Simulation, Training and Red Team Phishing Framework
AiTM phishing case study — MFA bypass demonstration (academic red team exercise, ESME Sudria 2025–2026)
Phishing triage analysis of a real Sneaky2FA AiTM campaign targeting Microsoft 365. Documents the full attack chain, IOC extraction, evasion techniques, and sandbox vs reputation tool detection gap.
BytePhisher 0.1.0 - pure-Python AiTM / phishing red-team framework for authorized engagements: reverse-proxy engine, phishlet forge, 808 brand templates in their real layouts, site cloner, keystroke + OTP capture, session vault, OAuth/device-code relay, Golden SAML / AD CS, click-to-access, DNS exfil, Telegram C2. MIT, Python 3.10+, 2221 tests.
A controlled lab that reproduces MFA-bypass session hijacking (adversary-in-the-middle and stolen-cookie replay) and the detection layer that catches it. Six context-comparison rules, four Sigma rules, reproducible sample logs. The defence is published, the attack tooling is withheld.
Built a complete Chrome Manifest V3 browser extension that detects Adversary-in-the-Middle (AiTM) reverse proxy phishing attacks in real time. The extension runs 5 detection modules against every page load and produces a 0–100 threat score.
Research prototype for detecting AiTM phishing reverse proxies using multi-level heuristic risk scoring
Docker-based AiTM lab for QR login workflows — reverse proxy, browser storage capture, and session replay. Educational use only.
Detection pipeline for AiTM/credential abuse in Azure Identity Protection — identifies axios user agent as a high-confidence IoC, enriches with AbuseIPDB, and automates alerting and response.
To associate your repository with the aitm topic, visit your repo's landing page and select "manage topics."