Reel

Reel 用于网络钓鱼模拟和安全意识培训的框架，支持可配置工作流、活动管理以及可选凭据代理。 快速开始（运维用途） 1. 克隆仓库并 cd 进入目录。 2. 运行 ./deploy.sh — 假设你在 Ubuntu 上，该脚本会为你配置好所有前置依赖。 3. 运行 ./start.sh --preload-ml。这会启动服务器并预加载我们使用的 ML 模型。 你会获得 http://localhost:8000 上的管理后台 UI 和 http://localhost:1234 上的钓鱼服务器。默认登录：admin / admin123。首次登录后请修改密码。 通过 ssh 将 8000...

csaf

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as...

camjacking-templates

CamJacking CamJacking 是一个安全意识培训与模拟框架 ，旨在帮助组织在受控且经授权的环境中教育用户了解摄像头权限风险、浏览器安全和社会工程学意识。 🎯 什么是 CamJacking？ CamJacking 是一个面向企业的网络安全意识框架，用于在受控实验室环境中模拟真实的摄像头权限提示与用户同意场景。 它帮助组织： ✅ 教育用户了解摄像头和浏览器权限风险 ✅ 演示社会工程学技术的运作方式 ✅ 通过逼真的模拟提升员工安全意识 ✅ 开展经授权的红队/蓝队训练 ✅ 衡量用户响应与安全意识水平 🚨 重要声明 CamJacking 严格仅供以下用途使用： 经授权的安全意识培训...

Security-Champions

OWASP 安全卫士指南 使用 MKDocs 将我们的内容托管在 https://securitychampions.owasp.org/ 上（与 OWASP 项目页面并列）。 灵感来自 https://github.com/OWASP/API-Security 和 https://github.com/OWASP/Top10/tree/master/2021。 在 Windows 上构建本地副本 安装 python python3 -m pip install -r requirements.txt python3 -m pip install mkdocs 本地测试 python3 ...

free-interactive-ai-training-materials

所有文件已移至官方项目组织下。欢迎为此仓库贡献： https://github.com/ransomleak/training-security-awareness...

camjacking

Camjacking Camjacking 是一款企业级安全意识培训框架，旨在模拟针对摄像头权限和用户意识开展逼真的钓鱼攻击。 🎯 什么是 CamJacking？ CamJacking 是一款企业级安全意识培训框架 ，旨在模拟针对摄像头权限和用户意识开展的逼真钓鱼攻击。该工具专为道德黑客、渗透测试人员和安全专业人员打造，能够帮助组织： ✅ 评估 员工的安全意识水平及对社会工程的易感性 ✅ 培训 团队掌握摄像头安全风险及最佳实践 ✅ 模拟 在受控实验室环境中开展逼真的攻击场景 ✅ 衡量 借助详细的分析和报告来评估安全态势 ✅ 教育 通过动手实践的网络安全培训提升能力 🚨 免责声明...

Probable-Wordlists

可能的密码列表 - 版本 2.0 你知道世界上最常见的密码是什么吗？ 你知道它们长什么样吗？ 为了安全，你会想要避开它们！ 考虑克隆？ 此仓库不包含代码，但包含指向一组列表的链接。 克隆可能并非获取所需文件的必要操作. 请访问 下载 页面获取更多信息。 查看 密码趋势分析 - 学习吧！ 我将在 版本 1 文件中出现 10 次或以上的密码趋势进行了可视化。 这些图表包含了 立即可操作 的建议，教您如何让密码更具独特性。 方法论：原因与方法 原因...

defenselessV1

defenselessV1 Defenseless 是一个用 PHP/MySQL 编写的脆弱 Web 应用程序。这是该应用程序的第一个版本。其目的是在开发者和应用安全新手之间建立安全意识。它将很快更新，增加更多漏洞，同时另一个新的脆弱应用也正在开发中。请告诉我如何改进它。 免责声明 请勿将此应用程序托管在在线或生产环境中。 设置 设置此应用程序很简单。 1. 下载后在 phpmyadmin 中创建一个新数据库。 2. 将数据库命名为 testapp 。然后，将文件 testapp2.sql 导入 testapp 数据库。 3. 刷新即可使用。 !!!使用 XAMPP 以获得最佳效果!!!...

gophish

Gophish Gophish：开源钓鱼工具包 Gophish 是一个开源钓鱼工具包，专为企业和渗透测试人员设计。它能够快速轻松地设置和执行网络钓鱼演练以及安全意识培训。 安装 安装 Gophish 非常简单 —— 只需下载并解压包含适用于你系统版本的 zip 压缩包，然后运行其中的可执行文件。Gophish 提供 Windows、Mac 和 Linux 平台的可执行文件。 从源码构建 如果你从源码构建，请注意 Gophish 需要 Go v1.10 或更高版本！ 要从源码构建 Gophish，只需运行 git clone...

gophish

Gophish Gophish: Open-Source Phishing Toolkit Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training. Install Installation of Gophish is...

training-security-awareness

Free Security Awareness Training for Employees — Open Source Interactive SCORM Library 130+ free, open-source security awareness training exercises for employees — hands-on, interactive SCORM modules covering phishing awareness training, phishing simulation, GDPR training, EU AI Act compliance, A...

Best Security Awareness Platforms for Personalized Employee Training

Comparing five leading security awareness platforms, based on the level of personalization they offer...

First-Person Identity Theft Story

Harrowing story of an identity theft victim. Yes, the person made a mistake--they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security...

Exploit for CVE-2026-61498

cve-id ⚡ Simple Usage Use this project only in safe and...

From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness

AI coding assistants are now central to professional software development, yet their impact on how developers think about and practice security remains poorly understood. While prior work has documented vulnerability rates in AI-generated code, a more fundamental question persists: how do these...

Comprehensive List of User Deception Techniques in Emails

Email remains a central communication medium, yet its long-standing design and interface conventions continue to enable deceptive attacks. This research note presents a structured list of 42 email-based deception techniques, documented with 64 concrete example implementations, organized around th...

CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First

Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked ...

Apeman Cameras

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to take control of the device or view camera feeds. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

Women’s History Month: Encouraging women in cybersecurity at every career stage

Women’s History Month—and International Women’s Day on March 8, 2026—always gives me pause for reflection. It’s a moment to think about how far we’ve come and think about who we choose to uplift as we look ahead. Throughout my career, I’ve been inspired by extraordinary women leaders—trailblazers...

CVE-2025-6592

Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0...