kgretzky/evilginx2

What it does

Evilginx is a standalone man-in-the-middle attack framework built for offensive security testing. It runs its own HTTP and DNS servers in Go and sits as a reverse proxy between a victim's browser and a legitimate website, capturing login credentials and session cookies. Because the session cookie is stolen after authentication, the technique can bypass many forms of two-factor authentication. It is the successor to the original nginx-based Evilginx released in 2017, rewritten as a self-contained Go application.

The project targets penetration testers and red teams who have written authorization to phish the parties involved. The author is explicit that it should only be used in legitimate assignments with permission from the to-be-phished parties README disclaimer. Sites are emulated through "phishlets" that define how to proxy a target service, and the tool handles the DNS and TLS side of serving convincing domains.

Getting started

Evilginx is not distributed as a turnkey binary in this README; installation, configuration, and phishlet usage are documented externally. Follow the official documentation at help.evilginx.com. A typical setup needs a server with a public IP, a domain you control with DNS pointed at it (wildcard or per-subdomain records), and TLS certificates; then you configure phishlets, start the proxy, and send authorized test users to the crafted domain, observing captured credentials and cookies in the admin interface.

For sending test links, the author provides a Gophish fork with Evilginx integration and a setup write-up Go Phish blog post.

The README states that the author does not provide support for creating phishlets, and that ready-to-use phishlets come from other people.

Constraints and caveats

• Legal scope: only legitimate penetration testing with written permission; the author frames the tool as a demonstration of attacker capability for defenders README.
• Phishlets are not supplied here: the project does not help users create phishlets, and there is no maintained phishlet database in the open repository.
• Commercial Pro edition: Evilginx Pro is a separate paid product with features such as evasion, a maintained phishlet database, bot filtering, JavaScript/HTML obfuscation, and automated deployment Pro release notes. Those features are not part of the open-source version described here.
• Deep understanding required: DNS, certificates, reverse-proxy configuration, and target-service behavior all affect whether a test works.
• License: BSD-3-Clause.

Defensive context

Discussion around the project notes that phishing resistant to this style of attack is hard to solve from the website side: binding the 2FA challenge to the site origin, as U2F does, helps on the client, but there is no universal server-side fix, and 2FA was designed against password reuse more than phishing HN discussion. Practical monitoring of look-alike domains can use tools such as EvilURL and dnstwist HN comment.

HotRepo's take

This is a mature security tool with a clear offensive purpose and an explicit authorization-only stance. HotRepo recorded it on the daily Go ranking at position 7 on 2026-11-08 with 22 stars added that day, and Hacker News threads from 2018 drew limited discussion (54 points, 7 comments on the main thread) HN thread. The useful signal for readers is not popularity but the split between the open-source framework and the commercial Pro edition: the README's feature list mostly describes Pro, while the repository itself is the base proxy engine. Teams evaluating it for red-team work should treat it as a framework requiring their own phishlets and infrastructure, not an out-of-the-box service.