search

kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
BSD 3-Clause "New" or "Revised" License
10.22k stars 1.87k forks source link

Runtime error if handshake was not established. #1051

Open matejsmycka opened 2 months ago

matejsmycka commented 2 months ago 
2024/04/27 08:17:31 [228] WARN: Cannot handshake client REDACTED.cz read tcp 192.168.64.176:443->24.144.112.6:60418: read: connection reset by peer
2024/04/27 08:17:31 [229] WARN: Cannot handshake client REDACTED.cz read tcp 192.168.64.176:443->24.144.112.6:60430: read: connection reset by peer
2024/04/28 11:15:24 [011] WARN: Cannot read TLS response from mitm'd server EOF
2024/04/28 11:15:38 [014] WARN: Cannot handshake client id.REDACTED.cz tls: client offered only unsupported versions: [302 301]
2024/04/28 11:15:40 [015] WARN: Cannot handshake client id.REDACTED.cz tls: client offered only unsupported versions: [301]
2024/04/28 11:15:42 [016] WARN: Cannot handshake client id.REDACTED.cz tls: client offered only unsupported versions: []
2024/04/28 17:49:55 [024] WARN: Cannot handshake client REDACTED.cz EOF
panic: runtime error: index out of range [1] with length 1

goroutine 7902 [running]:
github.com/inconshreveable/go-vhost.readClientHello({0xadede0?, 0xc000416120?})
     evilginx2_custom/vendor/github.com/inconshreveable/go-vhost/tls.go:259 +0x2b3
github.com/inconshreveable/go-vhost.TLS({0xae5098, 0xc00003c008})
     evilginx2_custom/vendor/github.com/inconshreveable/go-vhost/tls.go:91 +0x19b
github.com/kgretzky/evilginx2/core.(*HttpProxy).httpsWorker.func1({0xae5098, 0xc00003c008})
     evilgophish_tooling/evilginx2_custom/core/http_proxy.go:1623 +0xd0
created by github.com/kgretzky/evilginx2/core.(*HttpProxy).httpsWorker in goroutine 9
       evilginx2_custom/core/http_proxy.go:1618 +0x192
matejsmycka commented 2 months ago

This crawler crashed my Evilginx server.

NetRange:       24.144.64.0 - 24.144.127.255
CIDR:           24.144.64.0/18
NetName:        DIGITALOCEAN-24-144-64-0

At least this is what I think happened.

Dgoat201 commented 2 months ago

Capture cookies, load in iframe comes with AOL, google and office365 https://t.me/nextgenerationphishin

matejsmycka commented 1 month ago

what?

Dgoat201 commented 1 month ago

Check it