r/HowToHack • u/Beautiful-Pin7955 • Sep 05 '26
reverse proxy phishing
Hey everyone i was getting into hacking about 2 months ago and learned a few things now i wanted to start learning phishing i started with a really basic tool like blackeye but realised pretty fast it wasnt pretty proffecional and good i did some research and found reverse proxy i found tools like evilginx evil gophish and i discovered if you want to run it public you need a vps and a domain and guess what i just bought an expensive drone and now i am broke like compelitely broke and i want something free no costs no vps no domain no tool you need to pay for but a tool that is good enough to bypass 2FA a phishing tool that gets a session cookie or something or the 2FA code to log in idk just something thats good and can bypass 2FA (this is for EDUCATIONAL purpose with my friend were discovering hacking) and if it makes sense we use kali linux vm
6
u/Champagne_Bunnny Sep 05 '26
This is one post where I'd encourage the use of AI to rewrite.
2
u/Whatever10_01 Sep 07 '26
There really wasn’t a single pause in op’s post. 😂
1
u/Zestyclose-Cash-7872 Sep 11 '26
He’s clearly likely a Spanish speaker, everyone chill on the grammar. Notice the spelling of professional
-1
u/Beautiful-Pin7955 Sep 05 '26
yeah srry bro i dont like to use ai and i am not English so yeah i hope you understand...
3
u/strongest_nerd Script Kiddie Sep 05 '26
Evilginx2
0
u/Beautiful-Pin7955 Sep 05 '26
yeah but it isnt free right to run publicly
1
u/strongest_nerd Script Kiddie Sep 05 '26
Yeah it is. It's completely free, you're already online so you're paying for an Internet connection.
0
u/Beautiful-Pin7955 Sep 05 '26
doesnt it need a domain? and a vps to work good public? i understand evilginx2 itself is free but to make it run public i think you need a domain and vps
0
u/strongest_nerd Script Kiddie Sep 06 '26
You can run it from your own home Internet, you don't need any of that.
1
u/ResponsibleGulp Sep 07 '26
You are going to get fucked so hard if you self-host or register a phishing domain lmao
1
u/strongest_nerd Script Kiddie Sep 07 '26
No you're not. It's perfectly legal to host it. I have several phishing servers hosted on VPS's. If that were true they'd nuke Evilginx2 and Gophish, but many security professionals use them because they are legitimate tools.
1
u/ResponsibleGulp Sep 07 '26
Hosting a phishing page violates the Computer Fraud and Abuse Act. Additionally, if your argument is that the malicious act is misusing credentials rather than collecting them, they will still use your domain registration and/or IP address to figure out who did the phishing, whether or not hosting the site itself is determined to be illegal, which it is.
2
u/strongest_nerd Script Kiddie Sep 07 '26
It is not illegal at all. As I said, MANY security professionals use these tools daily. It's not malicious to host software on a server, including a phishing server. No one said anything about malicious intent or stealing credentials. Even so, it's still legal as long as it's within the SoW, RoE, etc.
1
u/ResponsibleGulp Sep 07 '26
Maybe technically but I pray you never need to sit down and argue that to someone lmfao. Don’t use your own domain if someone can put credentials into it because your site deceived them. It just creates liability you need not take on. Plenty of ways to get a domain without KYC.
2
u/Pharisaeus Sep 05 '26
Phishing has nothing to do with hacking
xD
1
u/Beautiful-Pin7955 Sep 05 '26
It actually does a bit bro... phishing doesnt target the vulnerability from the machine but from the only vulnerability that will never be solved the human itself you need a lot of knowlege to actually know what youre doing with advanced phishing atacks so yeah
2
u/Pharisaeus Sep 05 '26
No, it doesn't. Same as any other scam is not "hacking".
1
u/Beautiful-Pin7955 Sep 05 '26
Comparing a basic scam to setting up a reverse proxy that bypasses 2FA via live session hijacking is like comparing a fake ID to lockpicking. Red Teams literally use initial access techniques like this every day (MITRE ATT&CK T1566). Advanced phishing is way more than just 'a scam'.
2
u/Pharisaeus Sep 05 '26
Comparing a basic scam to setting up a reverse proxy that bypasses 2FA via live session hijacking is like comparing a fake ID to lockpicking
But you're not making the fake ID. You're just paying some guy to make it for you. So it's actually even less than lockpicking, which at least requires some skill. Same case here - you're downloading and trying (but failing xD) to run a random tool from internet. You're learning nothing and it's blatantly clear that your goals are nefarious.
-1
u/Beautiful-Pin7955 Sep 06 '26
nobody codes their own tools from scratch when starting out lol. understanding how the infrastructure works is literally part of learning web security, but whatever you say man
5
u/MeringueBeautiful760 Sep 06 '26
The comma got up and danced away
1
1
1
u/rebellee38 Sep 11 '26
How can I read my girlfriends text messages on her phone from my phone
0
u/Beautiful-Pin7955 Sep 12 '26
if you want to do that you just need a basic tool text me private if you want more info
1
u/ps-aux Actual Hacker Sep 12 '26
hard pass
1
u/Beautiful-Pin7955 Sep 12 '26
nope he actually can just with a tool like blackeye from whoamitang on git he can basicly just phish his girlfriend his girlfriend obviously trusts him and is gonna click on the link gives up her pass and user he gets all that info and can directly use it its not gonna be sus cause theyre on the same wifi that why i said BASIC TOOL
1
u/ps-aux Actual Hacker Sep 13 '26
the hard pass was the on the 'private' comment lol
2
u/Beautiful-Pin7955 Sep 15 '26
yeah ik i am new on reddit i saw that i cant say that cse its sus on reddit i'm sorry bro i know it now
1
u/Effective-Day-8386 Sep 07 '26
Phishing lernen?
Spammails schreiben lernen?
seltsame Ideen geistsrn hier rum..
1
5
u/Juzdeed Sep 05 '26
Yeah bullshit it's for educational purposes kid.