Welcome to my new post! Over the past several months I've been researching new phishing techniques that could be used in penetration testing assignments. Almost every assignment starts with grabbing the low-hanging fruit, which are often employees' credentials obtained via phishing.

In today's post I'm going to show you how to make your phishing campaigns look and feel the best way possible.

Steal Tools Lua Co

I'm releasing my latest Evilginx project, which is a man-in-the-middle attack framework for remotely capturing credentials and session cookies of any web service. It uses Nginx HTTP server to proxy legitimate login page, to visitors, and captures credentials and session cookies on-the-fly. It works remotely, uses custom domain and a valid SSL certificate. I have decided to phish Google services for Evilginx demonstration as there is no better way to assess this tool's effectiveness than stress-testing best anti-phishing protections available.

This section describes the C API for Lua, that is, the set of C functions available to the host program to communicate with Lua. All API functions and related types and constants are declared in the header file lua.h. Even when we use the term 'function', any facility in the API may be provided as a macro instead.
LuaEdit is an IDE/Debugger/Remote Debugger/Script Editor designed for the 5.1 and/or 5.2 version of Lua. It features syntax highlighting, completion proposal list, parameter proposition engine, advance breakpoint management (including condition system on breakpoints and hit count), function listing, global and local variables listing, watches, project oriented management, code profiling, etc.
Anomic-Stuff / Pick all dropped tools.lua Go to file Go to file T; Go to line L; Copy path Copy permalink; Shariiii Update Pick all dropped tools.lua. Latest commit 0b980e7 Feb 8, 2021 History. 1 contributor Users who have contributed to this file 5 lines (4 sloc) 10.7 KB Raw Blame.

Please note that Evilginx can be adapted to work with any website, not only with Google.

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time. Roblox lighting tools steal. Lua is a Void epic from the Dark Elves faction. Lua has huge nuke potential and a fantastic A3 which decreases turn meter of a single target completely. This makes Lua a great wave clearer for Dungeons and Faction Wars and then a specialist to keep the Spider 20 and Fire Knight 20 bosses turn meter down.

Enjoy the video. If you want to learn more on how this attack works and how you can implement it yourself, do read on.

Disclaimer: This project is released for educational purposes and should be used only in legitimate penetration testing assignments with written permission from to-be-phished parties.

How it works

Attacker generates a phishing link pointing to his server running Evilginx: https://accounts.notreallygoogle.com/ServiceLogin?rc=https://www.youtube.com/watch?v=dQw4w9WgXcQ&rt=LSID
Parameters in the URL stand for:
rc =
On successful sign-in, victim will be redirected to this link e.g. document hosted on Google Drive.
rt = This is the name of the session cookie which is set in the browser only after successful sign-in. If this cookie is detected, this will be an indication for Evilginx that sign-in was successful and the victim can be redirected to URL supplied by rc parameter.
Victim receives attacker's phishing link via any available communication channel (email, messenger etc.).
Victim clicks the link and is presented with Evilginx's proxied Google sign-in page.
Victim enters his/her valid account credentials, progresses through two-factor authentication challenge (if enabled) and he/she is redirected to URL specified by rc parameter. At this point rd cookie is saved for notreallygoogle.com domain in victim's browser. From now on, if this cookie is present, he/she will be immediately redirected to rc URL, when phishing link is re-opened.
Attacker now has victim's email and password, as well as session cookies that can be imported into attacker's browser in order to take full control of the logged in session, bypassing any two-factor authentication protections enabled on victim's account.

Let's take few steps back and try to define main obstacles in traditional phishing efforts.

First and major pain with phishing for credentials is two-factor authentication. You can create the best looking template that yields you dozens of logins and passwords, but you will eventually get roadblocked when asked for verification token that arrived via SMS. Not only will it stop you from progressing further, but it will also tip off the account owner, when they receive login attempt alert.

Second issue with phishing templates is, they must allow to accept any login and password, as they have no means of confirming their validity. That will, at times, leave you with invalid credentials.

Third issue is having to create phishing templates. I don't know about you, but for me the process of copying site layout, stripping javascript, fixing CSS and writing my own replacements for stripped javascript code to make the login screen behave as the original, is extremely annoying. It feels bad to recreate something, which has already been done.

In past several months I have worked on my own ettercap-like HTTP proxy software written in C++, using Boost::Asio library for maximum efficiency. I implemented SSLstrip, DNS spoofing and HSTS bypass. This solution worked perfectly in Local Area Network, but I wondered if same ideas could be repurposed for remote phishing, without a need to use custom-made software.

I had a revelation when I read an excellent blog post by @i_bo0om. He used Nginx HTTP server's proxy_pass feature and sub_filter module to proxy the real Telegram login page to visitors, intercepting credentials and session cookies on-the-fly using man-in-the-middle attacks. This article made me realize that Nginx could be used as a proxy for external servers and it sparked the idea of Evilginx. The idea was perfect - simple and yet effective.

Allow me to talk a bit on Evilginx's research process, before I focus on installation and usage.

Evilginx Research

The core of Evilginx is the usage of Nginx HTTP proxy module. It allows to pass clients' requests to another server. This basically allows Nginx server to act as a man-in-the-middle agent, effectively intercepting all requests from clients, modifying and forwarding them to another server. Later, it intercepts server's responses, modifies them and forwads them back to clients. This setup allows Evilginx to capture credentials sent with POST request packets and upon successful sign-in, capture valid session cookies sent back from the proxied server.

In order to prevent the visitor from being redirected to the real website, all URLs with real website's domain, retrieved from the server, need to replaced with Evilginx phishing domain. This is handled by sub_filter module provided by Nginx.

Nginx implements its own logging mechanism, which will log every request in detail, including POST body and also cookies: and set-cookie: headers. I created a Python script named evilginx_parser.py, that will parse the Nginx log and extract credentials and session cookies, then save them in corresponding directories, for easy management.

There is one big issue in Nginx's logging mechanism that almost prevented Evilginx from being finished.

Take a look at the following Nginx configuration line that specifies the format in which log entries should be created:

Variable $sent_http_set_cookie stores a value of set-cookie response header. These headers will contain session cookies returned from the server on successful authorization and they have to be included in the output of Nginx's access log.
Issue is, HTTP servers return cookies in multiple set-cookie headers like so:

For some reason Nginx's $sent_http_set_cookie variable doesn't store set-cookie header values as an array. Instead it stores only the value of the first seen set-cookie