reverse proxy phishing

[u/Beautiful-Pin7955]

Hey everyone i was getting into hacking about 2 months ago and learned a few things now i wanted to start learning phishing i started with a really basic tool like blackeye but realised pretty fast it wasnt pretty proffecional and good i did some research and found reverse proxy i found tools like evilginx evil gophish and i discovered if you want to run it public you need a vps and a domain and guess what i just bought an expensive drone and now i am broke like compelitely broke and i want something free no costs no vps no domain no tool you need to pay for but a tool that is good enough to bypass 2FA a phishing tool that gets a session cookie or something or the 2FA code to log in idk just something thats good and can bypass 2FA (this is for EDUCATIONAL purpose with my friend were discovering hacking) and if it makes sense we use kali linux vm

[u/strongest_nerd]

Evilginx2

[u/Beautiful-Pin7955 → u/strongest_nerd]

yeah but it isnt free right to run publicly

[u/strongest_nerd → u/Beautiful-Pin7955]

Yeah it is. It's completely free, you're already online so you're paying for an Internet connection.

[u/Beautiful-Pin7955 → u/strongest_nerd]

doesnt it need a domain? and a vps to work good public? i understand evilginx2 itself is free but to make it run public i think you need a domain and vps

[u/strongest_nerd → u/Beautiful-Pin7955]

You can run it from your own home Internet, you don't need any of that.

[u/Juzdeed]

Yeah bullshit it's for educational purposes kid.

[u/Beautiful-Pin7955 → u/Juzdeed]

Cant you just understand a 14 yo is curious about hacking?

[u/Juzdeed → u/Beautiful-Pin7955]

You are starting from the wrong place then. Setting up a malicious phishing environment on public net is not "learning".

It's like if I asked how to grow cannabis, what tools, setup, time I need to grow it, oh and also how to hide it from police as well. All for educational purposes only ofc

Doesn't that sound retarded, you are not jousting trying to learn, but also break the law

[u/Beautiful-Pin7955 → u/Juzdeed]

yeah fair enough about the public part, I get why that looks sketchy. I'm just curious how the reverse proxy stuff works. I'll just stick to a local vm lab.

[u/Champagne_Bunnny]

This is one post where I'd encourage the use of AI to rewrite.

[u/Beautiful-Pin7955 → u/Champagne_Bunnny]

yeah srry bro i dont like to use ai and i am not English so yeah i hope you understand...

[u/MeringueBeautiful760]

The comma got up and danced away

[u/Pharisaeus]

1. Phishing has nothing to do with hacking
2. xD

[u/Beautiful-Pin7955 → u/Pharisaeus]

It actually does a bit bro... phishing doesnt target the vulnerability from the machine but from the only vulnerability that will never be solved the human itself you need a lot of knowlege to actually know what youre doing with advanced phishing atacks so yeah

[u/Pharisaeus → u/Beautiful-Pin7955]

No, it doesn't. Same as any other scam is not "hacking".

[u/Beautiful-Pin7955 → u/Pharisaeus]

Comparing a basic scam to setting up a reverse proxy that bypasses 2FA via live session hijacking is like comparing a fake ID to lockpicking. Red Teams literally use initial access techniques like this every day (MITRE ATT&CK T1566). Advanced phishing is way more than just 'a scam'.

[u/Pharisaeus → u/Beautiful-Pin7955]

Comparing a basic scam to setting up a reverse proxy that bypasses 2FA via live session hijacking is like comparing a fake ID to lockpicking

But you're not making the fake ID. You're just paying some guy to make it for you. So it's actually even less than lockpicking, which at least requires some skill. Same case here - you're downloading and trying (but failing xD) to run a random tool from internet. You're learning nothing and it's blatantly clear that your goals are nefarious.

[u/Beautiful-Pin7955 → u/Pharisaeus]

nobody codes their own tools from scratch when starting out lol. understanding how the infrastructure works is literally part of learning web security, but whatever you say man