In this lesson,
we're going to talk about Evilginx,
a powerful tool used for phishing attack,
particularly to bypass Multi-Factor Authentication, or MFA.
Evilginx is a man-in-the-middle or on-path framework
that allows attackers to create realistic phishing websites,
capturing not only the user's credentials,
but also session tokens,
which can be used to access accounts
even if multi-factor authentication is enabled.
So, let's start with what Evilginx does.
Evilginx works by sitting
in between the victim and a legitimate website,
acting as a reverse proxy.
When the victim interacts
with the phishing page created by Evilginx,
it forwards the request to the real website in real time.
The victim never suspects anything,
since the login process looks identical to the real website.
Once the victim enters the credentials and MFA token,
Evilginx captures this information
and sends it to the legitimate site,
allowing the attacker to hijack the session
without the need for the MFA code in future logins.
Here's a typical scenario where Evilginx could be used.
Imagine we're simulating an attack
on a cloud-based service like Office 365.
In our phishing campaign,
we craft an email (similar to the one we discussed
with Gophish) that looks like
a routine notification from IT,
asking users to log into the company's Office 365 portal
to verify some recent updates.
The email contains a link to a phishing page,
but this page is a clone
of the legitimate Office 365 login page
created using Evilginx.
Now, here's how the attack works in practice.
So first, we need to set up Evilginx.
So, Evilginx is configured to act
as a proxy between the victim
and the legitimate Office 365 portal.
The tool captures every request
and response, including login credentials and MFA tokens.
Next, we need to construct the phishing page.
When the user clicks on the link in the phishing email,
they are taken to the fake Office 365 login page.
Since this page is a direct clone of the legitimate page,
it includes the actual Office 365 branding
and URL, making it almost impossible
to distinguish from the real one.
Evilginx does this by proxying the real website,
so everything the victim sees
is pulled directly from Office 365's servers in real time.
Then, we have the user interaction portion.
The victim enters their credentials
and is prompted for the MFA code,
assuming they have MFA enabled.
Then the phishing page relates this information
to the real Office 365 servers.
Everything appears normal
to the user and they're logged in successfully.
In the last portion
we're going to discuss session hijacking.
Evilginx captures both the username,
password, and the session token
that Office 365 uses to keep the user logged in.
This token allows the attacker to hijack
the session and log into the victim's account
without needing the MFA code again.
Now, let's go over this example.
Imagine we're running a pen test for Global Corp.
Global Corp uses Office 365 with MFA.
So simply capturing usernames
and passwords won't give
an attacker access to their accounts.
This is where Evilginx comes in.
We create a phishing page using Evilginx
that mimics the Office 365 login portal.
Employees receive a phishing email,
asking them to verify their credentials
for an important security update.
When they click the link,
they enter their credentials and MFA code,
thinking they're logging into the real Office 365 Suite.
Evilginx intercepts succession token,
and now the attacker has full access
to the user's account without needing the MFA code again.
One of the biggest challenges for attackers today
is bypassing multi-factor authentication.
Even if a user falls for a phishing attack
and provides their credentials,
MFA can block the attacker from logging in
without the additional authentication factor,
such as a code from a mobile app or hardware token.
Evilginx changes the game
by allowing attackers to steal not just the credentials,
but also session tokens, making MFA almost useless
in preventing the attack.
As pen testers,
having Evilginx in your social engineering toolkit
can help you demonstrate
how even companies with strong MFA implementations
can still be vulnerable
if employees fall for phishing attacks.
This can be a real eye-opener for clients
who think MFA alone will protect them
from all phishing threats.
Evilginx's ability to clone legitimate websites
and capture session tokens makes it
a very effective tool for testing MFA resilience.
By simulating these attacks,
we can show organizations
where they need to strengthen their defenses,
such as encouraging the use of FIDO2 hardware tokens,
training employees to recognize phishing emails,
and implementing zero-trust models
to restrict session hijacking.
So remember, Evilginx
is a powerful tool that allows
attackers to bypass multi-factor authentication
by capturing session tokens.
As pen testers,
Evilginx helps us demonstrate
that while MFA is essential,
it is not foolproof, and phishing attacks
can still succeed if employees aren't vigilant.