ACAO + CSP MOD!

Evilginx
, ,
1

Ramos here again!

The problem

‎
Evilginx currently sets Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true, this is invalid as pointed out here.

On top of that, Evilginx also strips the CSP header, this is overly agressive and can affect campaign opsec as mentioned here.

The solution

‎
This is why I have come save y’all once again with this mod which is an adaptation of “physics-sec” mod (the guy on the comments), tho his mod was from 2.4.0 and my mod has been adapted to 3.3.0 and mine completely works just as his (I already tested).

Cheers!

2 Likes
2

so only hader fixes ? anyting else ?

3

I enjoyed reading trough you’re source code modifications, you seem to strip “X-Evilginx”from the request headers being sent. Did you inspect the outgoing traffic from EvilGinx then placed this string in there. I am curious why not remove it from where it’s being set within the outgoing req.

Anyway good changes I liked looking at m :slight_smile:

4

thanks bro kudos
thanks for research and help weldone

1 Like