Evilginx2 - Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Original Docker-Evilginx2 - Previous Dockerized work on evilginx2 (but version is 3.2.0 at time of this fork).

This repository is designed to be separate as it will likely have adjustments only needed for the SANS Institute SEC660: Advanced Penetration Testing and Exploit Writing course.

Here are some example snippets to help you get started creating a container.

docker create \
  --name=evilginx \
  -p 10.50.50.50:443:443 \
  -p 10.50.50.50:80:80 \
  -p 7443 \
  -v /opt/evilginx/config:/config \
  -v /opt/evilginx/phishlets:/phishlets 
  --restart unless-stopped \
  jimshew/evilginx

Compatible with docker-compose v2 schemas.

---  -p 10.50.50.50:80:80 \

version: "2"
services:
  evilginx:
    image: jimshew/evilginx
    container_name: evilginx
    environment:
      - TZ=Europe/London
    volumes:
      - /opt/evilginx/config:/config
      - /opt/evilginx/phishlets:/phishlets
    ports:
      - 10.50.50.50:443:443
      - 10.50.50.50:80:80
      - 7443:7443
    restart: unless-stopped

Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate <external>:<internal> respectively. For example, -p 8080:80 would expose port 80 from inside the container to be accessible from the host's IP on port 8080 outside the container.

docker start evilginx

Access the webui at <your-ip>:7443, for more information check out evilginx2.

• Shell access whilst the container is running: docker run -it --entrypoint sh evilginx
• To monitor the logs of the container in realtime: docker logs -f evilginx

If you want to make local modifications to these images for development purposes or just to customize the logic:

git clone https://github.com/jimshew/docker-evilginx.git
cd docker-evilginx
docker build . -t evilginx

• v0.1 - Draft