Evilginx Captures on the Timeline, and Sessions Ready for Your Browser

On a phishing engagement, the evidence ends up in several places. The captured passwords sit in an Evilginx database, the session cookies are in a terminal you copied them out of, and the timeline is whatever you remember. Writing it up means putting those pieces back together after the campaign ends.

The Neuron CLI now follows an Evilginx server and records each capture on the engagement as it happens. Captured sign-in sessions are stored as their own kind of credential, ready to load into a browser.

Follow Evilginx From Your Laptop

Run neuron collector evilginx and the collector follows Evilginx for as long as it runs. Each victim who signs in through a phishlet becomes a Credential Capture event on the engagement’s Events timeline, with the username and password they entered. When Evilginx captures the session cookies, a Session Capture event follows, linked to that same credential.

Evilginx has no API, so the collector reads its data file, ~/.evilginx/data.db by default. Pass --db for another path, such as /root/.evilginx/data.db when Evilginx runs as root.

Your phishing server is rarely the machine you’re sitting at. Put --ssh and the host straight after neuron, as you would for any other command:

neuron --ssh jumpbox collector evilginx --db /root/.evilginx/data.db

The CLI reads the data file on that box over your own SSH, and --db names the file there. Collectors need the Red Team module on your Neuron server.

A Session Is a Credential

An adversary-in-the-middle proxy captures more than what the person typed. It lifts the cookies their sign-in produced, and those cookies are a working session. Whoever holds them is signed in without knowing the password and without passing MFA.

Neuron now stores them as a Session credential, encrypted like a password. A capture that has only the username and password so far appears as a Web credential, then becomes a Session once Evilginx lifts the cookies. On the Credentials page, a cookie icon beside the type shows which accounts you hold a live session for, and each one carries Evilginx as its source.

Open one and the Secret section shows a Captured session panel:

• How many cookies across how many domains, and when the session expires, or Unknown when the capture didn’t record it.
• Each cookie’s domain, name and flags, with the value hidden until you choose Reveal values. Each value is then click-to-copy.
• Download cookies saves the jar as a JSON file that the Cookie-Editor and StorageAce browser extensions import, the same format Evilginx exports. Copy for Cookie-Editor puts the same JSON on your clipboard.

A cookie file with an unknown expiry is dated a year out, so the browser keeps the cookies when it restarts.

Sessions don’t have to come from the collector. Choose Session as the credential type when you add one by hand, and paste a cookie export from Cookie-Editor, StorageAce or Evilginx into Session tokens.

Findings That Never Carry the Cookies

Raise a finding from the capture events and the evidence describes the session without handing it over. It says an authenticated session was captured, for which site and until when, along with the account, its privilege and how it was obtained. The session token itself is never included.

Export Credentials works the same way. It includes each session’s expiry but not its cookies, which you download from the credential’s own page.

Start a Collector Without Leaving the Shell

If you’re already in the recording shell on the box, you don’t need a second terminal. Type :collector evilginx, or :collector mythic with its arguments for a Mythic operation. The collector runs against that box over the session’s own SSH connection, so it never asks you to log in again, and your prompt comes straight back while it runs in the background.

If the collector stops on its own, the shell tells you at your next prompt. Leaving the shell stops it. neuron collector list shows the collectors running on the machine, and neuron collector stop with a collector’s name stops one.

A Quieter Timeline

The recording shell now leaves housekeeping off the timeline too. Under Admin Center > System Settings > App Settings, Recording Shell Logging lists the commands that never reach Events, starting with clear, reset, exit and logout. Add your own, or use Restore Defaults to put the starting list back.

A line that chains, pipes or redirects, such as history | grep pass, is always logged. So is any command that adds a host, credential or file to the engagement.

What This Means for Your Team

Phishing work now lands in the same record as the rest of the engagement. Each capture reaches the timeline as it happens, each live session is a download away from a browser, and the finding that reports it is written without a secret in it.

If you’d like to see the Evilginx collector in action, visit neuron.ws/demo

Thanks for reading,
The PenTest.WS Development Team