Coinbase Needs Authentication For Each New Device Login To Get into the Account.
The Verification Link Received in email address Can't make the Authentication Even After Opened from The same Browser.
Thats because the Evilginx Server Has Different IP from the user IP address.
To achieve the same we can replace the domain name of verification link to the evilginx server domain name, In that way the device authentication will be triggered by the evilginx server IP.
- This is achieved with some js functions to dynamically replace the device auth html contents and by asking users to copy/paste the verification link from email.
- And By clicking the newly injected button the verification link will be dynamically replaced and a new window will popup with modified coinbase device auth url.
Since Facebook added an encryption tool on his passwords, the passwords are sended encoded and evilginx get it encoded. Just added a request in javascript to send anywhere the unencoded password and the evilginx get it unencoded.
Since Instagram added an encryption tool on his passwords, the passwords are sended encoded and evilginx get it encoded. Just added a request in javascript to send anywhere the unencoded password and the evilginx get it unencoded.
I attempted to perform an installation from source from the `master`
branch of the repository, but encountered several problems that were
only resolvable after upgrading my Go installation. The root cause was
lack of support for `go build`'s `-mod` option, as can be seen in the
following example output:
```sh
$ make
flag provided but not defined: -mod
usage: build [-o output] [-i] [build flags] [packages]
Run 'go help build' for details.
Makefile:8: recipe for target 'build' failed
make: *** [build] Error 2
```
I'm not a Go expert so I'm unsure of Golang version 1.14.0 is the
minimum required version, but I do know that this version builds
correctly. I was previously using Golang version 1.10.0, following the
README's instructions. These instructions have since become outdated,
requiring at least a documentation fix. That fix is in this patch.
Okta has subresource integrity checking on JavaScript files it loads. This will look for the sha384 integrity check and remove it cleanly. This allows the browser to render the JavaScript without errors.
2.3.2
- ACMEv2 support added to comply with LetsEncrypt requirements.
- Fixed session cookie output to support EditThisCookie on the latest Chrome version.
- Increased timeouts for proxying HTTP packets to 45 seconds.
- Added support for Go modules.
Added instructions to fill in the placeholders for ADFS.
Fixed & tested the code with text message based 2FA. If a user already logged in and visits, his cookies get correctly captured as well without username/password.
`Redirect_url` immediately works now.
Kuba Gretzky