travisbale/miraged repository overview

⁠miraged

The daemon component of https://github.com/travisbale/mirage⁠, an Adversary-in-the-Middle (AiTM) phishing framework for authorized red team engagements. Miraged acts as a reverse proxy between the victim and a legitimate target, capturing credentials and live session cookies post-MFA.

⁠Quick Start

docker run -d \
    --name miraged \
    --cap-add NET_BIND_SERVICE \
    --network host \
    -v /etc/mirage:/etc/mirage:ro \
    -v /var/lib/mirage:/var/lib/mirage \
    travisbale/miraged:latest

⁠Configuration

Create /etc/mirage/miraged.yaml before starting the container:

domain: phish.example.com
external_ipv4: 1.2.3.4

api:
  secret_hostname: api.phish.example.com

acme:
  email: [email protected]
  directory_url: https://acme-v02.api.letsencrypt.org/directory

dns_providers:
  - alias: cf
    provider: cloudflare
    settings:
      api_token: YOUR_TOKEN

For local testing without ACME certificates, add self_signed: true.

See the full https://github.com/travisbale/mirage#configuration⁠ for all available options.

⁠Volumes

/etc/mirage      Config file (miraged.yaml), mount read-only
/var/lib/mirage  SQLite database, generated TLS certs, encryption key

Session credentials and auth tokens are encrypted at rest using AES-256-GCM. The encryption key is generated automatically on first run and stored in the data volume.

⁠Ports

443/tcp  HTTPS reverse proxy and management API
53/udp   DNS server

--network host is required so the DNS server is reachable from the host. NET_BIND_SERVICE is needed to bind privileged ports as a non-root user.

⁠Runtime

The image is based on gcr.io/distroless/static:nonroot — no shell, no package manager, minimal attack surface. The process runs as UID 65534 (nonroot).

On first start, miraged generates a TLS CA and an mTLS operator CA, then prints an enrollment command in the logs:

docker logs miraged | grep "enroll with"

Use the https://github.com/travisbale/mirage⁠ to enroll as an operator and manage phishlets, lures, and sessions.

⁠Features

• Reverse proxy — transparently proxies HTTPS traffic, rewriting domains and cookies
• Session capture — extracts credentials and auth tokens from cookies, headers, and response bodies
• Encryption at rest — AES-256-GCM encryption of all captured credentials and tokens
• BotGuard — JA4 fingerprint-based bot detection with configurable scoring
• JS obfuscation — optional per-request JavaScript transformation via Node.js sidecar
• Automated DNS — Cloudflare, Route53, and Gandi integration for phishing domain records
• mTLS API — management API authenticated with mutual TLS client certificates
• Notifications — push session events to webhooks or Slack

⁠Links

• https://github.com/travisbale/mirage⁠
• https://github.com/travisbale/mirage/blob/master/docs/quickstart.md⁠
• https://github.com/travisbale/mirage/blob/master/LICENSE⁠