How the lab web-app maps to AiTM

An Adversary-in-the-Middle tool (Modlishka, Muraena, or Evilginx) sits between the browser and this origin. The user sees a login that looks like yours; the proxy forwards traffic and harvests credentials + session cookies.

Bridge mode

…

Capture dir

…

Domain

…

Lab accounts (disposable)

Default password for seed accounts: LabPass!2026

Tools in this stack

Try it

  1. Open /signin and log in as a lab user.
  2. You land on /app/ with real cookies set.
  3. A JSON capture is written under the session dir (file mode).
  4. Open /admin/ as operator and review Sessions.

ASCII path

Browser ──TLS──► hespera.org (this web-app)
                    │  POST /lab/api/login
                    │  Set-Cookie: session, sid, auth
                    ▼
              capture JSON ──► ops panel /admin sessions
                    ▲
        optional AiTM proxy would sit on the first hop