search

kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
BSD 3-Clause "New" or "Revised" License
10.64k stars 1.93k forks source link

Google phishlet #657

Closed ghost closed 3 years ago

ghost commented 3 years ago

Editing the token enables the password form, which none of the phishlets currently achieve. Replacing it with an error is great because it doesn't require getting a valid token.

There's still some extra checks implemented when you attempt to login from a new location. The phishlet won't bypass those checks but it works on my machine

¯_(ツ)_/¯

athena2001 commented 3 years ago

before trying can you type in pw?

athena2001 commented 3 years ago

It will work if you're using it on your own account or an account which has logged in with the same IP as evilginx2 in the last 24hrs

check ur email please lol

Anonymoushawk commented 3 years ago

hi @TomAbel Great work. But still it is workable only with an account which has logged in with the same IP ?

ghost commented 3 years ago

I don't know, people are saying it's not working at all. I bought some prepaid SIM cards for the purpose of testing it with freshly created accounts, but I don't know when I'll have time for it. You can use my fork in the meanwhile