Modlishka
HTTP reverse proxy written in Go that tests two-factor authentication and session handling weaknesses by proxying arbitrary web domains.
Technical Architecture & Overview
Modlishka is an HTTP reverse proxy written in Go by Piotr Duszynski. It proxies arbitrary domains to test weaknesses in two-factor authentication schemes and session handling. It is licensed under the Modlishka Public Source License, which permits free non-commercial use and requires a separate commercial license for commercial applications.
Targeted Technical Use Cases
Security researchers and authorized penetration testers who need a configurable reverse proxy to test the resilience of web authentication flows, including OTP and session cookie handling, in consent-based assessments.
Evaluation & Trade-offs
Core Strengths
- +Supports most 2FA schemes by design without manual per-target template creation.
- +Point-and-click domain proxying with command-line and JSON configuration options.
- +Stateless design allows horizontal scaling through DNS load balancing.
Trade-Offs & Limitations
- -Reverse proxy interception is defeated by FIDO2 and WebAuthn phishing-resistant authentication.
- -Target site changes can break proxy behavior and require configuration updates.
- -Some features, such as the web panel, are marked as proof-of-concept or beta.
Defensive Security Application
Test whether 2FA, session binding, and phishing-resistant authentication controls can resist reverse-proxy interception, then prioritize FIDO2 or WebAuthn adoption.
Frequently Asked Questions
What is Modlishka?→
Modlishka is an HTTP reverse proxy written in Go by Piotr Duszynski. It proxies arbitrary domains to test weaknesses in two-factor authentication schemes and session handling. It is licensed under the Modlishka Public Source License, which permits free non-commercial use and requires a separate commercial license for commercial applications.
What is Modlishka used for?→
Security researchers and authorized penetration testers who need a configurable reverse proxy to test the resilience of web authentication flows, including OTP and session cookie handling, in consent-based assessments.
What are the strengths of Modlishka?→
- +Supports most 2FA schemes by design without manual per-target template creation.
- +Point-and-click domain proxying with command-line and JSON configuration options.
- +Stateless design allows horizontal scaling through DNS load balancing.
What are the limitations of Modlishka?→
- +Reverse proxy interception is defeated by FIDO2 and WebAuthn phishing-resistant authentication.
- +Target site changes can break proxy behavior and require configuration updates.
- +Some features, such as the web panel, are marked as proof-of-concept or beta.
How is Modlishka used defensively?→
Test whether 2FA, session binding, and phishing-resistant authentication controls can resist reverse-proxy interception, then prioritize FIDO2 or WebAuthn adoption.