Modlishka

Judgement

What it is

Developer tool

What it does

A man-in-the-middle reverse proxy for penetration testing that relays a real website to show how phishing can capture credentials and session tokens even with two-factor authentication.

Adopt it when

You run authorised red-team or phishing-awareness engagements and need to demonstrate that one-time-code 2FA can be phished.

Watch out

Using it against people or sites without written authorisation is illegal, and development has slowed; Evilginx is more actively used.

Ready for

Usable

Runs as

Command line and self-hosted server

Built with

Go

How established

Established: started 7 years ago, latest release v.1.1.1.

What the license allows

Use inside your business is unrestricted, but anything you distribute that includes it must be released under the same license.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Modlishka → Go → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Modlishka

1. 1
   Caddy caddyserver

   Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

   Building block Production-ready You want to serve sites or proxy apps over HTTPS with almost no configuration and no separate certificate tooling.

   ★ 79k Apache-2.0 Go Active, pushed today
   
2. 2
   Traefik traefik

   The Cloud Native Application Proxy

   Building block Production-ready Your services run in Docker or Kubernetes and you want routes created automatically as containers start and stop.

   ★ 65k MIT Go Active, pushed today
   
3. 3
   Kong Gateway Kong

   🦍 The API and AI Gateway

   Building block Production-ready You expose many APIs and want a gateway with a large plugin ecosystem, run yourself or through Kong's cloud.

   ★ 44k Apache-2.0 Lua Active, pushed 17 days ago
4. 4
   Nginx nginx

   The official NGINX Open Source repository.

   Building block Production-ready You need a fast, proven web server or reverse proxy in front of your applications.

   ★ 32k BSD-2-Clause C Active, pushed today
   
5. 5
   Nginx-proxy nginx-proxy

   Automated Nginx Reverse Proxy for Docker

   Building block Production-ready You host several web containers on one Docker host and want them proxied by hostname without editing nginx config.

   ★ 20k MIT Python Active, pushed 3 days ago
6. 6
   Apache APISIX apache

   The Cloud-Native API Gateway and AI Gateway

   Building block Production-ready You want a fully open-source API gateway whose routes and plugins change at runtime without reloads.

   ★ 17k Apache-2.0 Lua Active, pushed today
7. 7
   cloudflared cloudflare

   Cloudflare Tunnel client

   Integration Production-ready You want to publish an internal or home-hosted service through Cloudflare without a public IP or firewall changes.

   ★ 16k Apache-2.0 Go Active, pushed yesterday
8. 8
   Tengine alibaba

   A high-performance web server and reverse proxy, 100% compatible with nginx.

   Building block Production-ready You need nginx with built-in active health checks or Chinese national cryptography and are comfortable tracking a fork.

   ★ 13k BSD-2-Clause C Active, pushed 2 months ago