Introducing Phishing Frenzy

A couple weeks ago I presented at this years Derbycon on an email phishing platform that I have been working on. The web application is geared towards penetration testers who want to help streamline the creation and management of email phishing campaigns. The application is written in ruby on rails and is available for download on the Github repository: Phishing Frenzy.

For those of you who came out to my presentation, I appreciate you all getting up so early (Saturday 9am) to hear my talk. Those of you who missed the talk I went over some of the features of Phishing Frenzy and launched a live phishing simulation. You can see the recording below thanks to irongeek. If your looking to see just the demo, fast forward to 11:52.

Phishing Frenzy: 7 Seconds from Hook to Sinker

Phishing Campaigns

I briefly want to go over some of the features that Phishing Frenzy has to offer, including campaign creation, customization, and execution:

Template Management

Once you’ve setup a phishing scenario that works with Phishing Frenzy you can reuse them for all future campaigns. Phishing Frenzy also offers the ability to backup and restore templates. This allows the community to share phishing scenarios with everyone else. To share a Phishing Frenzy template you can submit a pull request to: https://github.com/pentestgeek/phishing-frenzy-templates

Reporting

Phishing Scenario

This phishing scenario that I demonstrated at Derbycon is available as part of the Phishing Frenzy install. I typically make the email look like it came from someone within the company who is an authoritative figure. The email  states that everyone should test their passwords to ensure they are in compliance with the company policies.

Once the user clicks on the phishing URL, they are directed to our fake Intel Password Checker website. The idea is that any passwords entered into the box will be harvested by us the pentester. You may notice that we are not asking for the users name or username in this scenario, and that is because we already have it.

Using a little PHP magic we can use the $_GET function to pull the base64 encoded email address from id parameter within the url. This way we know the email address and the password entered into the website

Demonstration

Here is a high level overview of  how Phishing Frenzy can be used to launch an email phishing campaign.

Outro

This application is currently in beta stages, and needs more QA time. Please try out the software and let me know how it can be improved.  If you would like to get involved with the project, please submit a pull request with your code changes or additions.

If you have bug fixes, issues or enhancements for Phishing Frenzy, please submit a ticket using Github. The repositories and install instructions can be found:

• https://github.com/pentestgeek/phishing-frenzy
• https://github.com/pentestgeek/phishing-frenzy-templates

Stay tuned for more documentation and tutorials on how to leverage Phishing Frenzy.

Happy Phishing!

Share this article