search

muraenateam / muraena

Muraena is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities.
https://muraena.phishing.click/
BSD 3-Clause "New" or "Revised" License
923 stars 169 forks source link

Feature Request: Proxy https through http #15

Closed snooze6 closed 4 years ago

snooze6 commented 5 years ago

A realistic use case might be to use muraena on a VPS administrating the domain through cloudflare or another proxy yet it seems impossible to do it at the moment (or perhaps I could have missed it in the documentation).

As cloudflare can manage the HTTPs certificate for us we could just serve the phishing website using http while of course the phishing server need to be connected to the real site through https.

If I disable tls support then all the traffic is established using http which is not helpful. For instance:

2019-06-27 21:04:39 inf: [8TIAJ][<redacted_ip>:57132] - [GET][http://<redacted_ip>(http://lichess.org)/]

This attempt results in the victim being redirected to https://redacted_ip due to the redirect that the original page does.

Long story short: I believe that it is a good improvement to have the ability to choose wether the server connects to the victim website using https or http regardless of the protocol that the phishing server is using.

ohpe commented 5 years ago

Aye, sounds a good idea but a bit tricky to handle multiple scenarios .. let me think about it. Maybe you can send a PR 😛

ohpe commented 4 years ago

Fixed in #29