What is this?
Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which lets an attacker bypass 2-factor authentication.
Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which lets an attacker bypass 2-factor authentication.Is this built on nginx like the original Evilginx, or something else?No - this version (3.0) is completely rewritten in Go as a standalone application that implements its own HTTP and DNS servers, replacing the nginx-based proxy used in the original 2017 release.
No - this version (3.0) is completely rewritten in Go as a standalone application that implements its own HTTP and DNS servers, replacing the nginx-based proxy used in the original 2017 release.How do I get it running?Build it yourself with Go and 'make' since it's a standalone Go binary with no external proxy dependency, or follow the official online documentation for full install and usage steps.
Build it yourself with Go and 'make' since it's a standalone Go binary with no external proxy dependency, or follow the official online documentation for full install and usage steps.Do I need an existing nginx setup or anything besides Go to build it?No - it's written entirely in Go and compiled into one standalone binary with 'make'; the old nginx-based proxy dependency from the 2017 version is gone.
No - it's written entirely in Go and compiled into one standalone binary with 'make'; the old nginx-based proxy dependency from the 2017 version is gone.Will the maintainer help me build phishlets?No - the author explicitly refuses to provide or help create phishlets, so you need to source ready-made ones from the community yourself.
No - the author explicitly refuses to provide or help create phishlets, so you need to source ready-made ones from the community yourself.Who is this tool meant for?It's meant for penetration testers and red teamers running authorized engagements - the author states it should only be used in legitimate pentests with written permission from the target.
It's meant for penetration testers and red teamers running authorized engagements - the author states it should only be used in legitimate pentests with written permission from the target.What is Evilginx Pro and how does it differ from this open-source tool?Evilginx Pro is a separate paid product built on the same reverse-proxy phishing concept, adding features like phishing-detection evasion, a maintained phishlets database, bot-blocking (Botguard), wildcard TLS certs and automated server deployment - none of which are in this free repo.
Evilginx Pro is a separate paid product built on the same reverse-proxy phishing concept, adding features like phishing-detection evasion, a maintained phishlets database, bot-blocking (Botguard), wildcard TLS certs and automated server deployment - none of which are in this free repo.Can I send Evilginx phishing links through Gophish?Yes - there's an official forked Gophish integration compatible with Evilginx 3.3 for running phishing campaigns that tie into Evilginx.
Yes - there's an official forked Gophish integration compatible with Evilginx 3.3 for running phishing campaigns that tie into Evilginx.Is there a course to learn reverse-proxy phishing with this tool?Yes - the author sells an 'Evilginx Mastery' training course covering reverse-proxy phishing and bypassing multi-factor authentication for red team work.
Yes - the author sells an 'Evilginx Mastery' training course covering reverse-proxy phishing and bypassing multi-factor authentication for red team work.Why was Evilginx rewritten from nginx to Go?To make it a fully standalone tool with its own built-in HTTP and DNS servers, removing the need to separately configure an nginx proxy and simplifying setup.
To make it a fully standalone tool with its own built-in HTTP and DNS servers, removing the need to separately configure an nginx proxy and simplifying setup.What are similar projects?Claude-Red, Red-Teaming-Toolkit, PowerSploit, bug-bounty-hunting-prompts, CVE-2026-62911, Decepticon, social-engineer-toolkit, thc-hydra
Claude-Red, Red-Teaming-Toolkit, PowerSploit, bug-bounty-hunting-prompts, CVE-2026-62911, Decepticon, social-engineer-toolkit, thc-hydraWhich topics is it in?credentials, phishing, two-factor-authentication, session, mitm, ethical-hacking, pentest, redteam, 2fa, network-security, hacking-tool, offensive-security
credentials, phishing, two-factor-authentication, session, mitm, ethical-hacking, pentest, redteam, 2fa, network-security, hacking-tool, offensive-security