kgretzky/evilginx2
View on GitHub ↗ ★ 15,819 Go
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
10 mentions on Hacker News by 9 people: 2 stories, 8 comments · first 2018-07-28 · latest 2025-01-24
20082026
-
…investigating further and taking preventative measures to protect your brand and users. Check this: https://github.com/kgretzky/evilginx2
comment by maremmano · 2025-01-24 · in Ask HN: Why buy domains and 301 redirect them to me? -
…why this change might be a good idea. Also even with traditional 2FA, TOTP can be phished. See https://github.com/kgretzky/evilginx2 WebAuthn almost entirely eliminates phishing risk (at least with respect to credential harvesting), and…
comment by px43 · 2023-10-10 · in Passkeys are now enabled by default for Google users -
…phishing attacks (though the HN audience is generally savvy enough to not fall for phishing) - https://github.com/kgretzky/evilginx2 . (2) As long as you rely on passwords and TOTP, you're relying on the shared secret paradigm and trusting…
comment by thekeyper · 2021-08-05 · in Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication -
…("prompts") are defeatable using trivial man-in-the-middle phishing techniques. For example: https://github.com/kgretzky/evilginx2 . Authenticator-initiated authentication solutions with two-way authentication like Keyri eliminate phishing.
comment by thekeyper · 2021-08-05 · in Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication -
Yeah most phishing attacks can't auto login, but there is an open source tool for doing it: https://github.com/kgretzky/evilginx2
comment by Thorrez · 2020-10-10 · in Robinhood Accounts Looted, No Customer Support -
It absolutely is: https://github.com/kgretzky/evilginx2
comment by AntonyGarand · 2020-09-14 · in I lost €4k in a Facebook scam -
…It is near-trivial to add a phase to phishing that captures the second factor as well. Tools like https://github.com/kgretzky/evilginx2 support it out-of-the-box.
comment by ramimac · 2020-06-09 · in Obscure Indian cyber firm spied on politicians, investors worldwide -
…for a skilled single person to do. DNS poisoning + this github library would be all you needed: https://github.com/kgretzky/evilginx2 EDIT: replaced quotemark with asterisk
comment by rshnotsecure · 2019-09-09 · in Clarifying ProtonMail and Huawei