search

kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
BSD 3-Clause "New" or "Revised" License
10.94k stars 1.97k forks source link

Sub1.sub2.sub3.sub4.domain.com #200

Closed thecityofhereafter closed 5 years ago

thecityofhereafter commented 5 years ago

I've registered mydomain.com at google domains.

I set A records for ns1 --> evilginx2 server ip and ns2 --> evilginx2 server ip

under registered hosts I put:

ns1.mydomain.com ---> evilginx2 server ip ns2.mydomain.com --> evilginx2 server ip

under name servers I check "use custom name servers" and I set them to ns1.mydomain.com and ns2.mydomain.com

in evilginx2 I set my evilginx2 server hostname to sub3.sub4.mydomain.com

i set my phishlets hostname to sub2.sub3.sub4.mydomain.com

in my site.yaml file I set the phish_sub: to "accounting"

the login page should be accessed at accounting.sub2.sub3.sub4.mydomain.com but I'm not having any luck? what am I doing wrong here?

(please delete my other post, I was able to cobble together a working yaml file for the site I'm interested in) thanks!

thecityofhereafter commented 5 years ago

I have also tried setting the evilginx2 server hostname to mydomain.com

then setting the phishlets hostname to sub2.sub3.sub4.mydomain.com

and the site.yaml stays the same with 'accounting' as the phish_sub

this did not work either. I'm sure it has something to do with using an extra subdomain?

thecityofhereafter commented 5 years ago

Basically, no matter what I do, the login page keeps loading after I hit submit username.. and this was a working yaml file, I just changed the domain name.

kgretzky commented 5 years ago

Seems you've set up the nameservers properly. What is the error you are getting and at which point? Do you generate the URL with lures get-url?

After adding new phish_hosts to the phishlet make sure to delete the certificates folder under ~/.evilginx/ for your domain as currently evilginx is not able to retrieve new LetsEncrypt certificates if they were already retrieved.