evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

goCabrito

goCabrito Super organized and flexible script for sending phishing campaigns. Features Sends to a single email Sends to lists of emails text Sends to lists emails with first, last name csv Supports attachments Splits emails in groups Delays sending emails between each group Support Tags to be...

king-phisher

King Phisher Phishing Campaign Toolkit King Phisher is no longer being maintained. Installation For instructions on how to install, please see the INSTALL.md file. After installing, for instructions on how to get started please see the wiki. Overview King Phisher is a tool for testing and promoti...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

RogueSliver

RogueSliver A suite of tools to disrupt campaigns using the Sliver C2 framework. This tool, its uses, and how it was created will be covered in depth on ACEResponder.com This tool is for educational purposes only. | ---|--- ExtractCerts.py| Extract mtls certificates and private keys from a minidu...

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

FiercePhish

FiercePhish FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more. The features will continue to be expanded and will include website spoofing, click tracking, and extensiv...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

Reel

Reel Phishing simulation and security awareness framework with configurable workflows, campaign management, and optional credential proxy. Quickstart OPS USE 1. Clone the repository and cd into it. 2. run ./deploy.sh - this will configure the pre-preqs for you, assuming you are on ubuntu. 3. Run...

operative-framework

operative framework is a digital investigation framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules. important The project has undergone a...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: MS Office HTML RCE with crafted documents On July 11, 2023, Microsoft released a patch aimed at addressing multiple actively exploited Remote Code Execution RCE vulnerabilities. This action also shed light on a phishing campaign orchestrated by a threat actor known as Storm-0978,...

Storm0978-RomCom-Campaign

Storm0978-RomCom-Campaign Recent Campaign abusing CVE-2023-36884 Disclaimer The code provided is offered as-is and is intended for educational or informational purposes only. The user assumes all responsibility for the use of this code and any consequences that may arise from its use. The creator...

EITest-tools-scripts-IOCs

IOCs Indicators of Compromise IOCs updated every 30 minutes related to EITest campaigns. The domain stat-dns.com used in EITest's DGA algorithmhas been sinkholed. As a result, the EITest campaign now appears to have been shutdown since 2018-03-15. backend-decipher.py Decodes data transmitted from...

Cartero

Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...

openclaw-security-monitor

OpenClaw セキュリティモニター OpenClaw デプロイメントに対するプロアクティブなセキュリティ監視、脅威スキャン、リアルタイム可視化を提供します。ClawHavoc キャンペーン（824以上の悪意のあるスキル）、AMOS スティーラー 、Vidar インフォスティーラー 、GhostSocks プロキシマルウェア、ClawJacked WebSocket ブルートフォース、ワークスペースプラグイン自動読み込み攻撃、共有認証スコープの権限昇格、承認リプレイ/整合性バイパス、サプライチェーン攻撃、メモリポイズニング、ログポイズニング、ブラウザリレーハイジャック、TAR...

Goreport

Goreport v3.0 - Gophish レポーティングツール このスクリプトは、Gophish キャンペーン ID をパラメータとして受け取り、キャンペーン結果を収集して統計を表示し、ユーザーエージェントの解析や IP アドレスのジオロケーション検索を実行します。Goreport は、IP アドレス、オペレーティングシステム、ブラウザの種類とバージョン、および場所のリストを、キャンペーン中にそれぞれが確認された回数とともに生成します。 統計に関する注意: Goreport はイベントの総数と、各イベントに参加したメール受信者の数を報告します。言い換えると、Gophish...

APT_REPORT

APTREPORT collected by @blackorbird https://x.com/blackorbird Interesting apt report & sample & malware & technology & intellegence collection APT Group for country Threat Actor Groups Tracked by Palo Alto Networks Unit 42...

gophish

Gophish Gophish: オープンソースのフィッシングツールキット Gophishは、企業やペネトレーションテスター向けに設計されたオープンソースのフィッシングツールキットです。フィッシング演習やセキュリティ意識向上トレーニングを迅速かつ簡単にセットアップして実行する機能を提供します。 インストール Gophishのインストールは非常に簡単です。お使いのシステム向けのリリースを含むzipファイルをダウンロードして解凍し、バイナリを実行するだけです。GophishはWindows、Mac、Linuxプラットフォーム向けのバイナリリリースを提供しています。 ソースからビルド...

FudgeC2

FudgeC2 FudgeC2 is a Powershell C2 platform designed to facilitate team collaboration and campaign timelining, released at BlackHat Arsenal USA 2019. This aims to help clients better understand red team activities by presenting them with more granular detail of adversarial techniques. Built on...

LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

Exploit Title: LetterPress CLICK THIS" in HTML Campaign Message input field and click on Save Campaign. 2. View the campaign and click on "CLICK THIS" hyperlink it will redirect to the 3rdparty site. Ex:evil.com...