antisnatchor/phishlulz

PhishLulz

PhishLulz is a Ruby toolset aimed at automating Phishing activities.

When you start a phishing campaign, a dedicated Amazon EC2 (Debian 7) instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are:

• PhishingFrenzy (https://github.com/pentestgeek/phishing-frenzy)
• BeEF (https://github.com/beefproject/beef)

PhishLulz comes with its own self-signed CA: this is needed to generate self-signed certs for the PhishingFrenzy admin UI. You will also find a bunch of cool phishing templates (which are not in PF) that you can quickly re-use in your scenarios.

Automatic domain registration is still TODO, however you can play with the almost-working code for the NameCheap registrar.

PhishLulz AWS AMI

The public AMI id is: ami-141bb974 You want to clone that, add your SSH keys, and use your nre clone.

The following are default passwords for various services, change them.

• MySQL root user: phishlulz_mysql
• PhishingFrenzy admin user: phishlulz_frenzy
• BeEF beef user: phishlulz_beef

To change the default admin user password/email for PhishingFrenzy use the Rails console: cd /var/www/phishing-frenzy && RAILS_ENV=production rails console admin = Admin.first admin.password = "newpasswd" admin.email = "newemail" admin.save! exit

PhishLulz Toolset

• phish_lulz: main script to start/stop phishing instances
• tools/find_resources: multi-threaded subdomain discovery and fingerprinting tool
• tools/mailboxbug: multi-threaded webmail data extruder
• tools/mail_parser: simple script to extract html/txt from an .eml email file
• namecheap_wrapper: WIP for automated domain registration

PhishLulz material released at KiwiCon X

![KiwiCon X talk slides]

![PhishLulz phishing]

![MailBoxBug against Outlook Office365]

Requirements

• Amazon AWS account (see main config.yaml)
• Non-Winzozz OS (path separators are hardcoded on purpose to don't make it compatible with Winzozz)
• ssh, scp, openssl in PATH
• Sane Ruby environment (RVM suggested). Install the required gems with: gem install sinatra thin watir-webdriver headless colorize datamapper dm-sqlite-adapter dm-timestamps dm-migrations fog nokogiri mail net-ssh --no-rdoc --no-ri
• Gecko/Chrome drivers

To instrument Firefox you need to have the geckodriver binary in your PATH. Download it from https://github.com/mozilla/geckodriver/releases Same thing applies if you prefer instrumenting Chrome, you need the chromedriver.

Once you have the binary, make sure it's in the PATH: export PATH=$PATH:path_to_driver_dir

Finally, make sure the MailBoxBug data extrusion domain has a valid HTTPS certificate (Mixed content...)

Get Involved

PhishLulz is supposed to be used by experienced people, so make sure you know what you're doing before spamming the Github issue tracker with non-sense questions.

If you like PhishLulz and the toolset, pull requests would be much appreciated ;-)

Twitter: @antisnatchor

phishlulz's Issues

DigitalOcean Support

Any plan for digitalocean ?

Is this ethical?

I came across this repository while looking for freelance gigs; someone was offering $25 for a developer to set it up on an Amazon instance. Am I correct in understanding that this tool's explicit purpose is facilitating illegal phishing campaigns?

can get a wiki ?

as a fresh man , there are much things i need to know.please

Can't find ami-141bb974

Hi there,
i'm trying to find your dedicated Image Template for PhishLulz called ami-141bb974 but I can't find on the Amazon MarketPlace (the message says "No AMI's found matching your filter criteria")
Any suggestions?
Thanks in advance.

Fede.

LetsEncrypt Support

Just a thought I had, but it would be pretty great to add LetsEncrypt support for automagically giving the phishing sites the "Green Padlock of Trustworthiness" for better tricking end users...

Syntax error?

All of a sudden, when I run a new instance, it gives an Apache error in the setup process:

sudo service apache2 restart
Syntax error on line 3 of /etc/apache2/pf.conf:
SSLCertificateFile: file '/home/sesl/ssl_certs/MAILDOMAIN.cert.pem' does not exist or is empty
Action 'configtest' failed.
The Apache error log may have more information.
 failed!

This is random, and it won't allow the virtual host to serve up the page. The admin panel is served fine, via it's assigned url. Nothing at all has been changed in the setup process, entirely normal. When i SSHd into the machine, it wouldn't allow me to edit the conf file when i tried to remove the reference to the cert altogether for testing.
I don't understand how this is all of a sudden in the first place though?
Any help would be appreciated.

SSHd not started

hi,
I followed https://jamescoote.co.uk/phishlulz-tutorial/ until the final part of step 8. After this command:

ubuntu@ip-172-31-20-111:~/phishlulz-master$ ruby phish_lulz.rb -a create

I encounter problems in:
[-] SSHd has not started yet, waiting 10 seconds and trying again...
[+] Checking if SSHd has started...
[-] Giving up. Instance is running but not properly configured.
[+] Executing command:
mysql -u pf_prod -e 'UPDATE global_settings SET site_url="https://hello.certislearning.net" WHERE id=1;' pf_prod
[-] ERROR: Is a directory @ io_fread - /home/ubuntu/phishlulz-master

The config.yaml is here:
provider: "AWS"
region: "us-west-2"

instance type and AMI id

instance:
type: "t1.micro"
ami: "ami-42e86e22"
security:
key_id: "AKIAIQ2KXIMY5LVLY6SQ"
access_key: "XbwIEBDRm/V5z+RZFSmNGMNNApbye7VJZBclj+Bp"
keypair_name: "frenzy" # SSH public key on Amazon AWS
keypair_path: "/home/ubuntu/phishlulz-master/" # path to SSH private key on$
ssh_user: "admin"
security_group: "sg-50e7c136" # default security $

passphrase for root and intermediate CA required to generate SSL certifica$

ca_passphrase: "phish_lulz_ca_wow!"
registrar:

TODO -- NOTE this is not finished yet. check the code in namecheap_wrapper$

provider: "namecheap"
debug: true
endpoint: "https://api.sandbox.namecheap.com/xml.response"
whitelisted_ip: "your_ip"
user: "sandbox_user"
key: "sandbox_key"

I had also set up the security group:

Where are the potential areas for me to resolve this issue? Thanks

Error: You have 1 job enqueued, but Sidekiq is not running

Followed the James Cootes guide exactly, and everything's installed fine far as I'm aware, except this error displayed when launched a tutorial. Report says email sent. What's caused Sidekiq not to start?