Phished user interacts with the real website, while Evilginx captures all the data being transmitted between the two parties.Įvilginx, being the man-in-the-middle, captures not only usernames and passwords, but also captures authentication tokens sent as cookies.
Instead of serving templates of sign-in pages lookalikes, Evilginx becomes a relay between the real website and the phished user. Update: Check also version 2.1 release post TL DR What am I looking at?Įvilginx is an attack framework for setting up phishing pages. In this blog post I only want to explain some general concepts of how it works and its major features. Updated instructions on usage and installation can always be found up-to-date on the tool's official GitHub project page. Usability was not necessarily the strongest point of the initial release.
My main goal with this tool's release was to focus on minimizing the installation difficulty and maximizing the ease of use. It is amazing how GO seems to be ideal for offensive tools development and bettercap is its best proof! A year ago, I wouldn't have even expected that one day Kevin Mitnick would showcase Evilginx in his live demos around the world and Techcrunch would write about it!Īt WarCon I met the legendary (he is a really nice guy), who inspired me with his ideas to learn GO and rewrite Evilginx as a standalone application. I've received tons of feedback, got invited to WarCon by (thanks man!) and met amazing people from the industry. It's been over a year since the first release of Evilginx and looking back, it has been an amazing year.
0 kommentar(er)
