Skip to content

added ability to receive credentials and sessions from Evilginx - #4

Open
callightmn wants to merge 5 commits into
kgretzky:masterfrom
vaadata:feature/evilginx
Open

added ability to receive credentials and sessions from Evilginx#4
callightmn wants to merge 5 commits into
kgretzky:masterfrom
vaadata:feature/evilginx

Conversation

@callightmn

Copy link
Copy Markdown

Hi,

This PR adds the following features:

  • Receive credentials (username, password or any custom), as well as session tokens (cookie, HTTP or body tokens) from Evilginx. This is linked to Added config flag to send captured credentials to Gophish evilginx2#1135, which adds a config flag (config gophish sessions true) to tell Evilginx to send details to Gophish. By default, Evilginx indeed only sends an event if the user's session has been captured (either the authorization URL was reached or all tokens were captured). This event is treated as "Submitted Data" and does not contain any details regarding the actual credentials and session tokens;
  • Manage credentials and session tokens independantly in the dashboard (as "Submitted Data" and "Captured Sessions" respectively);
  • Send credentials to Gophish as they come, even if the session is not finished (authorization URL not reached or all tokens not intercepted). This is particularly useful to catch users who entered invalid or fake credentials, which is always interesting even if no session has been captured (the password may be valid on another app for instance).

Default behavior (or config gophish sessions false in Evilginx):

image

image

As we can see, there are two "Submitted Data" events: one for the email/password and one for the OTP.

Behavior with config gophish sessions true:

image

Note that even if the user does not complete the 2FA step, the password is still captured:

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants