evilginx2

No entries match these filters. Clear filters

1. v3.3.0 Apr 2, 2024 · release notes

   Evilginx2 v3.3.0 adds official GoPhish integration, custom TLS loading, force_post injection, and autocert control.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.3.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout v3.3.0

   • Adds official integration with the GoPhish fork (https://github.com/kgretzky/gophish) for phishing campaign management
   • Enables loading custom TLS certificates from fullchain.pem and privkey.pem in ~/.evilginx/crt/sites/<hostname>/ or .pem/.crt and .key pairs
   • Adds ability to inject force_post POST parameters into JSON content body
   • Adds config autocert <on/off> setting to disable automated TLS certificate retrieval from LetsEncrypt

   4 details in Everything

2. v3.2.0 Aug 24, 2023 · release notes

   v3.2.0 adds dynamic redirects, lures pause, phishlet intercept and global redirect_url

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.2.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout v3.2.0

   └──▷ TRY IT
   Pause a lure briefly to prevent sandbox detection after token capture.
   copy

   $ lures pause <id>

   Intercept specific requests in a phishlet to return custom payloads.
   yaml copy

   # In phishlet config:
   intercept:
     - match:
         url: ".*?/api"
       respond:
         status: 200
         body: "Custom Response"

   Override global unauthorized redirect for a specific phishlet.
   copy

   $ phishlet unauth_url <phishlet> <url>

   • Adds intercept section in phishlets to intercept HTTP requests and return custom responses.
   • Adds optional redirect_url value in phishlet config to define default post-capture redirect (overridable by lure).
   • phishlet unauth_url <phishlet> <url> overrides the global unauthorized redirect URL for specific phishlets.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The redirect_url setting in global config is renamed to unauth_url.
3. v3.1.0 Jul 11, 2023 · release notes

   Separate listening and external IPv4 addresses via new config subcommands

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   └──▷ TRY IT
   Configure evilginx2 to listen on a specific internal interface while advertising a different public IP for redirect targets.
   copy

   $ config ipv4 bind 192.168.1.50

   Set the external IP address that phishing links will resolve to, distinct from the bind address.
   copy

   $ config ipv4 external 203.0.113.10

   • Adds config ipv4 bind subcommand to set the local listening address
   • Adds config ipv4 external subcommand to set the advertised external IP

   2 details in Everything

4. v3.0.0 May 10, 2023 · release notes

   Evilginx2 v3 adds auto-renewing TLS via certmagic, JSON config format, phishlet templates with new CLI commands, and flexible auth token capture.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   └──▷ TRY IT
   Verify the details of a specific phishing configuration (phishlet) without editing files.
   copy

   $ evilginx2 phishlet <phishlet>

   Create a new child phishlet from a template, using parameters for subdomain or domain.
   copy

   $ evilginx2 phishlet create <phishlet>

   • certmagic library now manages automated retrieval and renewal of Let's Encrypt TLS certificates
   • Changed default configuration file from config.yaml to config.json, permanently changing the configuration format to JSON
   • Authentication tokens can be captured from response body and HTTP headers (not just cookies)
   • Added always modifier for capturing authentication cookies, forcing capture even without expiration time
   • Phishing pages can now be embedded inside of iframes

   +7 more show less

   • Redirection after successful session capture changed from Location header to injected Javascript redirection
   • Added phishlet <phishlet> subcommand to show details of a specific phishlet
   • Added phishlet create subcommand to create child phishlets from template phishlets
   • Phishlet templates allow creating child phishlets with custom parameters (e.g., {param_name} replacement)
   • Renamed lure templates to lure redirectors due to name conflict with phishlet templates
   • Added {orig_hostname} and {orig_domain} support for sub_filters phishlet setting
   • Added {basedomain} and {basedomain_regexp} support for sub_filters phishlet setting

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Configuration file renamed from config.yaml to config.json; existing YAML configs must be converted or migrated to JSON format
   • !Lure templates renamed to redirectors; references to lure templates in phishlets or documentation will break
5. 2.4.0 Sep 14, 2020 · release notes

   evilginx2 2.4.0 adds per-lure hostnames, UA filtering, proxy routing, and encrypted URL params.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.4.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout 2.4.0

   └──▷ TRY IT
   Assign a unique hostname to a specific lure for evasion.
   copy

   $ lures edit <id> hostname evil-login.example.com

   Block non-browser traffic by filtering on the User-Agent string.
   copy

   $ lures edit <id> ua_filter "Mozilla/5.0.*"

   Route all evilginx2 traffic through a SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy.
   copy

   $ proxy socks5://127.0.0.1:9050

   • Adds lures edit <id> hostname <hostname> command to set customized hostnames for every phishing lure
   • Adds lures edit <id> ua_filter <regexp> subcommand to reject requests when the visitor's User-Agent does not match a whitelist regular expression filter for a given lure
   • Adds proxy command to route connections via SOCKS5 and HTTP(S) proxies
   • Adds blacklist command for IP blacklist with automated blacklisting and blocking on unauthorized requests
   • Updates lures get-url <id> to support encrypted custom parameters in the phishing URL via inline syntax like param1=value1 param2="value2"

   +3 more show less

   • Adds import argument to lures get-url <id> import <params_file> to import custom parameters from text, csv, or json files
   • Adds export argument to lures get-url <id> export <export_file> <text|csv|json> to export generated phishing URLs to text, csv, or json formats
   • Adds with_params option to the sub_filter configuration key to enable sub_filter only when a specific parameter is set in the phishing URL

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Custom parameters are no longer sent as separate options in lures; they are now encoded exclusively within the phishing URL, breaking any workflow that relied on sending them via lures command options.
6. 2.3.0 Jan 22, 2019 · release notes

   Evilginx2 2.3 adds auto sub_filters, lures with OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps./js injection, and replaces landing_path with login section

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.3.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout 2.3.0

   • Proxy can now create most of required sub_filters on its own, making it much easier to create new phishlets.
   • Added lures, with which you can prepare custom phishing URLs with each having its own set of unique options (help lures for more info).
   • Added OpenGraph settings for lures, allowing to create enticing content for link previews.
   • Added ability to inject custom Javascript into proxied pages.
   • Injected Javascript can be customized with values of custom parameters, specified in lure options.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The landing_path phishlet field is deprecated and replaced with the login section containing domain and path.
7. 2.2.0 Nov 22, 2018 · release notes

   Adds custom POST argument capture to credentials, regex group support in sub_filters, and new table UI for phishlet listing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.2.0 https://github.com/kgretzky/evilginx2.git
   # already have the repo? check out this version:
   $ git checkout 2.2.0

   • Capture custom POST arguments in the credentials.custom field for each authentication attempt
   • Inject custom POST arguments into proxied requests using phishlet configuration
   • Use regular expression capture groups within sub_filters definitions in phishlet YAML

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The name field is removed from phishlet YAML configuration; the phishlet name is now derived exclusively from the filename
   • !Phishlet YAML config file structure has been restructured, requiring an update to existing phishlet files