Referer and Origin headers removal

kgretzky / evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

BSD 3-Clause "New" or "Revised" License

10.23k stars 1.87k forks source link

Referer and Origin headers removal #980

Open gabyavra opened 8 months ago

gabyavra commented 8 months ago

Is it possible to remove Referer and Origin headers? The phish url get leaked in this way.

JBalanza commented 7 months ago

Hi there, I also corroborate that issue. As an example, when performing well known phishing against o365 the phish does not work since Microsoft checks this value (among other integrity things) and performs a request to tell about that to a "watson" endpoind.