Fix for force_post to allow interception without evilginx session

[stephenbradshaw]

This is a fix for an issue where EvilGinx will not do force_post replacement for requests to a phished domain if cookies (in particular the EvilGinx session cookie) are not included with the request. This is breaking proper interception of authentication flows where for example part of the process has a request made using JavaScript without adding cookies.

An example affected issue is here:

https://github.com/kgretzky/evilginx2/issues/1031

Have fixed by moving the existing force_post code into its own if branch that does not check for a evilginx session and adding a requirement for the request method to be "POST" - figured that since force_post has its own fairly specific conditions for matching requests that the session requirement can be overlooked

[n3rada]

It works like a charm with this. Let's go merging this @kgretzky.

[stephenbradshaw]

I will point out here that responses to the POST don't get captured by EvilGinx if they happen to have any authentication tokens even with this fix because of the missing session cookie. So if thats important to you, you might need to instead do some modification of whatever client side JavaScript code is generating the POST to include cookies so that things work as expected with EvilGinx sessions.

[n3rada]

My use case was to modify one of the keys of an outgoing POST request. Thanks for mentioning it though.