Evilginx Man-in-the-Middle Framework

Evilginx is a man-in-the-middle (MiTM) attack framework designed for phishing login credentials and session cookies. By acting as a reverse proxy between a browser and a target website, it can bypass 2-factor authentication (2FA) protections.

Unlike its predecessor which relied on a custom nginx configuration, Evilginx 3.0 is a standalone application written in Go that implements its own HTTP and DNS servers, simplifying setup and deployment.

Documentation

For installation and usage instructions, refer to the official online documentation at: https://help.evilginx.com

Support Policy

Note that the maintainer does not provide support for:

• Providing existing phishlets.
• Creating custom phishlets.

Users are encouraged to look for ready-to-use phishlets provided by the community.

For users wanting to use Gophish to distribute phishing links compatible with Evilginx, an official integration is available for Evilginx version 3.3.

This requires using a specific fork of Gophish. Detailed setup instructions can be found in the official blog post: https://breakdev.org/evilginx-3-3-go-phish/

https://github.com/kgretzky/gophish/

Evilginx is a command-line application. You can start it by running the binary, optionally providing flags to configure directories and modes. If no configuration directory is provided, it defaults to ~/.evilginx (the current user's home directory plus .evilginx).

# Basic execution
./evilginx

# Execution with custom directories
./evilginx -p ./my_phishlets -t ./my_redirectors -c ./my_config

# Enable developer mode (uses self-signed certificates)
./evilginx -developer

# Enable debug logging
./evilginx -debug

# Show version
./evilginx -v

Evilginx requires directories for phishlets (YAML definitions) and redirectors (HTML pages).

• Phishlets: If -p is not provided, the application looks in the executable's ./phishlets directory, and then falls back to /usr/share/evilginx/phishlets/.
• Redirectors: If -t is not provided, the application looks in the executable's ./redirectors directory, and then falls back to /usr/share/evilginx/redirectors/.

The following command-line flags are available for configuring the Evilginx server at startup:

-p, --phishlets <path>       Phishlets directory path
-t, --redirectors <path>     HTML redirector pages directory path
-debug                       Enable debug output
-developer                   Enable developer mode (generates self-signed certificates for all hostnames)
-c, --config <path>          Configuration directory path
-v, --version                Show version