A successful build leaves assessment readiness unresolved
Evilginx built in our sandbox, but its test command reported zero tests. That is the most useful starting point for evaluating this security tool: the repository cleared its recorded build step without supplying automated test results that establish its assessment behavior.
The repository is named evilginx2, while its README presents Evilginx 3.0. It describes a Go application that acts between a browser and a website, intercepting login credentials and session cookies. This review addresses the public repository for authorized security assessment. The README restricts use to legitimate penetration testing with written permission from the affected parties.
For an assessor, the attraction is a way to examine the risk of intercepted authenticated sessions. For an awareness-training team, that capability may exceed the question the exercise needs to answer. Decide which behavior the engagement must evaluate before choosing this framework.
What happened when we ran it
Our November 8, 2026 sandbox run installed Evilginx in 8 seconds and built it in 27 seconds. The test step completed successfully in 5 seconds, with Go reporting 0 passed, 0 failed and 0 total. A successful command with no tests provides no passing-test evidence for login handling or session interception.
We measured commit 4c0988a. The checkout contained 41 files, approximately 8,220 source lines and 0.6 MB. The record lists 0 dependencies recorded. That is a property of the supplied record, not proof that the application has no external code or operating requirements. The scan found no CI workflow files, no Dockerfile and no tests directory.
The recorded sandbox configuration specified 3 CPUs, 8 GB RAM and image golang:1.24-bookworm. Those settings do not establish the effective Go or operating-system version. Raw toolchain logs would be needed to identify them. We have no measured assessment session, target-compatibility result or security audit from this run.
The narrow conclusion is still useful. Source setup and compilation completed at this commit, so there is no observed build failure to diagnose. The next evaluation must address the authorized workflow itself. An empty test result cannot substitute for that evaluation, however short the build was.
Phishlet support has an explicit limit
The README says the maintainer does not provide or create phishlets and will not help users create their own. These site-specific configurations are therefore a support responsibility you must account for before adopting the public tool. The README directs readers to configurations provided by other people.
That is a concrete reason to walk away if your team needs maintained target configurations as part of the free project. An available configuration is also separate from evidence that it works for the application and authentication policy covered by your engagement. Our sandbox run didn't assess either. Budget for evaluating that fit within written authorization, or choose a tool matching a narrower training objective.
The application implements its own HTTP and DNS servers, according to the README. Its release history also discusses TLS certificate handling. A compiled binary therefore leaves network and certificate configuration to resolve. There is no verified deployment checklist or operating-system compatibility matrix in our lab evidence.
The Pro feature list belongs to a separate product
The public README advertises Evilginx Pro and labels its feature list accordingly. That list includes a maintained official phishlet database and automated server deployment. Those advertised features should not silently become reasons to recommend the public repository.
The distinction matters most for a buyer expecting ongoing help with site-specific behavior. The public README's refusal of phishlet support remains explicit even beside the Pro advertisement. Assess the repository on what its public documentation promises, then evaluate any commercial offer separately. This review contains no trial of Pro and no claim about its effectiveness.
The README also points to a custom Gophish fork for its official integration. If that integration is essential, review the named fork and its compatibility separately. Reading the upstream Gophish feature list does not verify the integrated workflow, and our run didn't exercise it.
Recent activity does not prove prompt support
GitHub reports a last push of June 10, 2026. The fetched issue-and-PR feed includes a hostname-handling proposal updated September 25. The latest-release endpoint returns v3.3.0, published April 2, 2024. Taken together, these records show a newer push and later discussion than the release tag alone would suggest. They don't establish abandonment or a reliable support schedule.
The repository metadata lists 267 open issues and PRs combined. That figure doesn't tell you how many are confirmed defects. Nor does a proposed change prove that its reported behavior persists in the measured commit. Our recommendation rests on the documented support boundary and recorded test gap, without turning an unverified report into a reproduced bug.
Gophish and mitmproxy fit narrower questions
Gophish is designed for phishing engagements and security awareness training. Compare it when the exercise is about employee response and training rather than evaluating intercepted authenticated sessions. That is a choice of objective, without a measured claim that Gophish is easier or safer.
mitmproxy is an interactive intercepting proxy with HTTP and WebSocket support. Compare it when you need to inspect authorized application traffic. It answers a debugging question rather than supplying the same assessment workflow. Neither alternative was run alongside Evilginx for this review.
The ratings stop at the evidence boundary
The editorial scale runs from 1 for major demonstrated obstacles, through 3 for a usable route with material limits, to 5 for broad independent validation. Setup earns 3 for completed repository steps with deployment unverified. Documentation earns 3 for clear product and support boundaries with external usage documentation. Maturity earns 2 because the recorded test step exercised no tests and the scan found no CI workflows. Community is unassessed because feed activity doesn't establish response quality.
Choose Evilginx only when the authorized assessment needs session-interception behavior and your team can own configuration validation. If the intended outcome is awareness training, start by evaluating whether Gophish already answers the engagement's question.