[PDF] PHISHING INFRASTRUCTURE evilginx.data.db which is

What is evilginx and how to use it?

This tool is Evilginx, which is a man-in-the-middle (MITM) attack framework for remotely capturing credentials and session cookies of any web service. It uses Nginx HTTP server to proxy legitimate login page to visitors, and captures credentials and session cookies. It uses custom domains and valid SSL certificates.

Where is evilginx2?

Prior to going phishing, note one more thing: a hidden directory named Evilginx2 should appear in the home folder. It contains the main config (the saved set of parameters), database (hijacked credentials and sessions), and a certificate with the key.

What are evilginx phishlets?

Evilginx phishlets are plain-text ruleset ( YAML format ), which are fed into Evilginx engine, and they’re defining which subdomains are needed to properly proxy a specific site, which strings to replace in relayed packets, which cookies to capture, etc. In those phishlets we have some general variables, e.g.:

Is evilginx 2 obfuscated?

I have set up and launched a test system just to check out Evilginx 2. Therefore, I neither bothered obfuscating the attack nor added any extra layers for the sake of disguise; the server was run as a bare ‘skeleton’. As you can see, even such a primitive attack can be successful.