search

dmdhrumilmistry / GooglePhish

Google account phishing tool written in python using django
86 stars 16 forks source link

Where can I find or create the env file to allow CSRF origins and allowed hosts #38

Closed YoussofH closed 1 year ago

YoussofH commented 1 year ago

I know this might seem as a stupid question, but i am still a beginner using docker. I have pulled the image successfully and ran it locally, it worked fine. Now after i used ngrok, i got 403 for csrf requests, i recognized i have to change the settings of allowed domains, after that i read the readme file which indicates that i have to update the ".env" file. Problem: I can not find the ".env" file inside docker desktop app. I tried pasting the settings in the ".dockerenv" file but things didn't work as suposed.

I was wondering how can i copy the ngrok subdomain generated after i have ran the docker image which is dependant on the domain to be allowed for csrf and ALLOWED HOSTS. So I decided to use a wild card for the subdomain but that didn't work neither. Any type of guidance is appreciated. Thanks in advance.

dmdhrumilmistry commented 1 year ago

Hi @YoussofH,

There are several ways to solve this problem, the easiest approach would be to use -e tag while starting the docker container which will help you to set environment variable. Below command should work for you:

docker run -p 8000:8000 --rm dmdhrumilmistry/googlephish -e CSRF_TRUSTED_ORIGINS=https://random-chars-and-ip.ngrok-free.app

Firstly run ngrok then start the googlephish docker container so that you can configure CSRF_TRUSTED_ORIGINS variable.

YoussofH commented 1 year ago

Dear @dmdhrumilmistry, I have noticed that the "e" option should be typed before the docker image, because if not the docker engine will consider the upcoming as an executable which is not the case here. Therefore i figured out the correct pattern is the following

docker run -p 8000:8000 --rm -e CSRF_TRUSTED_ORIGINS=https://random-chars-and-ip.ngrok-free.app dmdhrumilmistry/googlephish

dmdhrumilmistry commented 1 year ago

Dear @dmdhrumilmistry, I have noticed that the "e" option should be typed before the docker image, because if not the docker engine will consider the upcoming as an executable which is not the case here. Therefore i figured out the correct pattern is the following

docker run -p 8000:8000 --rm -e CSRF_TRUSTED_ORIGINS=https://random-chars-and-ip.ngrok-free.app dmdhrumilmistry/googlephish

Hi @YoussofH, yes, you're correct.

Closing issue since it has been resolved now.