Evilginx
Reverse-proxy framework that tests MFA and session resilience by proxying legitimate websites, with an open-source core and commercial Pro edition.
Technical Architecture & Overview
Evilginx is an open-source reverse-proxy framework written in Go by Kuba Gretzky. It is a standalone HTTP and DNS server that proxies legitimate websites to test the resilience of multi-factor authentication and session-handling controls. Evilginx Pro is a separate, vetted commercial edition with additional features and maintained phishlets.
Targeted Technical Use Cases
Red teams and security researchers who need to test advanced authentication and session-resilience controls, including MFA, in authorized adversary-simulation exercises.
Evaluation & Trade-offs
Core Strengths
- +The built-in HTTP and DNS server reduce external dependency requirements.
- +Target sites are defined in phishlets, which are YAML configuration files.
- +The open-source core is freely available and has an official Gophish integration.
Trade-Offs & Limitations
- -Community phishlets are not officially maintained and can break when target sites change.
- -The tested and maintained official phishlets database is available only in the commercial Pro version.
- -Deployment requires a registered domain and DNS configuration that points to the Evilginx server.
Defensive Security Application
Validate that MFA and session-management controls resist reverse-proxy credential and session interception.
Frequently Asked Questions
What is Evilginx?→
Evilginx is an open-source reverse-proxy framework written in Go by Kuba Gretzky. It is a standalone HTTP and DNS server that proxies legitimate websites to test the resilience of multi-factor authentication and session-handling controls. Evilginx Pro is a separate, vetted commercial edition with additional features and maintained phishlets.
What is Evilginx used for?→
Red teams and security researchers who need to test advanced authentication and session-resilience controls, including MFA, in authorized adversary-simulation exercises.
What are the strengths of Evilginx?→
- +The built-in HTTP and DNS server reduce external dependency requirements.
- +Target sites are defined in phishlets, which are YAML configuration files.
- +The open-source core is freely available and has an official Gophish integration.
What are the limitations of Evilginx?→
- +Community phishlets are not officially maintained and can break when target sites change.
- +The tested and maintained official phishlets database is available only in the commercial Pro version.
- +Deployment requires a registered domain and DNS configuration that points to the Evilginx server.
How is Evilginx used defensively?→
Validate that MFA and session-management controls resist reverse-proxy credential and session interception.