evilgophish

Evilginx is a man-in-the-middle (MITM) attack framework designed for phishing login credentials and session cookies. By acting as a proxy between a victim's browser and the legitimate website, it can bypass 2-factor authentication (2FA) protections.

Unlike its predecessor which relied on a custom nginx server, Evilginx 3.0 is a standalone application written in Go that implements its own HTTP and DNS servers, simplifying setup and deployment.

evilgophish is a combination of evilginx3 and GoPhish. It integrates the proxy man-in-the-middle capabilities of evilginx3 (capable of bypassing 2FA/MFA) with the social engineering toolkit and tracking statistics of GoPhish.

In this architecture:

• GoPhish handles email/SMS sending and provides a dashboard for campaign statistics.
• evilginx3 handles the actual landing pages and proxying.
• Phishing links sent from GoPhish point to an evilginx3 lure path.
• Real-time campaign event notifications and JSON strings containing tokens/cookies from evilginx3 are displayed directly in the GoPhish GUI.

The integrated GoPhish component has been modified to support the evilgophish workflow. Key changes include:

• IOC Mitigation: Email headers are stripped and GoPhish is not used in actual phishing pages to prevent Indicators of Compromise (IOCs).
• Customizable RID: The default rid string in phishing URLs is chosen by the operator during the setup.sh process.
• SMS Support: Added support for SMS campaigns.
• Enhanced Events: Added a Captured Session campaign event specifically for captured evilginx3 sessions/tokens.

The project supports two versions of phishlets due to changes in evilginx (version 3.0.0+).

• Version 3.0.0+ Phishlets: Compatible with the new phishlet file format. These are stored in evilginx3/phishlets.
• Legacy Phishlets: Phishlets using the older format. These are stored in evilginx3/legacy_phishlets and may require rewriting to work with newer versions of the tool.

Users are expected to create their own phishlets; the repository maintainer does not guarantee the creation of new ones.

To avoid static HTML detection, you should customize the Turnstile templates. When editing evilginx3/templates/turnstile.html, you must follow these rules to ensure functionality:

1. Include the following Go template variables: {{.FormActionURL}}, {{.ErrorMessage}}, and {{.TurnstilePublicKey}}.
2. The form action URL for the challenge submission must use {{.FormActionURL}}.
3. The data-sitekey attribute in the cf-turnstile div must use {{.TurnstilePublicKey}}.
4. Save the file at evilginx3/templates/turnstile.html.
5. The submit button must have the name attribute button.

Gophish can be deployed using the official Docker container available on Docker Hub.

https://hub.docker.com/r/gophish/gophish/

Cloudflare Turnstile is used to defend against bots and automated scanners. To set it up:

1. Create a Cloudflare account and add a new site under the Turnstile tab using your phishing domain.
2. Customize the evilginx3/templates/forbidden.html and evilginx3/templates/turnstile.html files.
3. Start evilginx3 using the -turnstile flag with your public and private keys separated by a colon.

Example:

./evilginx3 -feed -g ../gophish/gophish.db -turnstile <PUBLIC_KEY>:<PRIVATE_KEY>

After running setup.sh, follow these steps to launch an email campaign:

1. GoPhish Setup: Start GoPhish and configure your email template, email sending profile, and groups.
2. evilginx3 Setup: Start evilginx3. Configure your phishlet and lure. Crucially, you must specify the full path to the GoPhish sqlite3 database using the -g flag.
3. Launch: Launch the campaign from GoPhish, using the evilginx3 lure path as your landing URL.

You can include QR codes in your email HTML templates to facilitate QR code social engineering.

1. Template: Add the {{.QR}} template variable to your email HTML template.
2. Campaign Configuration: When starting a new campaign in GoPhish, enter the desired size for the QR code images.

Note: This feature is currently only supported for email campaigns using HTML templates.

After running the Gophish binary, access the web interface by navigating to https://localhost:3333 in your browser.

Credentials:

• For versions >= v0.10.1: Check the terminal log output for a unique, randomly generated username and password.
• For versions < v0.10.1: Use the default credentials admin / gophish.

time="2020-07-29T01:24:08Z" level=info msg="Please login with the username admin and the password 4304d5255378177d"