Evilginx is an open-source adversary-in-the-middle (AiTM) reverse-proxy phishing framework used primarily by penetration testers and red teams to simulate advanced phishing attacks. Its defining capability is its power to bypass multi-factor authentication (MFA) by stealing session cookies rather than just static passwords. [1, 2, 3]
Written entirely in Go, modern versions operate as standalone applications equipped with their own built-in HTTP and DNS servers. [4]
How Evilginx Works
Unlike traditional phishing kits that use static, cloned HTML copies of a login page, Evilginx acts as a live proxy. [5, 6]
- The Relay: When a victim navigates to an Evilginx phishing link (the "lure"), the framework acts as a middleman. It dynamically requests the actual, legitimate login page from the target service (like Microsoft 365, Okta, or Google) and forwards it to the victim. [2, 6]
- Real-time Interaction: The user interacts with a completely authentic page because the forms, graphics, and text are pulled directly from the real provider in real time. The user enters their username, password, and completes any secondary authentication (such as an SMS OTP or authenticator app prompt). [6, 7, 8]
- Token Hijacking: Once authentication is successful, the legitimate service issues a session cookie (or token). Evilginx intercepts and logs this session cookie before passing it back to the victim. [1, 2, 3, 5]
- Account Takeover: The attacker can import this stolen session cookie into their own browser. Because the cookie proves the MFA handshake already happened, the attacker bypasses the MFA wall entirely and gains full access to the account. [1, 3, 9]
Key Terminology & Concepts
- Phishlets: Configuration files (written in YAML) that instruct Evilginx how to proxy specific websites. They contain the specific domain tracking rules, text replacement rules, and definitions for which exact cookies must be stolen to hijack a session. [10]
- Lures: The specific URLs generated by Evilginx to send to targets. They pair a chosen domain with a specific phishlet to redirect a victim to the appropriate proxied page. [6, 11]
- Evilginx Pro: A commercial, strictly vetted enterprise tier developed by the framework's creator (Kuba Gretzky). It features stealth optimizations like client-server architecture, behavior-based bot blocking ("Botguard"), automated JavaScript obfuscation, and evasions for Google Safe Browsing. [1, 12, 13, 14]
Why Standard MFA Fails (and What Stops It)
Evilginx bypasses "traditional" multi-factor authentication—such as SMS codes, email verification, and standard authenticator app push notifications—because it relies on the user actively supplying the code to the proxy. [7, 8]
To completely neutralize an Evilginx attack, organizations must deploy phishing-resistant MFA: [7]
- FIDO2 / Passkeys: WebAuthn standards and passkeys use strict domain binding. During authentication, the browser cryptographically verifies the actual domain name in the address bar. If a user is on an Evilginx proxy domain (
://micros0ft.com) instead of the real domain (://microsoft.com), the security key/passkey refuses to sign the challenge, rendering the attack useless. [7, 8]
[13] https://evilginx.com
No comments:
Post a Comment