In this blog post, I demonstrate how to use an Adversary in The Middle (AiTM) phishing attack to capture a user’s session token utilising a tool called Evilginx. There are several methods to protect against such attacks and I will be concentrating on phishing resistant MFA.
IMPORTANT DISCLAIMER:
The user accounts involved are demo user’s. The information provided in this blog post is intended for educational and demonstration purposes only. Evilginx is a powerful tool that can be used to steal session tokens, which can lead to unauthorised access to user accounts. This tool should only be used for legitimate penetration testing on systems where you have explicit permission to do so. Unauthorised use of Evilginx or any similar tool is illegal and unethical, and can result in severe legal consequences. Always ensure you have proper authorisation before conducting any security testing.
What is Evilginx?
Evilginx is an advanced phishing framework that provides a way to bypass multi-factor authentication (MFA) protections by capturing session tokens. It operates as an Adversary-in-The-Middle (AiTM) proxy, intercepting communication between a victim and a legitimate service to steal authentication credentials and session tokens. Unlike traditional phishing attacks that trick user’s into divulging their passwords, Evilginx focuses on obtaining credentials and session tokens, enabling attackers to login without entering user credentials. This makes it a powerful tool for penetration testers and security researchers who need to assess the resilience of their systems against such sophisticated attacks, however, it can also be used by bad actors.
Here’s how it works in few steps:
- Attackers create fake login pages that look almost identical to legitimate ones, such as login pages for Microsoft, Google, Facebook and more.
- When user’s enter their credentials, Evilginx captures them and forwards them to the real site, making it seem like a normal login process.
- It can also intercept multi-factor authentication (MFA) codes, allowing attackers to gain unauthorised access.
This makes Evilginx particularly dangerous because of its capabilities to bypass security measures like MFA.
To protect yourself, always verify the URL of the login page, use phishing resistant MFA, and be cautious of unexpected login requests.
Let’s dig deeper and understand the process via the diagram below
How does Adversary-in-The-Middle (AiTM) take place using Evilginx
Click the image below to enlarge
Now, let’s see the process in action
Note: I’ve already installed and configured the Evilginx application.
Let’s explore how Evilginx can capture a user’s session token and gain access to data.
- I launch Evilginx on my server
2. I type:
lures create microsoft365
lures get-url 0
Click image to enlarge
3. I copy the fake url as shown in the image above. A malicious actor typically requires the user to click on this URL, often distributed through a phishing email.
For demonstration purposes, we’ll assume that the a real user has clicked the malicious link received through a phishing email.
I launch a browser and manually enter the URL of the fake login page.
Enlarge the image below.
Question: Can you spot anything suspicious in the image below?
In case you didn’t spot the suspicious detail, take a closer look at the website address, the letter ‘o’ in ‘micros’ has been replaced with a zero.
Bad actors often use cloned login pages that can appear convincing and legitimate. This highlights the importance of continuously educating ourselves and others about the risks of phishing attacks.
⚠️ WARNING: Please do not attempt to access the fake URL shown above on your own device.
4. Now, let’s assume the user proceeds to log in. For this demo, I’ll be using a test account:
- Demo Account:
[email protected] - This account is protected with multi-factor authentication (MFA) using the Microsoft Authenticator app. However, it’s important to note that I am not using phishing-resistant MFA.
I proceed to log in via the fake login page. Meanwhile, the Evilginx application is actively listening and capturing authentication logs in the background.
5. I click Next and am prompted to enter my password to authenticate with Microsoft Entra ID.
6. I enter my username and password, then click Sign in. I complete the MFA challenge via my Authenticator app when prompted. As mentioned earlier, this account does not currently use phishing-resistant MFA.
After logging in, I am briefly signed in before being automatically logged out. However, by this point, the Evilginx tool has already captured the necessary authentication information.
7. Let’s take a look at what Evilginx has captured.
8. At this point, I have successfully captured the user’s credentials, including the username and password, through the fake login page.
Evilginx has now captured the user’s session, including the MFA acceptance, a critical point in demonstrating how traditional MFA can be bypassed in such attacks. Let’s dig a little deeper.
9. I run the sessions command and can see that the username, password, and session token have all been successfully captured.
10. I type sessions 13 and press Enter to inspect the captured session in more detail.
11. The session token is now visible, this includes the full session data that Evilginx has intercepted, allowing an attacker to potentially hijack the authenticated session without needing the user’s credentials or MFA prompt again.
12. Next, I prepare to replay the stolen session token. I highlight and copy the token from the Evilginx output.
13. I’ve downloaded Firefox and installed a cookie editor extension to assist with injecting the session token.
14. I launch Firefox and navigate to https://office.com.
15. I click the Sign in button on office.com and am redirected to the official Microsoft login page.
16. I clear all existing cookies using the cookie editor extension.
17. Inside the cookie editor, I click the Import option and paste the stolen session cookie. I then click Import again.
18. The session cookie has now been loaded
19. I refresh the page, and I now have access.
20. I have access to the user’s apps.
21. I have access to the user’s data
22. I have access to the user’s mailbox
Phishing resistant MFA
Now, i’ll go through the same process again, but this time I’ve enabled phishing resistant MFA for the account [email protected]. I’ve used a passkey. If you’d like to learn more, check out this blog post: Part 1 – What is a FIDO2 key and How to Set One Up for Emergency Access in Entra ID | Cloud Build
- I return to the fake login page. I type my username and click Next, but instead of entering a password, I select the option: Use your face, fingerprint, PIN, or security key instead, as shown in the image below.
2. I’m prompted to use a security key, but this prompt is for the fake domain (login.micr0soft.com). My passkey is registered to the legitimate domain (login.microsoft.com), so authentication fails. As a result, Evilginx is unable to capture the session token.
No sessions saved by the Evilginx app
I hope this post was useful. Thanks for reading and see you at the next one.
