mirror of
https://github.com/kgretzky/evilginx2.git
synced 2026-04-25 00:36:10 +03:00
[PR #1135] Added config flag to send captured credentials to Gophish #173
Labels
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/evilginx2-kgretzky#173
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
📋 Pull Request Information
Original PR: https://github.com/kgretzky/evilginx2/pull/1135
Author: @callightmn
Created: 10/25/2024
Status: 🔄 Open
Base:
master← Head:dev📝 Commits (2)
313d595added ability to send captured credentials to gophishc947ecbadded ability to send credentials separately from session tokens📊 Changes
4 files changed (+146 additions, -32 deletions)
View changed files
📝
core/config.go(+12 -0)📝
core/gophish.go(+67 -6)📝
core/http_proxy.go(+48 -22)📝
core/terminal.go(+19 -4)📄 Description
Hello there,
By default, Evilginx does not send session information to Gophish. This is on purpose not to expose credentials and keep them in Evilginx only. Nevertheless, having credentials readily available in Gophish could be a nice feature to have everything in the dashboard, provided Gophish's admin interface is properly secured (behind a firewall for instance). I made it an opt-in feature to keep the default behavior.
Default behavior (or after
config gophish sessions falsein Evilginx' terminal):After
config gophish sessions truein Evilginx' terminal:The feature takes into account all three types of credentials (username, password and custom) and all three types of auth_tokens (cookies, body and HTTP tokens).
NB: Actually displaying session info in Gophish requires the ability for Gophish to receive session information (see https://github.com/kgretzky/gophish/pull/1). The Gophish update was done by @nairpaa, who also did a similar update for Evilginx but without the opt-in and not supporting cookie tokens. I merged his changes with mine as he wrapped the session info into a single generic
datamember, which is cleaner on the wire (instead of having potentially null members, unrelated to the event being sent by Evilginx).🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.