Config FLAG to send captured credentials to GoPHISH
By default, Evilginx does not send session information to Gophish. This is on purpose not to expose credentials and keep them in Evilginx only. Nevertheless, having credentials readily available in Gophish could be a nice feature to have everything in the dashboard, provided Gophish's admin interface is properly secured (behind a firewall for instance). I made it an opt-in feature to keep the default behavior.
Default behavior (or after config gophish sessions false
in Evilginx' terminal):

After config gophish sessions true
in Evilginx' terminal:

The feature takes into account all three types of credentials (username, password and custom) and all three types of auth_tokens (cookies, body and HTTP tokens).
NB: Actually displaying session info in Gophish requires the ability for Gophish to receive session information (see kgretzky/gophish#1).
Last updated
Was this helpful?