2023-06-13 17:57:24 +00:00
id : evilginx
info :
name : EvilGinx - Detect
author : pussycat0x
severity : info
description : |
Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection.
reference :
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-infrastructure/delivery/evilginx
metadata :
2024-04-08 11:34:33 +00:00
verified : "true"
2024-06-07 10:04:29 +00:00
max-request : 1
censys-query : b18d778b4e4b6bf1fd5b2d790c941270145a6a6d
2023-06-30 22:49:09 +00:00
tags : tech,evilginx,c2,phishing,panel
2023-06-13 17:57:24 +00:00
http :
- method : GET
path :
- "{{BaseURL}}/login"
matchers-condition : and
matchers :
- type : dsl
dsl :
- "status_code == 200 && contains(body, 'Evilginx')"
- "(\"b18d778b4e4b6bf1fd5b2d790c941270145a6a6d\" == sha1(body))"
2023-10-14 11:27:55 +00:00
condition : and
2024-06-08 16:02:17 +00:00
# digest: 4a0a0047304502201a3829f74293f6124d98ee4ad6dd20c93d7db14d5f94b27d676c176596aff0d5022100ba9db4fbc6059526b522c2393eb25e1bea8bf8c17e316611cfd5e8c7e3d0f76e:922c64590222798bb761d5b6d8e72950
