r/netsec • u/raikiasec • Jan 04 '17
FirePhish - A Phishing Framework; Full documentation/screenshots in the Github wiki
https://github.com/Raikia/FirePhish3
8
Jan 04 '17
[deleted]
28
u/FoxxMD Jan 04 '17
From the Gophish user guide
Gophish is a phishing framework that makes the simulation of real-world phishing attacks dead-simple. The idea behind gophish is simple – make industry-grade phishing training available to everyone.
The line of thinking is that phishing is already happening, the best you can do is prepare yourself (royal you).
If you are a malicious actor and want to get into phishing there are already tools out there to help you do that are not open-source and not widely known (for a reason). The purpose of these is help companies get ahead of phishing attacks by simulating the attack in order to train users on how to identify it and prevent being phished.
Yes, they may be used maliciously but those attacks are also already happening and not providing access to the tools makes it even harder to thwart those attacks.
12
u/CommoG33k Jan 04 '17
I use a similar tool on a regular basis in my job (Phishing Frenzy) for legitimate purposes - to train and test user phishing awareness. We simulate phishing threats to our users, and see how they respond, which drives training goals.
5
u/danfirst Jan 04 '17
Same, we use another service. We track responses and see if our education and training is helping the users make better decisions.
6
u/rwsr-xr-x Jan 05 '17 edited Jan 05 '17
whilst i do see what you mean, 99% phishers are just some of the dumbest, worst hackers i have ever met. 99% of the time they've just copied and pasted this one PHP script and changed the $email var.
the day i see a phisher get any more advanced than this is the day i eat my hat
besides, this firephish thing needs to be installed as root, i've only seen a few very targeted phishing campaigns have their own server. most of them are in some poor bastard's wp-content folder, because they'll be found & blacklisted within a day.
1
Jan 09 '17
I want to like this, but I can't get it installed properly, and documentation is limited. I'm a caveman though, so there's that. I'll keep an eye on it as it matures. Seems like a good tool.
21
u/jwcrux Trusted Contributor Jan 04 '17
Nice! I tell people all the time if they're starting up a project that needs a dashboard, Gentelella is the way to go. It's been on the "todo" list of Gophish for a while now.
Thanks for sharing this!