I've dedicated substantial time and effort to create and update new phishlets for Evilginx3. In this repository, you'll find many custom Evilginx phishlets, finely crafted and updated to suit real-world applications.
Advanced EvilGoPhish Mastery Course is Out Now!
This is a course for the advanced hackers, red teams, and penetration testers looking to gain an edge in today's security environment. Learn advanced phishing & smishing techniques with EvilGoPhish 3.0, one of the most powerful reverse-proxy phishing tools available.
EvilGoPhish Mastery is bar none the most dynamic and nuanced reverse-proxy phishing course on the market.
The course works in tandem with this repo by diving deep into the entire process of deploying these scripts for red team phishing & smishing campaigns.
Click HERE to view all sections & lessons! (click 'show more' for all lessons)
Click HERE to enroll in Simpler Hacking's EvilGoPhish Mastery Course
Check our constantly updating our free Evilginx3 Phishlet Repository for Red Teams
You can find it here: https://github.com/simplerhacking/Evilginx3-Phishlets
Send us an email to info@simplerhacking.com or message directly on our website www.simplerhacking.com
name: 'Your First Phishlet'
author: 'Simpler Hacking'
min_ver: '3.2.0'
proxy_hosts:
- { phish_sub: 'www', orig_sub: 'www', domain: '{domain}', session: true, is_landing: true }
sub_filters:
- { hostname: '{hostname}', sub: 'www', domain: '{domain}', search: '{domain}', replace: '{hostname}', mimes: ['text/html', 'application/javascript', 'text/css', 'application/json', 'image/x-icon', 'text/plain', 'application/xml', 'image/*', 'font/*']}
- { hostname: '{hostname}', sub: 'www', domain: '{domain}', search: '{domain}', replace: '{hostname}', mimes: ['application/x-www-form-urlencoded']}
auth_tokens:
- domain: '{domain}'
keys: ['session']
creds:
- key: 'username'
search: ['(.*)']
type: 'post'
- key: 'password'
search: ['(.*)']
type: 'post'
auth_urls:
- url_regex: 'https://{hostname}/login'
valid_statuses: [200]
login:
username: user
password: pass
url: https://www.{domain}/login
# This is just a demo example of a phishlet for 3.2.0
# You can find phishlets here: https://github.com/simplerhacking/Evilginx3-Phishlets
Explanation of Phishlet Parameters:
name:
Identifies the name of the phishlet.author:
Specifies the phishlet author.min_ver:
Specifies the minimum Evilginx version that is compatible with your phishlet.proxy_hosts:
Indicates the domain and subdomains to proxy. Thephish_sub
is the subdomain that the phishing page will imitate.sub_filters:
Allows the phishlet to replace instances of the actual domain name with the phishing domain, which is critical for the phishing page to function correctly.auth_tokens:
Identifies the cookies that should be captured from the victim's browser to gain access to the victim's session.creds:
This field determines the credentials that the phishlet is engineered to steal. Thekey
is the name of the credential (like username or password) andsearch
is a regular expression that the program will use to identify and extract these details from the user's input.auth_urls:
Defines the URLs that Evilginx will treat as the authenticated URLs. After the victim logs in, Evilginx will look out for a redirect to one of these URLs, at which point it will steal the listedauth_tokens
.login:
Here you specify the identifiers of the username and password fields in the login form on the original webpage. Theurl
is the link of the page where the victim enters their credentials.force_post:
If set to true, it forces the alteration of HTTP method from GET to POST.is_landing:
If set to true, it means that the page is a landing page for the phishing attack.js_inject:
This is where you can write some JavaScript to be injected in the webpage. It's typically used to enhance the phishing attack and ensure a smoother victim experience.domain:
This is a template variable used to replace target hostname used in phishlet configuration.
Follow our academic blog for more insights on security: https://medium.com/@simplerhacking
Gain access to more private Phishlets not available to the public on our Patreon.
![Patreon](https://private-user-images.githubusercontent.com/141525149/298275857-3e9d587d-0792-4dad-a6d2-aaa004197508.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1NzkwNDAsIm5iZiI6MTcyNTU3ODc0MCwicGF0aCI6Ii8xNDE1MjUxNDkvMjk4Mjc1ODU3LTNlOWQ1ODdkLTA3OTItNGRhZC1hNmQyLWFhYTAwNDE5NzUwOC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTA1JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkwNVQyMzI1NDBaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00OTExZGIyMTEwNDBhNDA3YjkzNGRmNjAwMTJjZGQ4ZjliZjY3MDdmYzRjYWJjOGQwNzVhOGM0MWUzYmFjNjU4JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.G5zb33dkARWdyjinXqKZofekP7iaUQupMJqfBtpxmtI)
Patreon: www.patreon.com/SimplerHacking
Enroll in our free training lessons & webinars: www.simplerhacking.com/courses
The tools here are intended solely for legal and ethical use by cybersecurity professionals in controlled environments. Any illegal or malicious use is strictly prohibited. I disclaim all responsibility for any harm, loss, or damage that may arise from improper use.