search

hash3liZer / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
GNU General Public License v3.0
101 stars 40 forks source link

capture tokens #19

Closed New1addi closed 3 years ago

New1addi commented 3 years ago

Good afternoon. I made my Phishlet everything works fine, through debag I see all cookies, they are registered in auth_tokens, I get a username and password and do not save cookies, I tried one cookie the same history, auth_urls: also does not help where to drip? auth_urls only on a get request? please help me where to drip. thank you in advance.

JamesCullum commented 3 years ago

This report is very difficult to understand for me - what do you mean with "drip"? Maybe you can write in your native language and let it translate by Google Translate?

New1addi commented 3 years ago

I just wrote through the translator, sorry for my bad English. Is there any advice, cookies with debug, I see everything, well, he does not save them, tried auth_urls too, there 10 cookies tried at least one result the same. taken from https://github.com/kgretzky/evilginx2/pull/212/commits/0d322964ff520d04f687bcb4797f698ab16fba45 well modified

New1addi commented 3 years ago 
keys: ['X-BackEndCookie','.*,regexp'] Not work idea?

I've tried almost everything 555

JamesCullum commented 3 years ago

You mean it recognizes the stuff but doesn't save the result? This would be related to the phishlet and if it captures all tokens and URLs to recognize that the phishing is complete.

New1addi commented 3 years ago

I understand that, well, the capture does not work for me, be it cookies or url, I don't even know what to try

JamesCullum commented 3 years ago

I see. I wish you best of luck to find someone to support you with this phishlet specific support. On Github we do not offer support for fixing phishlets, hence I will close the issue on this point.