search

kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
BSD 3-Clause "New" or "Revised" License
10.62k stars 1.92k forks source link

Okta phishlet not working #712

Closed jayhill365 closed 2 years ago

jayhill365 commented 2 years ago

DO NOT ASK FOR PHISHLETS.

DO NOT ASK FOR HELP CREATING PHISHLETS.

DO NOT ASK TO FIX PHISHLETS.

DO NOT ADVERTISE OR TRY TO SELL PHISHLETS.

EXPECT A BAN OTHERWISE. THANK YOU!

REPORT ONLY BUGS OR FEATURE SUGGESTIONS.

Are there any fixes for the okta phishlet as of now its automatically redirecting me toward another page . going to double check if the key is correct in config

Screen Shot 2022-01-20 at 1 56 07 PM
jayhill365 commented 2 years ago

got it working, just needed to add verification key and token at the end or the url, found out both by going to config and pulling they key and token at the end of the url created. ex: xxxxx.com/?verification_key=verificationtoken

cha0tic87 commented 2 years ago

@jayhill365 I think I'm facing a similar issue and can't get it working with your fix.

Right now, visiting my lure URL of xxxxx.com/n328fdn redirects to xxxxx.com/login/login.htm

I tried adding the verification_key and verification_token parameters to the URL but still got redirected in the same way.

Am I doing anything wrong? Are you able to clarify your steps?

hydroponictrash commented 1 year ago
  1. Type config to get the verification token.
  2. Run lures edit path <id> ?verification_key=verificationtoken (Replace this info with your actual token)
  3. If that doesn't work try lures edit path <id> verification_key=verificationtoken Or just the verification token. The goal is to make a lure attach to the correct verification token. Then your site should redirect to xxxxx.com/login/login.htm if everything else was done right.