id: evilginx

info:
  name: EvilGinx - Detect
  author: pussycat0x
  severity: info
  description: |
    Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection.
  reference:
    - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-infrastructure/delivery/evilginx
  metadata:
    verified: "true"
    max-request: 1
    censys-query: b18d778b4e4b6bf1fd5b2d790c941270145a6a6d
  tags: tech,evilginx,c2,phishing,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200 && contains(body, 'Evilginx')"
          - "(\"b18d778b4e4b6bf1fd5b2d790c941270145a6a6d\" == sha1(body))"
        condition: and
# digest: 4a0a0047304502201a3829f74293f6124d98ee4ad6dd20c93d7db14d5f94b27d676c176596aff0d5022100ba9db4fbc6059526b522c2393eb25e1bea8bf8c17e316611cfd5e8c7e3d0f76e:922c64590222798bb761d5b6d8e72950