# EvilChromium (Automate Session Replay) **URL:** \ **Category:** Evilginx\ **Tags:** evilginx, source-code\ **Created:** [August 20, 2025, 11:25am UTC](http://fluxxset.com/t/evilchromium-automate-session-replay/1610 "2025-08-20T11:25:26Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Ramos\_Milkovich](http://fluxxset.com/letter_avatar_proxy/v4/letter/r/b5e925/32.png) [@Ramos\_Milkovich](http://fluxxset.com/u/Ramos_Milkovich)\ **Post date:** [August 20, 2025, 11:25am UTC](http://fluxxset.com/t/evilchromium-automate-session-replay/1610/1 "2025-08-20T11:25:26Z")
> [These commands](https://github.com/kgretzky/evilginx2/pull/1192#issue-3332828556) are run in **local machine** beforehand: ```auto sudo apt update sudo apt install chromium-browser xdotool dns2socks iptables ssh -Y -L 22:localhost:22 user@your_vps_ip ``` > When [tokens are captured](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-81f0ab19f6761fabec8b93df594d33a483593bd5be528808ea5e0a7378ba46d1R1058): 1. [It](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R90) gets the latest tokens similar to how @Fluxxset did it [here](https://github.com/kgretzky/evilginx2/compare/master...fluxxset:evilginx2:master#diff-cd28f28ff45f3f2ea674630c4077ebda6169d14946f3babf5d5ff5f1b885b36eR44). 2. [It exports](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R35) extracted tokens to local machine [via SFTP](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R107) 3. [It](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R185) gets Evilginx’s proxy configuration 4. [It](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R229) applies Evilginx’s proxy configuration to the [automation file](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R220) (later exported to local machine) so that [Chromium runs on same proxy as Evilginx](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R265) 5. It writes [automation file](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R220) to `/tmp/` in the VPS, then [exports it](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R143) to local machine, after that it executes the file from VPS 6. After all this, it will [switch Evilginx proxy](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R56) (from a [predefined list](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R355) by the user) so that new users authenticate from fresh IPs > EXTRA: - Local machine’s IP will never be leaked to Chromium given the [network stealth](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R256). - **Chromium is never launched in VPS!.** - **Chromium is never launched in headless mode!.** - If 250 links are sent every 5 minutes, users have a 15% chance of overlapping within the 1-minute interaction. Sending every 10 minutes lowers overlap to 8%, assuming a 65% chance of opening within the 5/10 min and 35% outside the 5/10 min. - To evade the 15% chance of error I need to add some logic to constantly guard whether two users are active, if so.. [Kali workspace logic](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R222) has to be modified as well as [SwitchProxy logic](https://github.com/kgretzky/evilginx2/pull/1192/commits/3b0410e02ec7dba408f76bde600987906a247e2b#diff-e7d2f417973acf27f0f23ee7f49975669180d6d8d2afc4411d81f4daeaeb7fe4R353) ---
**Author:** ![fluxxset](http://fluxxset.com/user_avatar/fluxxset.com/fluxxset/32/20_2.png) [@fluxxset](http://fluxxset.com/u/fluxxset)\ **Post date:** [August 20, 2025, 11:29am UTC](http://fluxxset.com/t/evilchromium-automate-session-replay/1610/2 "2025-08-20T11:29:15Z")
can u list down all benifits over traditional method and drawbacks ---
**Author:** ![Ramos\_Milkovich](http://fluxxset.com/letter_avatar_proxy/v4/letter/r/b5e925/32.png) [@Ramos\_Milkovich](http://fluxxset.com/u/Ramos_Milkovich)\ **Post date:** [August 21, 2025, 2:55am UTC](http://fluxxset.com/t/evilchromium-automate-session-replay/1610/3 "2025-08-21T02:55:46Z")
**Traditional method:** Typically, cookies with a short (10–20 min) lifetime are extracted manually from Evilginx and replayed on a local machine or RDP. **Is this the traditional method you refer to?** **Advantages of this EvilChromium:** - Expired cookies cannot be reused **(right? I really don’t know)**, so automation ensures timely replay. - The tool assigns each session to a different proxy, automatically switching from a predefined list once authentication is captured and replayed. - All sessions (Chromium profiles) are stored in a folder (witht their IP [the proxy IP] as the Chromium session name). ---
**Author:** ![Ynot](http://fluxxset.com/letter_avatar_proxy/v4/letter/y/a698b9/32.png) [@Ynot](http://fluxxset.com/u/Ynot)\ **Post date:** [August 24, 2025, 4:40am UTC](http://fluxxset.com/t/evilchromium-automate-session-replay/1610/4 "2025-08-24T04:40:15Z")
@Ramos_Milkovich what is the benefit of utilising a pre-defined proxy-list, I assume you utilise residential proxy I.P’s to hide originating request from EvilGinx server. Atough I would go for `mullvadVPN` connection. I understand if `mullvad` is blacklisted on a site to utilise proxy’s. But if a high anonymity VPN like mullvad is available to connect to site, why not utilise that. It would also make you less identifiable. A proxy subnet and fingerprint can be (more) easily figured out and tracked. I am just curious 🙂