Evilginx 3.0 is a standalone security-testing framework that demonstrates reverse-proxy phishing attacks against modern web authentication systems. It sits between a browser and a legitimate service to study how credentials and authenticated session data can be intercepted in adversary-in-the-middle scenarios. Because session tokens can remain valid after multifactor authentication, the project highlights limitations of some traditional 2FA deployments. The current implementation is written in Go and includes its own HTTP and DNS server components. Site-specific behavior is defined through modular phishing-site configurations known as phishlets. The project is intended for authorized penetration testing, red-team exercises, and defensive research into phishing-resistant authentication. Its capabilities can enable credential theft if misused, so testing should be restricted to systems and users covered by explicit permission.
Features
- Reverse-proxy phishing simulation
- Credential and session-token interception research
- Multifactor authentication resilience testing
- Standalone Go HTTP and DNS components
- Site-specific phishlet configuration system
- Authorized red-team and defensive security assessment
Project Samples
