Credits and acknowledgements

Open-source projects and community work incorporated into or influential to P-BitM.

P-BitM builds on open-source projects and ideas shared by the security community. This page credits projects whose code is incorporated or adapted, as well as projects that influenced P-BitM without supplying code.

The canonical legal inventory is THIRD_PARTY_NOTICES.md at the repository root. Package-manager dependencies are not repeated here unless they also materially influenced P-BitM’s design.

Research foundation

Browser-in-the-Middle (BitM) research

• Paper: Browser-in-the-Middle (BitM) attack
• Authors: Franco Tommasi, Christian Catalano and Ivan Taurino
• Relationship: foundational research
• Influence: Browser-in-the-Middle attack model on which P-BitM is based

The paper describes the Browser-in-the-Middle attack model on which P-BitM is based.

Code, components, and project lineage

Selkies

• Repository: selkies-project/selkies
• Relationship: incorporated and adapted code
• Influence: browser streaming dashboard, web core, input handling, controller, and related frontend assets
• Active path: bitm-images/selkies/
• Upstream license: MPL-2.0

The active Docker build fetches the upstream source and compiles its dashboard. P-BitM’s selkies-core.js is adapted primarily from upstream addons/selkies-web-core/selkies-ws-core.js and is installed at the web-core entry point before compilation. Selected upstream controller, nginx, and jsdb assets are also carried into the built dashboard. P-BitM preserves the upstream license on files containing Selkies code.

LinuxServer.io Selkies base image

• Repository: linuxserver/docker-baseimage-selkies
• Relationship: incorporated runtime base
• Influence: container framework, desktop and streaming runtime, system layout, and stock Selkies services
• Relevant path: the active multi-arch Selkies Dockerfile
• Upstream license: GPL-3.0-only

The active image adds P-BitM files and replaces the stock dashboard. Its frontend build stage separately uses LinuxServer’s generic Alpine base image as a build environment.

noVNC

• Repository: novnc/noVNC
• Relationship: incorporated and adapted during image build
• Influence: VNC browser-session client
• Relevant path: bitm-images/vnc/Dockerfile
• Upstream licenses: primarily MPL-2.0, with per-file licenses recorded in noVNC’s LICENSE.txt

The VNC build uses noVNC and applies explicit changes to its MPL-2.0 core library during the Docker build. The complete clone also contains HTML, CSS, fonts, images, and incorporated libraries under the BSD-2-Clause, OFL-1.1, CC BY-SA 3.0, MIT, and other BSD-style terms recorded upstream. P-BitM’s own entry page is separate from those upstream assets.

EvilnoVNC

• Repository: JoelGMSec/EvilnoVNC
• Relationship: modified and adapted code
• Author credited upstream: Joel Gámez Molina (@JoelGMSec)
• Influence: VNC session-container architecture, browser/noVNC workflow, startup orchestration, and noVNC tuning
• Relevant path: bitm-images/vnc/
• Upstream license: GNU General Public License version 3

P-BitM’s VNC implementation evolved from EvilnoVNC and was subsequently reworked around Firefox, campaign-specific routing, extensions, keylogging, a local proxy, and supervised services. EvilnoVNC itself uses noVNC, so both projects are credited separately.

Peeko

• Repository: b3rito/peeko
• Relationship: modified and adapted code
• Authors credited upstream: b3rito at mes3hacklab and GioPpeTto
• Influence: browser WebSocket agent and its command/response flow
• Relevant path: server/backend-phishing/app/static/index.js
• Upstream license: GNU General Public License version 3

P-BitM’s agent started from Peeko’s browser agent and was adapted with platform-specific behavior, including routing, authenticated sessions, message handling, modules, data collection, and WebRTC features. The resulting file remains credited to the upstream project and its authors.

Inspiration and acknowledgements

CuddlePhish

• Repository: fkasler/cuddlephish
• Relationship: design inspiration; no code copied
• Influence: early reference for using WebRTC rather than VNC to deliver an interactive browser stream in a weaponized BitM workflow
• Upstream license: MIT

CuddlePhish demonstrated a multi-user BitM design in which WebRTC carries the browser video while WebSockets handle pairing, signaling, and input. It influenced P-BitM’s exploration of browser-streaming alternatives to VNC. P-BitM does not reuse CuddlePhish code, and its current Selkies integration is configured in WebSocket mode rather than using CuddlePhish’s WebRTC implementation.

Gophish

• Repository: gophish/gophish
• Relationship: design and workflow inspiration; no code copied
• Original author credited upstream: Jordan Wright
• Influence: operator-facing style and the creation, organization, and tracking of traditional phishing campaigns
• Upstream license: MIT

Gophish influenced the way P-BitM presents familiar phishing concepts such as target lists, SMTP profiles, email templates, landing pages, campaign lifecycle, and tracking results. P-BitM implements its own code and extends that operational model with DNS configuration, plugins, modules, and per-target BitM container and live-session management.

Adding another project

Add a project when code, documentation, assets, configuration, or a material workflow was copied, adapted, or used as a meaningful design reference. Record:

1. the repository name and canonical URL;
2. whether code was incorporated, modified, adapted, or not copied;
3. the affected P-BitM paths or features;
4. the upstream version, when useful;
5. the upstream license.

Do not describe copied code as mere inspiration. Ordinary package-manager dependencies do not need a credits entry unless they also materially influenced P-BitM’s design.