Descargar DyNaMiC PrOxY
Elpidio Heart
I've recently managed to find some free time to work on reverse proxy support for the latest Google updates and in the process I've made several additions to the Evilginx code base, which I think some of you will find useful.
To start, I wanted to give a big shoutout to Daniel (@dunderhay) for publishing a great post on how he used Evilginx to phish the Microsoft 365 ADFS environment and how he even made his modifications to succeed!
Evilginx is getting more love this year than in the last couple of years and I'm very happy about it. I have big plans for Evilginx, which I will announce soon, but first I wanted to give you a rundown of what the latest 3.2 update consists of.
One of the behaviours, that annoyed me when using Evilginx, was the fact that sometimes it was not possible to immediately redirect the phished user to the configured redirect_url, once all session tokens were captured. Evilginx could only redirect the browser once the targeted website attempted to navigate to a different page, on its own.
It made redirects not work on single-page applications. I learned it first-hand during the development of the Training Lab for my Evilginx Mastery course. The main page of the lab changes its contents dynamically and never navigates to a different URL. This means that once session tokens are captured by Evilginx, the tool is unable to redirect the user to redirect_url address.
In the 3.2 update, I've managed to solve the problem with injected JavaScript sending out HTTP long polling requests on every proxied page, to retrieve session capture status directly from the Evilginx proxy server in real-time. Evilginx will inject its own JavaScript code on every HTML page load, which will be responsible for querying infinitely. Evilginx proxy server will respond with a JSON structure, containing the redirect_url value only when the session is successfully captured. Otherwise, the connection will time out after 30 seconds and will be retried afterwards. Long polling allows Evilginx to let the injected script know that the session was captured immediately when it happens.
The script will then change the window.location URL to the retrieved redirect_url value, redirecting the user to a preconfigured page address. Redirection should now work great within Evilginx Mastery Training Lab.
Imagine a situation - you're on a phishing engagement and finally get to send out your phishing lures. Once the emails start arriving at the target inbox, the mailbox server opens them one by one and scans the HTML content of every phishing URL. The mail server then determines emails as phishing and they are sent to quarantine.
There are many ways to prevent automated scanners from seeing the content of your phishing pages, but the most straightforward method would be to simply hide your phishing pages for a brief moment, right before you send out the emails. Enough to hide their content from automated scanners, but not from the targeted user.
The best part is that you don't have to worry about unpausing a lure manually. Once the pause period expires, the lure with become active again and you will get a notification about it in the terminal. The pause state also persists between Evilginx restarts.
Now you can detect specific requests within the new intercept section in your phishlets, which will match specific URL paths on domains within your proxy_hosts list. Once the request matches your filters, you will be able to detour the request and return your response with a custom HTTP status code.
Sometimes for the phishlet to work properly and to not interrupt the phished user's experience, it needs to redirect the user's browser right after session tokens are successfully captured. For now, the redirect would happen only if redirect_url was specified for the lure, used with the phishing engagement.
At times, it is important to have a default redirect_url specified, especially if we want the user to be redirected to the home page of the phished website, by design. Sometimes the redirection to the home page will happen automatically, but sometimes it needs to be enforced.
From this Evilginx version, you can set a default redirect_url in the phishlet you are creating to make sure the phished user is redirected, once session tokens are captured, even if redirect_url has not been set up for the given lure.
Unauthorized URL or unauth_url holds the URL address where visitors will be redirected if they open any URL on the phishing domain, which doesn't correspond to any valid URL or if the lure is currently paused.
So far, it was possible to set up unauth_url globally, which would provide the same URL to redirect to for all active phishlets. With 3.2 you can now override the global unauth_url by specifying a value for each phishlet with:
Sometimes it was especially frustrating to test the sub_filters of your phishlets because your web browser cached the content of your previous modification. Every time you made small changes and had to retest, it was required to clear the browser cache.
Normally when your phishlets inject JavaScript, through js_inject functionality, Evilginx would drop the whole script into the content of the HTML page within ... tags. This approach was kind of messy, so I figured out a way to inject multiple scripts as external references, like this:
Requests to download external JavaScript resources will be intercepted by Evilginx proxy and the response will be delivered from Evilginx directly, without ever being forwarded to the destination website.
In the upcoming weeks, I want to show off a sneak peek of Evilginx Pro and outline all of its extra features. Evilginx Pro will be a paid product I want to distribute only to vetted red teaming companies around the world.
Obfuscated SSH with an optional keyword. When supported and enabled in both the client and server, obfuscation makes it more difficult for an observer to detect that the protocol being used is SSH. (Protocol; OpenSSH patches)
Bitvise SSH Client provides integrated access to the SSH server's console, either via VT-100 and xterm protocols supported by most SSH servers on any platform, or via the enhanced bvterm protocol supported by Bitvise SSH Server:
When using Bitvise SSH Client to connect to a GSSAPI-enabled SSH server in the same or a trusted Windows domain, you can let Kerberos 5 (or on older platforms, NTLM) perform the server as well as user authentication for you. No manual host key verification; no management of user passwords and public keys. Just tell the SSH client which server in the domain to connect to, and if that server is Bitvise SSH Server or another server with compatible support for GSSAPI, the two programs will authenticate and establish a secure connection automatically.
Dynamic tunneling via integrated proxysupporting SOCKS4, SOCKS4A, SOCKS5 and HTTP CONNECT proxy tunnelingprotocols. Configure your applications to connect to target hoststhrough the SSH Client's proxy, and no manual tunneling rules need beconfigured.
Bitvise SSH Client minimizes its presence by displaying only a system tray icon when running in the background. If an error is encountered while the program is minimized, the icon reflects that.
Server-side forwarding:with Bitvise SSH Server and Client, a server and multiple clients can be set upso that all port forwarding rules are configured centrally at theserver, without requiring any client-side setting updates. The SSHclients only need to be configured once, and port forwarding rules caneasily be changed when necessary.
Command-line parameters are supported. Using command-line automation,a port forwarding session can be started from a link in the Startupmenu without requiring any user interaction whatsoever. Help with thecommand-line parameters can be found in the SSH client log area when itis first started, or by executing 'BvSsh /?' from a command prompt.
run Bitvise SSH Client from removable media and prevent it from making any changes to the Windows registry - and yet use public key authentication andverify host keys using the -noRegistry, -keypairFile and -hostKeyFileparameters;
Additionally, when the graphical Bitvise SSH Client is running, you can use the command line utility BvSshCtrl to programmatically cause the client to log in, log out, or exit. Run 'BvSshCtrl' for help.
Bitvise SSH Client (Tunnelier) supports command-line parameters that control how it uses the Windows registry (the -noRegistry and -baseRegistry parameters). This can be used when control over registry usage is required.
The latest versions of our SSH Client additionally support storing host key information and client authentication keypairs in an SSH Client profile. This means that you can copy the contents of the SSH Client installation directory to a USB key, insert the USB key into another computer, and run the graphical SSH Client as follows:
Bitvise SSH Client incorporates sexec,a scriptable command-line remote execution client which can be used tosecurely execute programs on remote machines from a batch file. Thebatch file can perform actions based on the exit code reported from theremote program, and can capture the remote program's output forprocessing by simple redirection of sexec output.
Another command-line program included with Bitvise SSH Client, stermc,conveniently opens an SSH terminal emulation session with xterm, VT-100and bvterm support in the same Command Prompt window it is startedfrom. If you SSH from computer A to computer B running Bitvise SSH Server, and you also have Bitvise SSH Client installed on computer B, you can use stermc toconveniently establish an onward SSH terminal session to computer C.
All Bitvise command-line clients support all authentication methodssupported by Bitvise SSH Client, can load settings from a profile configured in the graphical client, work with the same user keypair and host key database as the graphical client, can connect through a SOCKS or HTTP CONNECT proxy, and support a common set of command-line parameters controlling most aspects of establishing an SSH connection.
13d16603cb