Catch&Release Phramework (C.A.R.P.)

Made by www.rootandbeer.com

C.A.R.P. delivers a remote, browser-in-the-browser experience for multi-campaign phishing and credential capture. A victim visits a campaign URL (e.g. http://your-server:80); they see a full-screen browser (noVNC + Firefox) that loads a target site you configure (e.g. a login page). Each visitor gets their own isolated Docker container, so sessions don’t mix. Keystrokes are logged per session, and you manage everything (campaigns, sessions, keylogs, idle timeouts) from a single Admin UI.

What makes this different is that it’s not template-based phishing. The victim is interacting with the real website in a fully isolated browser session, proxied through the framework. Each user and target site gets its own containerized environment, which makes the attack both cleaner and more scalable. There is no fake site for the user to detect, the target site is the REAL website. This allows for full session hijacking and MFA bypassing.

How it works at a glance: You define campaigns in the Admin UI — each campaign has a port (80–99), a target URL, and optional branding. When someone hits that port, the gateway assigns them a session cookie and starts a dedicated noVNC/Firefox container. Traefik routes traffic by cookie, so you don’t need a port or subdomain per container. Multiple campaigns can run at once (e.g. bank1 on :80, bank2 on :81). Because the victim is typing into a browser you control, C.A.R.P. can capture credentials and support session hijacking that bypasses normal login and MFA on the real site.

Deploy C.A.R.P. on a local network combined with ARP Spoofing + DNS Spoofing to passively harvest web credentials using the real domain.

Overview

• Gateway – Runs Traefik for routing and a Python/Flask app that spins up per-session Firefox containers and serves the Admin UI.
• Sessions – A visitor hits a campaign port (80–99); the gateway assigns a session cookie and starts a dedicated container. Traefik routes that port to the right container based on the cookie.
• Campaigns – Each campaign has an ID, name, port, target URL, and optional favicon. Campaigns are managed in the Admin UI; changes apply immediately without restart.
• Keylogs – Keystrokes are written per session under ./keylogs/<session_id>.txt and can be viewed or bulk-exported from the Admin UI.
• Admin UI – Sessions, campaigns, settings, and health are managed at http://<host>:9080/admin.

---

How to run

Prerequisites

• Docker CE (or any Docker-compatible environment)

After downloading Docker CE Run:

sudo systemctl enable docker
sudo usermod -aG docker $USER

Then you will need to reboot

Steps

1. Create directory

mkdir -p carp/icons carp/config carp/keylogs && cd carp

2. Download docker-compose.yml or copy into docker-compose.yml:

name: carp
services:
  firefox-image:
    image: rootandbeer/carp-firefox:latest
    restart: "no"
    entrypoint: ["/bin/sh", "-c", "exit 0"]

  gateway:
    depends_on:
      firefox-image:
        condition: service_completed_successfully
    image: rootandbeer/carp-gateway:latest
    container_name: carp-gateway
    ports:
      # Campaign ports: one per campaign, user-selected in Admin UI (range 80-99 pre-defined in traefik.yml)
      - "80-99:80-99"
      # Admin UI (direct to uvicorn, not through Traefik)
      - "9080:9080"
    environment:
      - ADMIN_PORT=9080
      - BOOTSTRAP_PORT=8080
      - carp_USER_IMAGE=rootandbeer/carp-firefox:latest
      - CONFIG_DIR=/config
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./keylogs:/keylogs
      - ./icons:/icons:ro
      - ./config:/config
    networks:
      - carp_net
    restart: unless-stopped

networks:
  carp_net:
    name: carp_ephemeral_net

3. Start the stack

   docker compose up -d

Ports 80–99 are exposed for campaigns; 9080 is the Admin UI.
Admin UI: http://<host>:9080/admin.

---

Configuration

Admin UI

Access at http://<host>:9080/admin.

Tab	Description
Sessions	Live sessions with last-seen, per-session View/Keylog/Kill, and bulk actions (Export All Keylogs ZIP, Kill Selected, Kill All, Kill Idle).
Campaigns	Add/edit/delete campaigns; copy entry links. Each campaign needs: ID (slug), Name, Port (80–99), Target URL, Page Title, optional Favicon from ./icons.
Settings	Port range (min/max), idle timeout, max sessions, optional admin password (HTTP Basic auth on /admin when set).
Health	Docker status, container count, keylog disk usage.

Campaign changes regenerate Traefik routing immediately; no restart needed.

Keylogs and audit

• Keylogs: ./keylogs/<session_id>.txt. Download per session from the Sessions tab or Export All Keylogs (ZIP).
• Containers send a heartbeat every 30s (POST /heartbeat?session=<id>). Kill Idle uses the idle timeout from Settings (default 60 minutes).

Port range and Traefik

Ports 80–99 are defined as Traefik entrypoints in gateway/traefik.yml and exposed in docker-compose.yml. The port range in Settings only validates campaign ports. To use ports outside 80–99, update gateway/traefik.yml and docker-compose.yml and rebuild.