Godaddy AWS config - Githubissues

kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

BSD 3-Clause "New" or "Revised" License

10.64k stars 1.93k forks source link

Godaddy AWS config #696

Closed jayhill365 closed 2 years ago

jayhill365 commented 2 years ago

DO NOT ASK FOR PHISHLETS.

DO NOT ASK FOR HELP CREATING PHISHLETS.

DO NOT ASK TO FIX PHISHLETS.

DO NOT ADVERTISE OR TRY TO SELL PHISHLETS.

EXPECT A BAN OTHERWISE. THANK YOU!

REPORT ONLY BUGS OR FEATURE SUGGESTIONS.

I keep getting errors, I believe I have correctly pointed my purchased godaddy domain toward my AWS server.

However when I run command, phishlets enable facebook, I get getting 403 errors. Am I not configuring A records correctly in Godaddy , or is this an issue I need to fix within AWS?

For reference I have followed this tut

evilginx2 walkthrough

When i visit, my domain currently an apache web page is showing, when i visit the link created by Evilginx2 , it doesn't work.

Are there any walkthroughs showing steps setting up DNS and subdomains as I think this is where I'm doing something wrong?

jayhill365 commented 2 years ago

https://github.com/kgretzky/evilginx2/issues/614 looks like a similar issue here

jayhill365 commented 2 years ago

Thanks going to ignore adding anything to /etc/hosts file .

Does this look correct to you? Still not sure why im getting 403's from what i can tell ive already correctly added subdomains to godaddy's domain manager @waitwhatwhen thanks for the reply here as well

jayhill365 commented 2 years ago

Something else to note, when I added the new subdomains to the godaddy domain manager it automatically assigned new IP's to each of the new subdomains not sure if this is why im still getting this same error

jayhill365 commented 2 years ago

Well shit thanks for looking out i've been on this for 2 days straight im going to rip out Cnames, and delete the subdomains I added and see if it works your way instead thanks @waitwhatwhen

jayhill365 commented 2 years ago

Still not working on my end, does it look like im missing anything from what you can tell?

looks like im still getting errors something to do with the subdomain m.instagram.com and www.instagram.com @waitwhatwhen

jayhill365 commented 2 years ago

I figured out what was causing this issue, after getting the DNS records corrected, I needed to shut down the AWS DNS and webserver in order for evilginx to use 443 & set up TLS certs and proxy the request. The AWS server im using host its own dns server on local 53 which stops evilginx2. In order to fix the 403 error what I did was first turn off the apache2 service, then I started evilginx2 using sudo, then enabled phishlets and I was finally able to setup the TLS.

jayhill365 commented 2 years ago

https://1jayhill.medium.com/evilginx2-x-gophish-to-hunt-for-2fa-mfa-passwords-cookies-using-aws-godaddy-f03e9154732b this might help someone else out.

vendettaiai commented 2 years ago

https://1jayhill.medium.com/evilginx2-x-gophish-to-hunt-for-2fa-mfa-passwords-cookies-using-aws-godaddy-f03e9154732b this might help someone else out.

how did you get you domain to say instgram.com

jayhill365 commented 2 years ago

https://1jayhill.medium.com/evilginx2-x-gophish-to-hunt-for-2fa-mfa-passwords-cookies-using-aws-godaddy-f03e9154732b this might help someone else out.

how did you get you domain to say instgram.com

yo @starbwoy32 thats a feature that comes with Evilginx2 and the premade phishlet for ig they give you.

vendettaiai commented 2 years ago

https://1jayhill.medium.com/evilginx2-x-gophish-to-hunt-for-2fa-mfa-passwords-cookies-using-aws-godaddy-f03e9154732b this might help someone else out.

how did you get you domain to say instgram.com

yo @starbwoy32 thats a feature that comes with Evilginx2 and the premade phishlet for ig they give you.

Last question I read you blog. What is the purpose of putting evilginx2 link in gophish?

jayhill365 commented 2 years ago

@starbwoy32 gophish is a super powerful tool, basically you'd use it to spam the link you created using evilginx2. There's a ton of information out about gophish check out there docs https://getgophish.com/documentation/

WilKGoodangel commented 2 years ago

https://1jayhill.medium.com/evilginx2-x-gophish-to-hunt-for-2fa-mfa-passwords-cookies-using-aws-godaddy-f03e9154732b this might help someone else out.

how did you get you domain to say instgram.com

yo @starbwoy32 thats a feature that comes with Evilginx2 and the premade phishlet for ig they give you.

I am a bit lost it has been 4 days. are you saying that the domain name added to the server needs to be the one of the phishlet (e,g coinbase.com ) instead of the one I bought coinbase.com.es?