Open-source alternatives to Phishmonger

MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain.

Modlishka is a man-in-the-middle reverse proxy framework designed for automated phishing campaigns. It dynamically generates valid TLS certificates for target domains, aggregates traffic from multiple domains through a single proxy, and injects custom scripts into proxied responses. The framework operates transparently without requiring client-side certificate installation and relays two-factor authentication steps to capture secondary verification tokens. What sets Modlishka apart is its ability to automate the entire credential theft process. It logs all form submissions, headers, and cooki

dnstwist is a Python-based tool designed to detect domain name variants and typo-squatting attempts. It generates a comprehensive list of potential domain permutations—such as misspellings, homoglyphs, and character substitutions—that could be used for phishing, brand impersonation, or other malicious activities. The project serves as a security research utility for identifying lookalike domains that might be registered by adversaries to exploit user confusion or trust. The tool systematically probes each generated domain variant to determine its registration status, DNS resolution, and other

This tool has been released along with a FireEye blog post. The blog post can be found at the following link: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html

Gophish is an open-source phishing toolkit and simulation framework designed to test organizational security awareness and evaluate vulnerability to social engineering attacks. It provides a core engine for sending deceptive emails to targets and tracking their interactions to identify gaps in security training. The platform functions as a comprehensive campaign manager for deploying lures and monitoring email delivery and click-through rates. It allows for the design and execution of simulated email threats to track how targets interact with malicious-looking content or provide credentials i

Zphisher is a security testing framework designed for conducting authorized social engineering assessments and penetration testing. It functions as a credential harvesting simulator that enables security professionals to evaluate organizational defenses and user awareness by deploying deceptive login interfaces. The platform automates the creation of realistic web pages through dynamic template rendering and provides tools to mask destination addresses. It integrates reverse proxy tunneling to expose local testing services to the public internet, allowing for remote access during security aud

PLEASE USE NEW VERSION: https://github.com/kgretzky/evilginx2

Evilginx2 is a man-in-the-middle phishing framework designed to proxy authentication traffic between a user and a target web service. By acting as a reverse proxy, the tool intercepts and relays web requests to capture credentials and session tokens in real time, enabling the bypass of multi-factor authentication mechanisms through session cookie hijacking. The platform distinguishes itself by integrating infrastructure orchestration with modular template-driven content injection. It automates the deployment of proxy servers, manages the lifecycle of encryption certificates, and applies conte

o365-attack-toolkit allows operators to perform oauth phishing attacks.

Browser In The Browser (BITB) Templates

Muraena is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities.

CATPHISH project - For phishing and corporate espionage. Perfect for RED TEAM.

An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector

Phishing Campaign Toolkit

The OAuth Device Authorization flow is documented via: Device Authorization Flow via Auth0 v2 OAuth2 Device Code via Microsoft

This project is a Docker-based Nginx reverse proxy manager designed to automate the deployment of HTTPS for web applications. It functions as a gateway that acquires and renews security certificates via Let's Encrypt and proxies incoming traffic to backend services. The system distinguishes itself by automatically discovering web services running in Docker containers to eliminate manual domain configuration. It manages security certificates through an automated process and can expose these certificates to other applications via shared volumes. The tool covers traffic management through load

Authors Joe Vest (@joevest) & Andrew Chiles (@andrewchiles)

Generate unicode domains for IDN Homograph Attack and detect them.