# EvilPUPPET

The <mark style="color:$primary;">EvilPUPPET</mark> course equips participants with advanced skills in leveraging <mark style="color:$primary;">EvilPUPPET</mark> , a Node.js-based MITM proxy using Puppeteer for real-time phishing, session hijacking, and corporate reconnaissance. The course emphasizes stealth, automation, and bypassing modern defenses, covering the following key aspects:

1. **Deployment**\
   Participants will explore <mark style="color:$primary;">EvilPUPPET</mark> architecture and functionality. The module covers cloning the repository, installing Node.js and dependencies, and configuring `config.js` (target URL, port, SSL certificates).&#x20;
2. **Modifications and Improvements of** <mark style="color:$primary;">EvilPUPPET</mark> **\[EXPANDED MODULE]**\
   This module dives deep into customizing <mark style="color:$primary;">EvilPUPPET</mark> through source code modifications, performance optimization, and new feature integration. Will address limitations (e.g., text field syncing, iframe issues) and enhance Puppeteer integration for advanced attacks. Key topics include:
   * <mark style="color:green;">Auto-Creds Logger</mark>: Real-time capture of login credentials from POST requests.
   * <mark style="color:green;">2FA Push Replay</mark>: Intercepts OTP/push tokens for bypassing two-factor authentication.
   * <mark style="color:green;">Canvas Fingerprint Spoof</mark>: Alters canvas data to evade Cloudflare fingerprinting.
   * <mark style="color:green;">Auto-Screenshot Scheduler</mark>: Captures screenshots every 3 seconds for reconnaissance.
   * <mark style="color:green;">Dynamic User-Agent Spoofing</mark>: Randomizes User-Agents to mimic legitimate browsers.
   * <mark style="color:green;">Real-Time Keystroke Logger</mark>: Logs all keystrokes on phishing pages.
   * <mark style="color:green;">Automated Form Filler</mark>: Auto-populates forms to accelerate testing.
   * <mark style="color:green;">Session Cookie Exfiltration</mark>: Steals cookies post-authentication.
   * <mark style="color:green;">Geo-Spoofing</mark>: Fakes geolocation to bypass regional restrictions.
   * <mark style="color:green;">WebRTC Fingerprint Spoofing</mark>: Disables or spoofs WebRTC to avoid fingerprinting.
   * <mark style="color:green;">Input Validation Bypass</mark>: Removes client-side form validation (e.g., regex).
   * <mark style="color:green;">Dynamic DOM Manipulation</mark>: Injects hidden elements (e.g., fake buttons) for manipulation.
   * <mark style="color:green;">Screen Resolution Spoofing</mark>: Alters screen resolution to evade fingerprinting.
   * <mark style="color:green;">Session Timeout Extension</mark>: Simulates activity (scrolls/clicks) to extend sessions.
   * <mark style="color:green;">Font Fingerprint Spoofing</mark>: Spoofs font lists to bypass fingerprinting.
   * <mark style="color:green;">CSRF Token Harvesting</mark>: Captures CSRF tokens from forms.
   * <mark style="color:green;">Fake CAPTCHA Solver</mark>: Mimics CAPTCHA solutions to bypass checks.
   * <mark style="color:green;">Browser Plugin Spoofing</mark>: Fakes browser plugins to evade detection.
   * <mark style="color:green;">Data Exfiltration Scheduler</mark>: Periodically sends collected data (cookies, logs).
   * <mark style="color:green;">Configuring</mark>: <mark style="color:$primary;">EvilPUPPET</mark> parameters in <mark style="color:blue;">PHISHLETs</mark> + Custom PARM,
3. <mark style="color:orange;">Creating Professional Phishing Pages</mark>\
   Participants will craft phishing pages mimicking services like Microsoft or Salesforce, ensuring legitimacy to evade suspicion. The module covers integration with EvilGinx <mark style="color:red;">Pro</mark> <mark style="color:blue;">PHISHLETs</mark> and bypassing bot detection like CAPTCHA.
4. <mark style="color:orange;">Using Puppeteer for Automation</mark> **\[**<mark style="color:green;">NEW</mark>**]**\
   This section introduces Puppeteer for browser automation within <mark style="color:$primary;">EvilPUPPET</mark> . Participants will configure Puppeteer to automate interactions, capture real-time data (credentials, tokens), and streamline phishing workflows.
5. <mark style="color:orange;">Corporate Reconnaissance</mark>\
   Participants will master streaming corporate dashboards (e.g., Jira, CRM) via Puppeteer. The module includes <mark style="color:yellow;">GoPhish</mark> phishing campaigns ("Urgent task check!"), capturing user actions (scrolling, clicks, inputs), and extracting sensitive data (API keys, PII). MFA bypass via token replay is included.
6. <mark style="color:orange;">Session Hijacking</mark>\
   This module focuses on capturing cookies and JWTs through Puppeteer interactions. Participants will replay sessions for unauthorized access, bypassing 2FA (push/OTP), and gaining entry to banking or admin panels.
7. <mark style="color:orange;">Custom Phishing Configurations</mark>\
   Participants will create tailored setups in `config.js` and EvilGinx <mark style="color:blue;">PHISHLETs</mark> . Examples for popular services ensure adaptability and optimized user experience to avoid detection.
8. <mark style="color:orange;">Custom Anti-Fingerprinting Configurations</mark> **\[**<mark style="color:green;">NEW</mark>**]**\
   Participants will bypass browser fingerprinting by spoofing user-agents, canvas fingerprints, WebGL, and headers to mimic legitimate browsers. Techniques to evade Cloudflare and advanced bot detection are covered.
9. <mark style="color:orange;">Process Automation</mark> **\[**<mark style="color:green;">NEW</mark>**]**\
   Participants will automate phishing workflows using Puppeteer scripts for data harvesting, cron jobs for scheduling, and API integration for real-time processing. Automation of lure delivery and session replay is included.
10. <mark style="color:orange;">Evading Detection and Ensuring Anonymity</mark>\
    Participants will master stealth: zero disk footprint, HTTPS, domain fronting, VPNs/TOR, temporary domains, and proxies to hide infrastructure and minimize traces.
11. <mark style="color:orange;">Setting up</mark> <mark style="color:yellow;">GoPhish</mark> <mark style="color:orange;">for Campaign Management</mark>\
    Participants will install and configure <mark style="color:yellow;">GoPhish</mark> , integrating it with <mark style="color:$primary;">EvilPUPPET</mark> for large-scale phishing. The module covers campaign creation, multi-target management, and result analysis.
12. <mark style="color:orange;">**Advanced**</mark> <mark style="color:orange;"></mark><mark style="color:orange;">EvilPUPPET</mark> <mark style="color:orange;"></mark><mark style="color:orange;">**Modifications**</mark>**&#x20;\[**<mark style="color:green;">NEW MODULE</mark>**]**\
    This module explores cutting-edge customizations:
    * **Browser Language Spoofing**: Spoofs language settings to bypass localization checks.
    * **Automated Form Submission Detection**: Logs form submissions for additional data capture.
    * **Mouse Movement Mimicry**: Simulates natural mouse movements to evade behavioral analysis.
    * **Audio Fingerprint Spoofing**: Alters Web Audio API to bypass fingerprinting.
    * **Dynamic Redirect Injection**: Inserts hidden redirects to manipulate victim navigation.

<mark style="color:purple;">**Application for Training**</mark><mark style="color:purple;">:</mark>

* Telegram: @cfs0x
* Tox: 340EF1DCEEC5B395B9B45963F945C00238ADDEAC87C117F64F46206911474C61981D96420B72
* Pricing:
  * $200 / Basic \[ includes: training, recording, support ]
  * $400/ Premium \[ includes: training, <mark style="color:$primary;">EvilPUPPET</mark> Modifications, Puppeteer, Anti-Fingerprinting, Automation, <mark style="color:blue;">PHISHLETs</mark> , advanced modifications, support, recording ]


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://rproxylab.gitbook.io/evilginx-lab-by-cfs0x/getting-started/education/evilpuppet.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.