[PR #1135] Added config flag to send captured credentials to Gophish #173

Open
opened 2026-02-26 02:31:30 +03:00 by kerem · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/kgretzky/evilginx2/pull/1135
Author: @callightmn
Created: 10/25/2024
Status: 🔄 Open

Base: masterHead: dev


📝 Commits (2)

  • 313d595 added ability to send captured credentials to gophish
  • c947ecb added ability to send credentials separately from session tokens

📊 Changes

4 files changed (+146 additions, -32 deletions)

View changed files

📝 core/config.go (+12 -0)
📝 core/gophish.go (+67 -6)
📝 core/http_proxy.go (+48 -22)
📝 core/terminal.go (+19 -4)

📄 Description

Hello there,

By default, Evilginx does not send session information to Gophish. This is on purpose not to expose credentials and keep them in Evilginx only. Nevertheless, having credentials readily available in Gophish could be a nice feature to have everything in the dashboard, provided Gophish's admin interface is properly secured (behind a firewall for instance). I made it an opt-in feature to keep the default behavior.

Default behavior (or after config gophish sessions false in Evilginx' terminal):

Capture d’écran 2024-10-25 à 20 36 42

After config gophish sessions true in Evilginx' terminal:

Capture d’écran 2024-10-25 à 20 38 22

The feature takes into account all three types of credentials (username, password and custom) and all three types of auth_tokens (cookies, body and HTTP tokens).

NB: Actually displaying session info in Gophish requires the ability for Gophish to receive session information (see https://github.com/kgretzky/gophish/pull/1). The Gophish update was done by @nairpaa, who also did a similar update for Evilginx but without the opt-in and not supporting cookie tokens. I merged his changes with mine as he wrapped the session info into a single generic data member, which is cleaner on the wire (instead of having potentially null members, unrelated to the event being sent by Evilginx).


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/kgretzky/evilginx2/pull/1135 **Author:** [@callightmn](https://github.com/callightmn) **Created:** 10/25/2024 **Status:** 🔄 Open **Base:** `master` ← **Head:** `dev` --- ### 📝 Commits (2) - [`313d595`](https://github.com/kgretzky/evilginx2/commit/313d5950e6226e7ca68b3a8f8ad4a491550bdfbb) added ability to send captured credentials to gophish - [`c947ecb`](https://github.com/kgretzky/evilginx2/commit/c947ecbb9853d7f60ee7de1c6cb4de868c10e558) added ability to send credentials separately from session tokens ### 📊 Changes **4 files changed** (+146 additions, -32 deletions) <details> <summary>View changed files</summary> 📝 `core/config.go` (+12 -0) 📝 `core/gophish.go` (+67 -6) 📝 `core/http_proxy.go` (+48 -22) 📝 `core/terminal.go` (+19 -4) </details> ### 📄 Description Hello there, By default, Evilginx does not send session information to Gophish. This is on purpose not to expose credentials and keep them in Evilginx only. Nevertheless, having credentials readily available in Gophish could be a nice feature to have everything in the dashboard, provided Gophish's admin interface is properly secured (behind a firewall for instance). I made it an opt-in feature to keep the default behavior. Default behavior (or after `config gophish sessions false` in Evilginx' terminal): ![Capture d’écran 2024-10-25 à 20 36 42](https://github.com/user-attachments/assets/ab1fdd19-418f-4f58-bfb0-cc011240e616) After `config gophish sessions true` in Evilginx' terminal: ![Capture d’écran 2024-10-25 à 20 38 22](https://github.com/user-attachments/assets/53e6a116-9ac5-482e-aeb4-9f056c35392d) The feature takes into account all three types of credentials (username, password and custom) and all three types of auth_tokens (cookies, body and HTTP tokens). **NB**: Actually displaying session info in Gophish requires the ability for Gophish to receive session information (see https://github.com/kgretzky/gophish/pull/1). The Gophish update was done by @nairpaa, who also did a similar update for Evilginx but without the opt-in and not supporting cookie tokens. I merged his changes with mine as he wrapped the session info into a single generic `data` member, which is cleaner on the wire (instead of having potentially null members, unrelated to the event being sent by Evilginx). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/evilginx2-kgretzky#173
No description provided.