Skip to content
/ Evilginx-Phishing-Infra-Setup Public

Evilginx Phishing Infrastructure Setup Guide - Securing Evilginx and Gophish Infrastructure, Removing IOCs, Phishing TTPs

527 stars 100 forks Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

An0nUD4Y/Evilginx-Phishing-Infra-Setup

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
img
img
 
 
README.md
README.md
 
 

Repository files navigation

Phishing Engagement Infrastructure Setup Guide

Note: These are copy of my personal notes. Please Do not completely rely on them.

Table of Contents

Blogs/Talks

Red Team/Phishing Infra Automation

Domain Purchase and Categorization Techniques

Improve Phishing Email Writing Using Tools

Test Email Spammyness

Emulate Phishing emails / Purple Team Phishing

Awesome Enterprise Email Security

Delivering Emails in Inbox

Phishing Engagements With Evilginx

Evilginx Research Blogs/Talks :

Defense Tactics Against Evilginx

Securing GoPhish Infra

These modifications will also work in the latest evilginx + gophish version i.e evilginx3.3

  • Tips : Use {{.URL}} parameter in phishing template while using with evilginx ( https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864)

  • Modifications in gophish source code and file structure to Secure the GoPhish Infra

    • Remove X-Gophish instances ( X-Gophish-Contact , X-Gophish-Signature)

    • Remove const ServerName= "gophish" and change it to const ServerName= "IGNORE" in file config/config.go

    • Change the default Admin server port in config.json file.

    • Modify Test Email Message Signatures, To avoid detection during SMTP Testing. Controllers > api > util.go

      Controllers > api > util.go
models > testdata > email_request.go
models > testdata > email_request_test.go
models > testdata > maillog.go
models > testdata > maillog_test.go
models > testdata > smtp_test.go

    • Change 404 response

      • Add below custom function in controllers/phish.go file

        func customNotFound(w http.ResponseWriter, r *http.Request) {
	http.Error(w, "Try again!", http.StatusNotFound)
}

      • Now replace all instances of http.NotFound(w, r) to customNotFound(w, r)

    • Remove robots.txt hardcoded response and modify it in file controllers/phish.go

      • Modify the respective code in phish.go file to below one.

        //Modified Response
// RobotsHandler prevents search engines, etc. from indexing phishing materials
func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "User-agent: *\nDisallow: /*/*\nDisallow: /.git/*")
}

    • Modify the “rid” GET Parameter in requests

      • Make sure to modify all the instances of "rid" to something else.
      • These are also present in evilginx3.3 source code , So make sure to modify there as well.

    • For advance preventions, You can modify the static folder as well and rename it to something else, also rename the files inside it to avoid path based detection. Just do not forget to modify the relevance source code as well.

      • Like images name , example : pixel.png , modify it to something else.

    • Change the Certificate Properties in util/util.go file

      	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			//Organization: []string{"Gophish"},
			Organization: []string{"Microsoft Corporation"},
		},

    • Use Nginx to proxy traffic through it to avoid any Golang Server Fingerprint

      • service nginx start

      • You need to change the gophish config.json to change the ports for http from 80 to 8080 and https from default to 60002, as shown below

        {
	"admin_server": {
		"listen_url": "127.0.0.1:60002",
		"use_tls": true,
		"cert_path": "gophish_admin.crt",
		"key_path": "gophish_admin.key",
		"trusted_origins": []
	},
	"phish_server": {
		"listen_url": "127.0.0.1:8080",
		"use_tls": false,
		"cert_path": "example.crt",
		"key_path": "example.key"
	},
	"db_name": "sqlite3",
	"db_path": "gophish.db",
	"migrations_prefix": "db/db_",
	"contact_address": "",
	"logging": {
		"filename": "",
		"level": ""
	}
}

      • Below configuration will block all requests with user agent containing “Bot” or “bot”

        # /etc/nginx/nginx.conf

events {
    # Define event processing parameters here
    worker_connections 1024; # Adjust according to your requirements
}

http {

    upstream backend {
        server localhost:8080;
    }
    # HTTP server
    server {
        listen 80 default_server;
        

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
            return 403;
        }

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    upstream backend_https {
        server localhost:60002;
    }
    # HTTPS server
    server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
            return 403;
        }

        location / {
            proxy_pass https://backend_https;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

      • To allow specific user agent only, use below config. This will block all requests and only allow requests which has user agent “iamdevil”.

        # /etc/nginx/nginx.conf

events {
    # Define event processing parameters here
    worker_connections 1024; # Adjust according to your requirements
}

http {

    upstream backend {
        server localhost:8080;
    }

    # HTTP server
    server {
        listen 80 default_server;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
            return 403;
        }

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    upstream backend_https {
        server localhost:60002;
    }

    # HTTPS server
    server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
            return 403;
        }

        location / {
            proxy_pass https://backend_https;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

    • Modify Gophish Tracking Pixel signature to avoid detection based on signatured tracking pixel.

    • Change the gophish email headers sequence pattern. It may be used to detect the gophish (From BreakDev Red Community).

    • Setup PostFix infront of gophish to remove IOCs and other detection and spamyness of emails and also removed and fixes the headers.

  • GoPhish Research Blogs/Talks :

  • Gophish Alternatives :

AiTM Post Exploitation / Phishing Research Blogs/Talks

Other Techniques/Blogs/Researches

Phishing Research Talks

About

Evilginx Phishing Infrastructure Setup Guide - Securing Evilginx and Gophish Infrastructure, Removing IOCs, Phishing TTPs

Resources

Readme
Activity

Stars

527 stars

Watchers

6 watching

Forks

100 forks
Report repository

Releases

No releases published

Packages

No packages published