Evilginx
Reverse-proxy framework that tests MFA and session resilience by proxying legitimate websites, with an open-source core and commercial Pro edition.
Technical Architecture & Overview
Evilginx is an open-source reverse-proxy framework written in Go by Kuba Gretzky. It is a standalone HTTP and DNS server that proxies legitimate websites to test the resilience of multi-factor authentication and session-handling controls. Evilginx Pro is a separate, vetted commercial edition with additional features and maintained phishlets.
Targeted Technical Use Cases
Red teams and security researchers who need to test advanced authentication and session-resilience controls, including MFA and conditional access policies, in authorized adversary-simulation exercises.
Evaluation & Trade-offs
Core Strengths
- +The built-in HTTP and DNS server reduce external dependency requirements.
- +Phishlet configuration lets testers proxy arbitrary target domains without writing custom templates.
- +The open-source core is freely available and has an official Gophish integration.
Trade-Offs & Limitations
- -Community phishlets are not officially maintained and can break when target sites change.
- -The commercial Pro version is required for access to maintained phishlets and support.
- -Deployment and TLS certificate management require careful network and DNS setup.
Defensive Security Application
Validate that MFA, conditional access, and session-management controls resist reverse-proxy credential and session interception, then prioritize phishing-resistant authentication.
Frequently Asked Questions
What is Evilginx?→
Evilginx is an open-source reverse-proxy framework written in Go by Kuba Gretzky. It is a standalone HTTP and DNS server that proxies legitimate websites to test the resilience of multi-factor authentication and session-handling controls. Evilginx Pro is a separate, vetted commercial edition with additional features and maintained phishlets.
What is Evilginx used for?→
Red teams and security researchers who need to test advanced authentication and session-resilience controls, including MFA and conditional access policies, in authorized adversary-simulation exercises.
What are the strengths of Evilginx?→
- +The built-in HTTP and DNS server reduce external dependency requirements.
- +Phishlet configuration lets testers proxy arbitrary target domains without writing custom templates.
- +The open-source core is freely available and has an official Gophish integration.
What are the limitations of Evilginx?→
- +Community phishlets are not officially maintained and can break when target sites change.
- +The commercial Pro version is required for access to maintained phishlets and support.
- +Deployment and TLS certificate management require careful network and DNS setup.
How is Evilginx used defensively?→
Validate that MFA, conditional access, and session-management controls resist reverse-proxy credential and session interception, then prioritize phishing-resistant authentication.