Mole is a framework for identifying and exploiting out-of-band (OOB) vulnerabilities.
Installation & Setup
Mole Install
- Python >= 3.6
virtualenv -p /usr/bin/python3 venv
source venv/bin/activate
./venv/bin/pip3 install -r requirements.txt
git submodule update --init --recursive
- Set an API key in
config.yml
(must be the same for the client and server)
DNS Configuration
You’ll need to configure the DNS records in your registrar to point to your mole server. Minimally, you’ll need an A
record for the name server and an NS
record configured.
Mole can be configured to host other configuration options.
- Mailgun (Optional)
Mailgun requires DNS entries to enable the service: https://help.mailgun.com/hc/en-us/articles/203637190-How-Do-I-Add-or-Delete-a-Domain-
- TLS
Currently Mole does not support TLS natively. To implement TLS, use a reverse proxy such as nginx to terminate the TLS connection and forward traffic to the Mole server.
Burp Suite Extension
The Burp Suite Extension requires a separate Python 2.7 virtual environment due to the latest version of Jython only supporting 2.7. Below are the instructions for setting up the virtual environment and configuring the Extension.
- Create a new python2.7 virtualenv for burp/jython
virtualenv -p /usr/bin/python2.7 burp_venv
- Load the venv,
source
./burp_venv/bin/activate
- Install the required packages
./burp_venv/bin/pip -r requirements
- Configure the Python Environment by downloading and selecting the jython-standalone jar.
- Set the “Folder for loading modules” to the full path to
burp_venv/lib/python2.7/site-packages
that was created in steps 1-3.
![](https://1.bp.blogspot.com/-w4X_N4e0XLg/YFgzLYcemMI/AAAAAAAAIoA/RMQOuwS9DTkC5LE-YvLJMc1Stm4EJU8GQCLcBGAsYHQ/s848/Mole-1.png)
- Click Add
![](https://1.bp.blogspot.com/-6zYsp7R6oqw/YFgzLTl37UI/AAAAAAAAIn8/DxOp7NlhpyIG_M2IqLQbZ2L_21rrKeQOgCLcBGAsYHQ/s340/Mole-2.png)
- Set the Extension type to
Python
and select themole_burp_extension.py
file from the mole project directory.
![](https://1.bp.blogspot.com/-pTYTisnKbZU/YFgzL9Y-4TI/AAAAAAAAIoE/1lbsyL_dnjgs3i1SVHDbUklxQjbSzPNygCLcBGAsYHQ/s880/Mole-3.png)
- Click Next and if all goes well, there will be no errors on the load screen.
![](https://1.bp.blogspot.com/-yRGukjnGriw/YFgzMTQONgI/AAAAAAAAIoI/PgvXcWMGB_U0_AP-GRv94G3QvG2yT2tdwCLcBGAsYHQ/s835/Mole-4.png)
Configuration
Token
domain
– Your custom domainlength
– Length of the tokens (default 5)- The token character set is ascii upper & lower, and digits. The length can be modified to meet needs such as constrained space for a payload. The number of tokens per length is listed below.
- 1 – 62
- 2 – 3844
- 3 – 238328
- 4 – 14776336
- 5 – 916132832
ssl
– Configure payloads forhttps
vshttp
- “server` – domain or IP of the Mole token server
default_tags
– list of default tags to add to all tokens. Useful for per-project/client tokens.
Server
api_key
– API key used to authenticate requests to the mole APIdns_addr
– IP address used to respond to DNS queriesdb_conn
– SQLAlchemy database URL. Default is a SQLite db in the root directorysqlite:///mole.db
static_responses
– list of DNS static response key/value pairsweb_port
– configure the listening web portdns_port
-configure the listening dns port
Notifications
All notifications have an enabled
flag that determines whether or not to trigger the notification on an interaction. Each notification plugin has its own configuration items.
mailgun
– configuredomain
,to
,from
, andapi_key
to enable mailgun email notificationsslack
–token
andchannel
webhook
– generic POST webhook
Issues/Bugs
I’m sure there are many, please create a new issue and fill out the template as best as you can for quick triage.