter used to track the client (default "id")

Modlishka is a man-in-the-middle proxy that can be configured using various command-line flags. Key configuration areas include:

• Targeting: Use -target to specify the target domain (e.g., target.tld).
• Proxy Domain: Use -proxyDomain to set the domain name that will be used for the proxy (e.g., proxy.tld).
• Listening: Set -listeningAddress (default 127.0.0.1), -listeningPortHTTP (default 80), and -listeningPortHTTPS (default 443).
• Credentials Management: Use -controlURL to set the URL to view captured credentials (default SayHello2Modlishka) and -controlCreds to protect the credentials page using user:pass format.
• TLS/SSL: Provide -cert, -certKey, and -certPool as base64 encoded strings.
• Rules & Injection: Use -jsRules for pattern-based JavaScript injection (format target.tld:base64(payload)) and -rules for string pattern replacements.