Modlishka
No description available.
The Lens
By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.
Updated Jun 2026
Modlishka is a reverse-proxy tool for phishing simulations and red-team testing. It demonstrates why SMS and TOTP-based 2FA aren't as secure as people think.
Fully free. No paid tier. This is a security research tool, not a commercial product. Set it up, point it at a target domain, and it automatically mirrors the real site while capturing everything the user types, including one-time 2FA codes.
The catch: this is a double-edged sword. It's designed for authorized penetration testing only. Using it against targets without permission is illegal. The project hasn't been actively maintained, and modern phishing-resistant methods like WebAuthn/passkeys defeat it entirely. If you're a defender, this tool shows you exactly why you should be pushing your org toward hardware security keys instead of SMS codes.
Free vs Self-Hosted vs Paid
fully freeFully open source. No paid tier, no hosted version, no commercial offering.
Zero cost. You need a VPS ($5/mo), a domain, and a TLS certificate (free via Let's Encrypt). Total operational cost: ~$5-10/mo during an active engagement.
Context: Commercial phishing simulation platforms (KnowBe4, Proofpoint) charge $10-25/user/year and include training content, reporting, and compliance features. Modlishka is a raw technical tool. No reporting dashboard, no user training, no compliance templates. It tests the mechanism, not the organization.
Free. Security research tool with no commercial offering.
What to do by team size
- Solo
- Useful for independent security researchers and pentesters.
- Small team
- Good for red team exercises. Pair with reporting tools.
- Medium team
- Consider commercial phishing platforms (KnowBe4) if you need compliance reporting alongside testing.
- Large team
- Use as part of a red team toolkit, not as your phishing simulation platform. You need the reporting and training that commercial tools provide.
Get tools like this every Wednesday
One featured tool, three on the radar. No fluff.
Similar Tools
A low score is not a verdict on quality. Young and niche tools start low by design. How we calculate scores
Trust Signals
About
- Owner
- drk1wi (Organization)
- Stars
- 5,414
- Forks
- 960
Explore Further
More tools in the directory
openclaw
Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞
389.9k ★everything-claude-code
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
264.1k ★hermes-agent
The agent that grows with you
247.6k ★