Evilgophish – Evilginx2 + Gophish

Combination of

Once you have run setup.sh, the next steps are:

1. Configure SMS message template. You will use Text only when creating a SMS message template, and you should not include a tracking link as it will appear in the SMS message. Leave Envelope Sender and Subject blank like below:

2. Configure SMS Sending Profile. Enter your
   3. Import groups. The CSV template values have been kept the same for compatibility, so keep the CSV column names the same and place your target phone numbers into the Email column. Note that Twilio accepts the following phone number formats, so they must be in one of these three:
   4. Start evilginx2 and configure phishlet and lure (must specify full path to GoPhish sqlite3 database with -g flag)
   5. Ensure Apache2 server is started
   6. Launch campaign from GoPhish and make the landing URL your lure path for evilginx2 phishlet
   7. PROFIT

   Live Feed Setup

   Realtime campaign event notifications are handled by a local websocket/http server and live feed app. To get setup:

   1. Select true for feed bool when running setup.sh

   2. cd into the evilfeed directory and start the app with ./evilfeed

   3. When starting evilginx2, supply the -feed flag to enable the feed. For example:

   ./evilginx2 -feed -g /opt/evilgophish/gophish/gophish.db

   4. You can begin viewing the live feed at: http://localhost:1337/. The feed dashboard will look like below:

   IMPORTANT NOTES

   • The live feed page hooks a websocket for events with JavaScript and you DO NOT need to refresh the page. If you refresh the page, you will LOSE all events up to that point.

   Phishlets Surprise

   Included in the evilginx2/phishlets folder are three custom phishlets not included in evilginx2.

   1. o3652 – modified/updated version of the original o365 (stolen from Optiv blog)
   2. google – updated from previous examples online (has issues, don’t use in live campaigns)
   3. knowbe4 – custom (don’t have access to an account for testing auth URL, works for single-factor campaigns, have not fully tested MFA)

   A Word About Phishlets

   I feel like the world has been lacking some good phishlet examples lately. It would be great if this repository could be a central repository for the latest phishlets. Send me your phishlets at [email protected] for a chance to end up in evilginx2/phishlets. If you provide quality work, I will create a Phishlets Hall of Fame and you will be added to it.

   Changes To evilginx2

   1. All IP whitelisting functionality removed, new proxy session is established for every new visitor that triggers a lure path regardless of remote IP
   2. Fixed issue with phishlets not extracting credentials from JSON requests
   3. Further “bad” headers have been removed from responses
   4. Added logic to check if mime type was failed to be retrieved from responses
   5. All X headers relating to evilginx2 have been removed throughout the code (to remove IOCs)

   Changes to GoPhish

   1. All X headers relating to GoPhish have been removed throughout the code (to remove IOCs)
   2. Custom 404 page functionality, place a .html file named 404.html in templates folder (example has been provided)
   3. Default rid string in phishing URLs is chosen by the operator in setup.sh
   4. Transparency endpoint and messages completely removed
   5. Added SMS Campaign Support

   Changelog

   See the CHANGELOG.md file for changes made since the initial release.

   Issues and Support

   I am taking the same stance as Kuba Gretzky and will not help creating phishlets. There are plenty of examples of working phishlets and for you to create your own, if you open an issue for a phishlet it will be closed. I will also not consider issues with your Apache2, DNS, or certificate setup as legitimate issues and they will be closed. However, if you encounter a legitimate failure/error with the program, I will take the issue seriously.

   Future Goals

   • Additions to IP blacklist and redirect rules
   • Add more phishlets

   Contributing

   I would like to see this project improve and grow over time. If you have improvement ideas, new redirect rules, new IP addresses/blocks to blacklist, phishlets, or suggestions, please email me at: [email protected] or open a pull request.

   Download Evilgophish