Standalone man-in-the-middle attack framework used for phishing login credentials.

[AplexTM 3]

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.

 

 

evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server to provide man-in-the-middle functionality to act as a proxy between a browser and phished website. Present version is fully written in GO as a standalone application, which implements its own HTTP and DNS server, making it extremely easy to set up and use.

 

 

Installation

 

$GOPATH

 environment variable is set up properly (def. 

$HOME/go

).

After installation, add this to your 

~/.profile

, assuming that you installed GO in 

/usr/local/go

:

export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin

 

Then load it with 

source ~/.profiles

.

Now you should be ready to install evilginx2. Follow these instructions:

sudo apt-get install git make
go get -u github.com/kgretzky/evilginx2
cd $GOPATH/src/github.com/kgretzky/evilginx2
make

 

You can now either run evilginx2 from local directory like:

sudo ./bin/evilginx -p ./phishlets/

 

or install it globally:

sudo make install
sudo evilginx

 

Instructions above can also be used to update evilginx2 to the latest version.

[/url]Installing with Docker

You can launch evilginx2 from within Docker. First build the container:

docker build . -t evilginx2

 

Then you can run the container:

docker run -it -p 53:53/udp -p 80:80 -p 443:443 evilginx2

 

Phishlets are loaded within the container at 

/app/phishlets

, which can be mounted as a volume for configuration.

Installing from precompiled binary packages

Grab the package you want fromh ere  and drop it on your box. Then do:

unzip .zip -d 
cd 

 

If you want to do a system-wide install, use the install script with root privileges:

chmod 700 ./install.sh
sudo ./install.sh
sudo evilginx

 

or just launch evilginx2 from the current directory (you will also need root privileges):

chmod 700 ./evilginx
sudo ./evilginx

USAGE

IMPORTANT! Make sure that there is no service listening on ports

TCP 443
[color=#000000][size=undefined]
, [/size][/color]
TCP 80[color=#000000][size=undefined]
 and [/size][/color]
UDP 53[color=#000000][size=undefined]
. You may need to shutdown apache or nginx and any service used for resolving DNS that may be running. evilginx2 will tell you on launch if it fails to open a listening socket on any of these ports.[/size][/color]
[color=#24292e][size=medium][font=-apple-system, BlinkMacSystemFont, ]By default, evilginx2 will look for phishlets in [/font][/size][/color]
./phishlets/[color=#000000][size=undefined]
 directory and later in [/size][/color]
/usr/share/evilginx/phishlets/[color=#000000][size=undefined]
. If you want to specify a custom path to load phishlets from, use the [/size][/color]
-p [color=#000000][size=undefined]
 parameter when launching the tool.[/size][/color]
Usage of ./evilginx:
 -debug
       Enable debug output
 -developer
       Enable developer mode (generates self-signed certificates for all hostnames)
 -p string
       Phishlets directory path

[color=#24292e][size=medium][font=-apple-system, BlinkMacSystemFont, ]You should see evilginx2 logo with a prompt to enter commands. Type [/font][/size][/color]
help[color=#000000][size=undefined]
 or [/size][/color]
help 
 if you want to see available commands or more detailed information on them.

 

 

Source:https://github.com/kgretzky/evilginx2