Controlled engagement surface on hespera.org. Sign in to the real lab web-app, watch session cookies land, and review captures in the operator panel — so you can see how AiTM reverse proxies work.
hespera.org — this VPS. TLS via Let’s Encrypt. Clear Path Recovery stays on clearpathrecovery.hespera.org.
Server-side lab auth, cookies session / sid / auth, and a post-login dashboard — the thing an AiTM proxy would clone.
Admin panel manages campaigns, session review, and Evilginx/Modlishka bootstrap notes. File-mode capture — no mock data.