Mole is a framework for identifying and exploiting out-of-band (OOB) vulnerabilities.
Installation & Setup
Mole Install
virtualenv -p /usr/bin/python3 venv
source venv/bin/activate
./venv/bin/pip3 install -r requirements.txt
git submodule update --init --recursive
config.yml
(must be the same for the client and server)DNS Configuration
You’ll need to configure the DNS records in your registrar to point to your mole server. Minimally, you’ll need an A
record for the name server and an NS
record configured.
Mole can be configured to host other configuration options.
Mailgun requires DNS entries to enable the service: https://help.mailgun.com/hc/en-us/articles/203637190-How-Do-I-Add-or-Delete-a-Domain-
Currently Mole does not support TLS natively. To implement TLS, use a reverse proxy such as nginx to terminate the TLS connection and forward traffic to the Mole server.
Burp Suite Extension
The Burp Suite Extension requires a separate Python 2.7 virtual environment due to the latest version of Jython only supporting 2.7. Below are the instructions for setting up the virtual environment and configuring the Extension.
virtualenv -p /usr/bin/python2.7 burp_venv
source
./burp_venv/bin/activate
./burp_venv/bin/pip -r requirements
burp_venv/lib/python2.7/site-packages
that was created in steps 1-3.Python
and select the mole_burp_extension.py
file from the mole project directory.Configuration
Token
domain
– Your custom domainlength
– Length of the tokens (default 5)ssl
– Configure payloads for https
vs http
default_tags
– list of default tags to add to all tokens. Useful for per-project/client tokens.Server
api_key
– API key used to authenticate requests to the mole APIdns_addr
– IP address used to respond to DNS queriesdb_conn
– SQLAlchemy database URL. Default is a SQLite db in the root directory sqlite:///mole.db
static_responses
– list of DNS static response key/value pairsweb_port
– configure the listening web portdns_port
-configure the listening dns portNotifications
All notifications have an enabled
flag that determines whether or not to trigger the notification on an interaction. Each notification plugin has its own configuration items.
mailgun
– configure domain
, to
, from
, and api_key
to enable mailgun email notificationsslack
– token
and channel
webhook
– generic POST webhookIssues/Bugs
I’m sure there are many, please create a new issue and fill out the template as best as you can for quick triage.
Pingora is a cutting-edge Rust framework designed to build fast, reliable, and programmable networked systems.…
DockerSpy is a powerful tool designed to perform Open Source Intelligence (OSINT) on Docker Hub,…
Anki is a powerful, open-source flashcard software designed to enhance learning and memory retention through…
Rolldown is an innovative JavaScript/TypeScript bundler written in Rust, designed to revolutionize the development workflow…
Invoke-ArgFuscator is an open-source, cross-platform PowerShell module designed to obfuscate command-line arguments for system-native executables.…
Morgan is an advanced JavaScript security analyzer designed to detect and mitigate sensitive data exposure…