evilgophish
evilginx3 + gophish (by fin3ss3g0d)
evilginx2
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication (by kgretzky)
| evilgophish | evilginx2 | |
|---|---|---|
| 20 | 30 | |
| 1,309 | 9,953 | |
| - | - | |
| 10.0 | 7.4 | |
| 7 months ago | 4 days ago | |
| Go | Go | |
| GNU General Public License v3.0 only | BSD 3-clause "New" or "Revised" License |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
evilgophish
Posts with mentions or reviews of evilgophish.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-04-04.
- Evilgophish Evilginx 3.0.0 Update
-
Phishing Infrastructure Resources?
https://github.com/fin3ss3g0d/evilgophish comes shipped with SMS phishing capabilities, and is a combination of gophish and evilginx2 with Apache2 proxy in front
-
You should probably disable WebUSB and WebBluetooth in Chrome
As part of this process, I started looking at the various avenues of attack that could bypass FIDO/FIDO2/U2F MFA style authentication. Previously I would use something like EvilGoPhish to phish employees/customers and steal their session cookies to bypass MFA but this does not work with U2F.
-
Phish a User with MFA Enabled
All evilginx2 fans checkout this project that provides campaign statistics for evilginx2 campaigns in the GoPhish dashboard and a real-time end-to-end encrypted feed https://github.com/fin3ss3g0d/evilgophish
- evilgophish - Phishing/Smishing Framework With Pusher End-To-End Encrypted Live Feed
- EvilPhish adds SMS campaign support via Twilio
- evilgophish Now Supports SMS Smishing Campaigns
evilginx2
Posts with mentions or reviews of evilginx2.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-10-10.
-
Google announces passwordless by default: Make the switch to passkeys
No, if you break into a site using passkeys, it gives you literally zero information that can be used to authenticate as any of the users. Think about the prevalence of data breaches in the past decade, and the sharp rise in the effectiveness of password stuffing, and think about why this change might be a good idea.
Also even with traditional 2FA, TOTP can be phished. See https://github.com/kgretzky/evilginx2
WebAuthn almost entirely eliminates phishing risk, and Passkeys are a really nice, clean UX for using WebAuthn.
-
I’ve been stuck on this situation for 3 days, does anyone know how to fix this?
So I downloaded this onto my computer https://github.com/kgretzky/evilginx2 and that took while since I’m new to GitHub and I barely know my way around computers. That went fine, i noticed there was another repository that was pretty much an add on to that same software I downloaded earlier “evilginx2” by another creator, this is the link https://github.com/simplerhacking/Evilginx3-Phishlets
-
friends 2fa being bypassed and Im stumped any advice?
Did your friend clicked on a phising link, if yes a aitm coud be one of the possibilities: https://github.com/kgretzky/evilginx2
-
MFA Just Casually being bypassed?? Anyone else seeing this?
We had a user compromised simiarly the other day, with what I believe to be https://github.com/kgretzky/evilginx2 now. It stole his session cookie and was able to auth. Fortunately, we have Office 365 Defender and he was flagged immediately on the risky user sign-ins and we were able to block and investigate.
-
Accounting got phished. Paid out big bucks
Evilginx kan bypass MFA and hijack your session https://github.com/kgretzky/evilginx2 Only thing that migitates this is fido keys
- User compromised despite MFA?
-
Best way to capture web app traffic for later analysis?
You can try this for web app traffic MIMD: https://github.com/kgretzky/evilginx2
- Main channel hacked
- Any Self Hosted alternatives to cloak.ist?
- MFA Bypass
What are some alternatives?
When comparing evilgophish and evilginx2 you can also consider the following projects:
PhishDock - Automated Docker infrastructure with Gophish, Nginx Proxy Manager, Nginx and PHP
Modlishka - Modlishka. Reverse Proxy.
webusb - Connecting hardware to the web.
muraena - Muraena is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities.
Evilginx2-Phishlets - Evilginx2 Phishlets version (0.2.3) Only For Testing/Learning Purposes
awesome-lnurl - A curated list of awesome lnurl things.
gogophish - Fly into Gophish with One Click (Infra Automation)
css-only-chat - A truly monstrous async web chat using no JS whatsoever on the frontend
htmx - </> htmx - high power tools for HTML
CSS_SQL_Networking_Tools - Tools used by the SQL Networking Customer Support Team
Evilginx3-Phishlets - This repository provides penetration testers and red teams with an extensive collection of dynamic phishing templates designed specifically for use with Evilginx3.
evilgophish vs PhishDock
evilginx2 vs Modlishka
evilgophish vs webusb
evilginx2 vs muraena
evilgophish vs Evilginx2-Phishlets
evilginx2 vs awesome-lnurl
evilgophish vs gogophish
evilginx2 vs css-only-chat
evilginx2 vs htmx
evilginx2 vs Evilginx2-Phishlets
evilginx2 vs CSS_SQL_Networking_Tools
evilginx2 vs Evilginx3-Phishlets