
项目说明
<p align="center">
<img src=" width="200"/>
</a></p>
<h1 align="center">SocialFish v3.0</h1>
<h3 align="center">Modern Dynamic Phishing Toolkit</h3>
SocialFish v3.0 brings powerful new features for cloning modern login pages, capturing cookies, and intercepting 2FA codes with a li panel.
🆕 What's New in v3.0
Playwright Browser Automation — Clone modern JS-hea pagesFull Cookie Capture & Analysis — Detailed metadata, security attributes, auth tokensTemplate System — Save and reuse clones across multiple Live OTP Interception Panel — Real-time 2FA 代码 capture and injectionMITM Reverse Proxy — ngrok/cloudflared tunneling with auto-installation6 Clone Modes — Login-only, cookies-only, or full captureMulti-step Login Detection — Automatic heuristics for complex flows (Office365, etc.)Webhook Notifications — Real-time alerts to Slack, Discord, custom APIsSession Management — Full session tracking with export to JSON/CSVNetwork Interception — Log all HTTP requests/responses Tracking — Track clicks, IP addresses, geolocation, device type📖 Documentation
FEATURES_v3.md — Complete feature guide with workflowsIMPLEMENTATION_SUMMARY.md — Technical implementation detailsWiki — Original setup and ad guides🚀 Quick Start
Option 1: Interacti (Recommended)
This will:
Install all dependenciesSetup Playwright browsersInitialize databaseConfigure tunneling (optional)Display quick-start guideOption 2: Manual Setup
Then access:
🎯 Basic Workflow
1. Create Template
2. Setup Tunnel (optional, for remote testing)
3. Generate Lure URL
4. Send to
5. Monitor in Real-Time
🔧 Key Features
Templates Library
Sa configurationsReuse across multiple usersClone modes: both (credentials + cookies), login (credentials only), cookies (session only)Browser engines: Playwright (default), Selenium (optional)Cookie Capture
Full cookie jar (domain, path, secure, httponly, samesite, expiry)Ja cookie interceptionAuth token detectionSecurity attribute analysisExport to JSON/CSVLive OTP Panel
WebSocket-based real-time communicationDisplay session detailsWait for OTP codes (manual or automatic)Inject OTP back to 's browserNetwork activity monitoringMITM & Reverse Proxy
Auto-setup ngrok or cloudflared tunnelsReverse proxy all trafficAutomatic cookie + credential captureNo setup oWebhook Notifications
Slack, Discord, custom APIsTriggerable on credential submit, OTP received, session createdJSON, form-encoded, or XML payloadsMulti-step & 2FA Detection
Automatic heuristics for complex flowsOTP endpoint detectionManual breakpoints for user interaction2FA indicators in analytics📊 Supported Sites
Works with any login page that uses:
✅ HTML forms✅ Ja form submission✅ XHR/fetch-based authentication✅ SPA logins (React, Vue, Angular)✅ 2FA/OTP flows✅ Multi-step authentication (Office365, Gmail, GitHub, etc.)🌐 API & CLI
Web API
CLI Commands
📂 Project Structure
🔐 Security & Ethics
⚠️ EDUCATIONAL USE ONLY
✅ Consent Required — Only test systems you own or ha written permission for✅ Audit Logging — All operations logged with user attribution✅ Data Protection — Implement proper data retention policies✅ GDPR Compliance — Comply with local privacy regulations✅ Disclosure — Report responsiblySee CODE_OF_CONDUCT.md and LICENSE for details.
📱 Mobile Controller
Looking for the mobile controller? Check SocialFishMobile
⚖️ Disclaimer
TO BE USED FOR EDUCATIONAL PURPOSES ONLY
The use of the SocialFish is COMPLETE RESPONSIBILITY of the END-USER. De assume NO liability and are NOT responsible for any misuse or damage caused by this program.
"DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
Taken from LICENSE.
🐳 Docker
Run with Docker:
---
Status: Production-ready for authorized security testing and red team exercises
CONTRIBUTING
![Open Source Helpers]()
We encourage you to contribute to SocialFish! Please check out the Contributing to SocialFish guide for guidelines about how to proceed. Join us!
Special Contributors
-
项目信息
开发语言:CSS
Star 数:4894
技术要点
该项目属于黑客技术方向的开源资源,代码结构清晰,适合安全研究人员学习参考。项目围绕Phishing 工具 & Information Collector 展开,提供了可运行的实现,对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看,此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论,梳理项目的初始化流程、核心模块职责与数据流转,逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包,解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证,避免影响生产系统。
免责声明
本资源来源于开源社区,仅供安全研究、技术学习与合法授权范围内的攻防演练使用,请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。