evilginx2: Test Reverse-Proxy Phishing Defenses

Overview

Evilginx2 is a standalone man-in-the-middle framework that proxies traffic between a browser and a target website. In an authorized test, it demonstrates how phishing can capture login credentials and session cookies, including cases where multifactor authentication alone does not prevent session compromise.

It is most relevant to penetration testers and defenders assessing identity protections. Its capabilities are dual-use and can enable credential theft, so deployments and tests require explicit authorization and careful scope controls.

Key Features

• Standalone Go application with its own HTTP and DNS servers.
• Reverse-proxy architecture that relays browser and website traffic.
• Demonstrates capture of credentials and session cookies in phishing scenarios.
• Supports phishlets, which define how the proxy interacts with a target site.
• Provides an official Gophish integration, documented for Evilginx 3.3.
• Includes online documentation at help.evilginx.com.

Use Cases

• Red teams can assess whether an organization’s login and session controls withstand authorized phishing simulations.
• Identity and security teams can use controlled tests to inform phishing-resistant authentication and session-protection improvements.
• Security educators can demonstrate reverse-proxy phishing risks in a permission-based lab.

Getting Started

Consult the repository README and official documentation for setup and usage details. Use it only in a controlled environment or an explicitly authorized engagement.

Considerations

• This is a dual-use security tool that can facilitate credential and session theft. Do not target real users or services without written authorization.
• Captured credentials and session cookies are sensitive data. A test plan should define scope, handling, retention, and deletion before testing begins.
• The README describes the project as a standalone application, but the supplied information does not specify system requirements or a one-command installation method.
• The repository is BSD-3-Clause licensed. Review the license and applicable rules before use or redistribution.