PhishLulz: Phishing Automation Tool
PhishLulz
PhishLulz is a Ruby toolset aimed at automating Phishing activities.
When you start a phishing campaign, a dedicated Amazon EC2 (Debian 7) instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are:
- PhishingFrenzy (https://github.com/pentestgeek/phishing-frenzy)
- BeEF (https://github.com/beefproject/beef)
PhishLulz comes with its own self-signed CA: this is needed to generate self-signed certs for the PhishingFrenzy admin UI. You will also find a bunch of cool phishing templates (which are not in PF) that you can quickly re-use in your scenarios.
PhishLulz Toolset
- phish_lulz: main script to start/stop phishing instances
- tools/find_resources: multi-threaded subdomain discovery and fingerprinting tool
- tools/mailboxbug: multi-threaded webmail data extruder
- tools/mail_parser: simple script to extract html/txt from an .eml email file
- namecheap_wrapper: WIP for automated domain registration
Requirements
- Amazon AWS account (see main config.yaml)
- Non-Winzozz OS (path separators are hardcoded on purpose to don’t make it compatible with Winzozz)
- ssh, scp, openssl in PATH
- Sane Ruby environment (RVM suggested). Install the required gems with: gem install sinatra thin watir-webdriver headless colorize datamapper dm-sqlite-adapter dm-timestamps dm-migrations fog nokogiri mail net-ssh –no-rdoc –no-ri
- Gecko/Chrome drivers
Installation && Tutorial
Demo
MailBoxBug: automated & multi-threaded webmail data extrusion
Document
Source
https://github.com/antisnatchor/phishlulz