Skip to content
/ Evilginx-Phishing-Infra-Setup Public

Evilginx Phishing Infrastructure Setup Guide - Securing Evilginx and Gophish Infrastructure, Removing IOCs, Phishing TTPs

334 stars 63 forks Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

An0nUD4Y/Evilginx-Phishing-Infra-Setup

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
img
img
 
 
README.md
README.md
 
 

Repository files navigation

Phishing Engagement Infrastructure Setup Guide

Note: These are copy of my personal notes. Please Do not completely rely on them.

Blogs/Talks

Red Team/Phishing Infra Automation

Domain Purchase and Categorization Techniques

Improve Phishing Email Writing Using Tools

Test Email Spammyness

Awesome Enterprise Email Security

Delivering Emails in Inbox

  • Method -1

  • Method - 2 (By Andre Rosario - From BreakDev Red Discord)

    • If you are having issues with delivering emails due to email filtering, consider using Microsoft 365 and Azure IPP to send encrypted emails to your targets!

      • Emails originate from legit Microsoft SMTP servers so they can't block it.
      • Targets who get the encrypted email are the only ones who can open it, if they forward it to their DFIR, they will have to login as that user to even see your message.
      • Easy orchestration in the Microsoft Admin portal of custom domains, create a ton of fake accounts.
      • M365 allows you to set arbitrary display names. So in a targets outlook the email can look like its from [email protected] but it's really from [email protected] (Technical people can easily figure this out though)
      • Emails come from legit Microsoft IPs and domains, so you don't have to worry about domain categorization or lifespan since it's Microsoft.

    • Steps

      1. Make an account with a Microsoft 365 Business Standard (or higher) license. (https://www.microsoft.com/en-us/microsoft-365/enterprise/office365-plans-and-pricing)
      2. Create a generic company name.
      3. Get a Azure Information Protection Premium P1 license to be able to use encryption. (https://support.microsoft.com/en-us/office/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc)
      4. Import your domain.
      5. Create a user with an email to your custom domain to send the phish and give it the M365 Business and Azure IPP P1 license.
      6. Draft your phishing message in Outlook online and press the encrypt button
      7. ????
      8. Profit

    • Screenshot

      Untitled

Phishing Engagements With Evilginx

  • Building Evilginx Phishlets

  • Evilginx Installation Scripts

  • Securing Evilginx Infra tips -

    • https://github.com/An0nUD4Y/Evilginx2-Phishlets#securing-evilginx-infra-tips

      - Rewrite URLs on Phishing Pages to avoid detection through URL Path pattern matching (by Kuba).
- Remove IOCs (X-Evilginx header and Default Cert Details)
- Modify Unauth redirect static contents
- Modify code to request wildcard certificates for root domain from Let'sEncrypt other than requesting for each subdomains (As mentioned in Kuba's blog) - Check this repo for reference https://github.com/ss23/evilginx2
- Put evilginx behind a proxy to help against TLS fingerprinting (JA3 and JA3S)
- Use cloudflare in between if possible/feasible (You have to configure the SSL Settings correctly, change it to Full in cloudflare settings)
- Use some known ASN blacklist to avoid getting detected like here (https://github.com/aalex954/evilginx2-TTPs#ip-blacklist)
- Reduce the Number of proxyhosts in phishlet if possible to reduce content loading time.
- Host Evilginx at Azure and use their domain (limit proxy host in phishlet to 1 or find a way , may be create multiple azure sub domains and try with that)
- Add some sub_filters to modify the content of the pages to avoid content based detections, like (Favicon, form title font or style, or anything which seems relevant)
- Block the feedback/telemetry/logs/analytics subdomains using the phishlet sub_filters which can log the domain or may help later on analysis.
- See if js-injected is static or dynamic , if static modify the evilginx js-inject code to create dynamic/obfuscated version of your js for each user/target.
- Make sure to not leak your Evilginx infra IP, Check the DNS history to make sure its not stored anywhere (Analysts may look for older DNS Records of the domain)
- Be aware of this research : https://catching-transparent-phish.github.io/catching_transparent_phish.pdf , repo - https://catching-transparent-phish.github.io/

    • Remove X-Evilginx header (Check all the code lines with req.Header.Set and comment relevant functions)

    • Search for <html> in core/http_proxy.go file and modify the html code to remove any static signatures.

    • Also to avoid the static injected js code signature detection , You can modify the code as below

      • Make sure to add "github.com/tdewolff/minify/js" in imports

        	re := regexp.MustCompile(`(?i)(<\s*/body\s*>)`)
	var d_inject string

	if script != "" {
		minifier := minify.New() // "github.com/tdewolff/minify/js"
		minifier.AddFunc("text/javascript", js.Minify)
		obfuscatedScript, err := minifier.String("text/javascript", script)
		if err != nil {
			// Handle error - Obfuscation failed
			d_inject = "<script" + js_nonce + ">" + "function doNothing() {var x =0};" + script + "</script>\n${1}"
		}
		d_inject = "<script" + js_nonce + ">" + "function doNothing() {var x =0};" + obfuscatedScript + "</script>\n${1}"
		//d_inject = "<script" + js_nonce + ">" + "function doNothing() {var x =0};" + script + "</script>\n${1}"

	} else if src_url != "" {
		d_inject = "<script" + js_nonce + " type=\"application/javascript\" src=\"" + src_url + "\"></script>\n${1}"
	} else {
		return body
	}

    • Modify core/cert.db file as well

    • Change “rid” for gophish.

    • Rewrite URLs on Phishing Pages to avoid detection through URL Path pattern matching (by Kuba). [This Feature not available in evilginx Public Version, You have to implement it yourself.]

      # Only Work in Evilginx Pro Version
# Similar functionality can be implemented in public version as well.
rewrite_urls:

trigger:
domains: ['www.linkedin.com']
paths: ['^/login$']
rewrite:
path: '/this/is/not/the/path/you/are/looking/for.php'
query:

    {key:'a', value: 'HOW'}
    {key:'b', value: 'MUCH'}
    {key:'d', value: 'IS'}
    {key:'e', value: 'THE'}
    {key:'f', value: 'PHISH'}
    {key:'q', value: '{id}'}

      Untitled

    • Modify the lure/session identifier cookies signatured pattern and value (by @rad9800 )

    • Block Referrer headers from leaking your phishing domain name - check this research blog for reference :

      • Add below line in http_proxy.go file here (Chrome don’t respect this and when request is initiated by url() CSS function - check blog for more)
        • resp.Header.Set("Referrer-Policy", "no-referrer")
        • To automate from phishlet Check this PR : kgretzky/evilginx2#1006

    • Define your own CSP (Content security Policy) to avoid telemetry/canary/detection by leaking phishing domain.

    • Check if target site is using some sort of canary tokens (CSS, JS) and avoid them

    • JA4 fingerprint evasion

Evilginx Research Blogs/Talks :

Defense Tactics Against Evilginx

Securing GoPhish Infra

These modifications will also work in the latest evilginx + gophish version i.e evilginx3.3

  • Tips : Use {{.URL}} parameter in phishing template while using with evilginx ( kgretzky/evilginx2#1042 (comment))

  • Modifications in gophish source code and file structure to Secure the GoPhish Infra

    • Remove X-Gophish instances ( X-Gophish-Contact , X-Gophish-Signature)

    • Remove const ServerName= "gophish" and change it to const ServerName= "IGNORE" in file config/config.go

    • Change the default Admin server port in config.json file.

    • Modify Test Email Message Signatures, To avoid detection during SMTP Testing. Controllers > api > util.go

      Controllers > api > util.go
models > testdata > email_request.go
models > testdata > email_request_test.go
models > testdata > maillog.go
models > testdata > maillog_test.go
models > testdata > smtp_test.go

    • Change 404 response

      • Add below custom function in controllers/phish.go file

        func customNotFound(w http.ResponseWriter, r *http.Request) {
	http.Error(w, "Try again!", http.StatusNotFound)
}

      • Now replace all instances of http.NotFound(w, r) to customNotFound(w, r)

    • Remove robots.txt hardcoded response and modify it in file controllers/phish.go

      • Modify the respective code in phish.go file to below one.

        //Modified Response
// RobotsHandler prevents search engines, etc. from indexing phishing materials
func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "User-agent: *\nDisallow: /*/*\nDisallow: /.git/*")
}

    • Modify the “rid” GET Parameter in requests

      • Make sure to modify all the instances of "rid" to something else.
      • These are also present in evilginx3.3 source code , So make sure to modify there as well.

    • For advance preventions, You can modify the static folder as well and rename it to something else, also rename the files inside it to avoid path based detection. Just do not forget to modify the relevance source code as well.

      • Like images name , example : pixel.png , modify it to something else.

    • Change the Certificate Properties in util/util.go file

      	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			//Organization: []string{"Gophish"},
			Organization: []string{"Microsoft Corporation"},
		},

    • Use Nginx to proxy traffic through it to avoid any Golang Server Fingerprint

      • service nginx start

      • You need to change the gophish config.json to change the ports for http from 80 to 8080 and https from default to 60002, as shown below

        {
	"admin_server": {
		"listen_url": "127.0.0.1:60002",
		"use_tls": true,
		"cert_path": "gophish_admin.crt",
		"key_path": "gophish_admin.key",
		"trusted_origins": []
	},
	"phish_server": {
		"listen_url": "127.0.0.1:8080",
		"use_tls": false,
		"cert_path": "example.crt",
		"key_path": "example.key"
	},
	"db_name": "sqlite3",
	"db_path": "gophish.db",
	"migrations_prefix": "db/db_",
	"contact_address": "",
	"logging": {
		"filename": "",
		"level": ""
	}
}

      • Below configuration will block all requests with user agent containing “Bot” or “bot”

        # /etc/nginx/nginx.conf

events {
    # Define event processing parameters here
    worker_connections 1024; # Adjust according to your requirements
}

http {

    upstream backend {
        server localhost:8080;
    }
    # HTTP server
    server {
        listen 80 default_server;
        

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
            return 403;
        }

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    upstream backend_https {
        server localhost:60002;
    }
    # HTTPS server
    server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
            return 403;
        }

        location / {
            proxy_pass https://backend_https;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

      • To allow specific user agent only, use below config. This will block all requests and only allow requests which has user agent “iamdevil”.

        # /etc/nginx/nginx.conf

events {
    # Define event processing parameters here
    worker_connections 1024; # Adjust according to your requirements
}

http {

    upstream backend {
        server localhost:8080;
    }

    # HTTP server
    server {
        listen 80 default_server;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
            return 403;
        }

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    upstream backend_https {
        server localhost:60002;
    }

    # HTTPS server
    server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
            return 403;
        }

        location / {
            proxy_pass https://backend_https;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

    • Modify Gophish Tracking Pixel signature to avoid detection based on signatured tracking pixel.

    • Change the gophish email headers sequence pattern. It may be used to detect the gophish (From BreakDev Red Community).

  • https://edermi.github.io/post/2021/modding_gophish/

  • https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls

  • https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf

  • https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls

  • https://github.com/puzzlepeaches/sneaky_gophish

  • https://cybercx.co.nz/blog/identifying-gophish-servers/

  • gophish/gophish#1553 (comment)

AiTM Post Exploitation / Phishing Research Blogs/Talks

Other Techniques

About

Evilginx Phishing Infrastructure Setup Guide - Securing Evilginx and Gophish Infrastructure, Removing IOCs, Phishing TTPs

Resources

Readme
Activity

Stars

334 stars

Watchers

5 watching

Forks

63 forks
Report repository

Releases

No releases published

Packages

No packages published