Outpost24 provides a short glance behind the scenes of a Social Engineering assessment with Gophish and Evilginx.
One important aspect is finding a suitable domain, for example with typo generators like urlcrazy or by picking up an expired domain that still has a good reputation.
Also, modifying the utilized security tools is a good idea to not immediately alert the SOC: rename the X-Gophish headers, change the server name and strip the X-Evilginx header.
A header that literally says “Gophish” is a bit of a giveaway.
Sprocket Security had already shown in 2021 that a stock Gophish install also fingerprints itself through its rid parameter and its 404 page.
Real attackers use the same tooling: Microsoft described an AiTM phishing campaign that went after more than 10,000 organizations since September 2021 with Evilginx2 as its infrastructure, stealing session cookies to get past MFA.
