EvilChromium (Automate Session Replay)

Evilginx
,
1

These commands are run in local machine beforehand:

sudo apt update
sudo apt install chromium-browser xdotool dns2socks iptables
ssh -Y -L 22:localhost:22 user@your_vps_ip

When tokens are captured:

  1. It gets the latest tokens similar to how @Fluxxset did it here.
  2. It exports extracted tokens to local machine via SFTP
  3. It gets Evilginx’s proxy configuration
  4. It applies Evilginx’s proxy configuration to the automation file (later exported to local machine) so that Chromium runs on same proxy as Evilginx
  5. It writes automation file to /tmp/ in the VPS, then exports it to local machine, after that it executes the file from VPS
  6. After all this, it will switch Evilginx proxy (from a predefined list by the user) so that new users authenticate from fresh IPs

EXTRA:

  • Local machine’s IP will never be leaked to Chromium given the network stealth.
  • Chromium is never launched in VPS!.
  • Chromium is never launched in headless mode!.
  • If 250 links are sent every 5 minutes, users have a 15% chance of overlapping within the 1-minute interaction. Sending every 10 minutes lowers overlap to 8%, assuming a 65% chance of opening within the 5/10 min and 35% outside the 5/10 min.
  • To evade the 15% chance of error I need to add some logic to constantly guard whether two users are active, if so.. Kali workspace logic has to be modified as well as SwitchProxy logic
1 Like
2

can u list down all benifits over traditional method and drawbacks

3

Traditional method: Typically, cookies with a short (10–20 min) lifetime are extracted manually from Evilginx and replayed on a local machine or RDP. Is this the traditional method you refer to?

Advantages of this EvilChromium:

  • Expired cookies cannot be reused (right? I really don’t know), so automation ensures timely replay.
  • The tool assigns each session to a different proxy, automatically switching from a predefined list once authentication is captured and replayed.
  • All sessions (Chromium profiles) are stored in a folder (witht their IP [the proxy IP] as the Chromium session name).
4

@Ramos_Milkovich what is the benefit of utilising a pre-defined proxy-list, I assume you utilise residential proxy I.P’s to hide originating request from EvilGinx server. Atough I would go for mullvadVPN connection. I understand if mullvad is blacklisted on a site to utilise proxy’s.

But if a high anonymity VPN like mullvad is available to connect to site, why not utilise that. It would also make you less identifiable. A proxy subnet and fingerprint can be (more) easily figured out and tracked.

I am just curious :slight_smile: