Modlishka
HTTP reverse proxy written in Go that tests two-factor authentication and session handling weaknesses by proxying arbitrary web domains.
Technical Architecture & Overview
Modlishka is an HTTP reverse proxy written in Go by Piotr Duszynski. It proxies arbitrary domains to test weaknesses in two-factor authentication schemes and session handling. It is licensed under the GNU General Public License v3.0 or later, which permits commercial use under the terms of the license.
Targeted Technical Use Cases
Security researchers and authorized penetration testers who need a configurable reverse proxy to test the resilience of web authentication flows, including OTP and session cookie handling, in consent-based assessments.
Evaluation & Trade-offs
Core Strengths
- +Supports most 2FA schemes by design without manual per-target template creation.
- +Point-and-click domain proxying with command-line and JSON configuration options.
- +Stateless design allows horizontal scaling through DNS load balancing.
Trade-Offs & Limitations
- -The author's write-up names U2F hardware tokens as the technical countermeasure to this reverse-proxy technique.
- -Domain translation is automatic in most cases; some domains need manual configuration.
- -Some features, such as the web panel plugin, are marked as beta.
Defensive Security Application
Test whether 2FA and session controls can resist reverse-proxy interception, then prioritize U2F hardware token adoption.
Frequently Asked Questions
What is Modlishka?→
Modlishka is an HTTP reverse proxy written in Go by Piotr Duszynski. It proxies arbitrary domains to test weaknesses in two-factor authentication schemes and session handling. It is licensed under the GNU General Public License v3.0 or later, which permits commercial use under the terms of the license.
What is Modlishka used for?→
Security researchers and authorized penetration testers who need a configurable reverse proxy to test the resilience of web authentication flows, including OTP and session cookie handling, in consent-based assessments.
What are the strengths of Modlishka?→
- +Supports most 2FA schemes by design without manual per-target template creation.
- +Point-and-click domain proxying with command-line and JSON configuration options.
- +Stateless design allows horizontal scaling through DNS load balancing.
What are the limitations of Modlishka?→
- +The author's write-up names U2F hardware tokens as the technical countermeasure to this reverse-proxy technique.
- +Domain translation is automatic in most cases; some domains need manual configuration.
- +Some features, such as the web panel plugin, are marked as beta.
How is Modlishka used defensively?→
Test whether 2FA and session controls can resist reverse-proxy interception, then prioritize U2F hardware token adoption.