phishingclub - Simulation, Training and Red Team Phishing Framewo

项目说明

Phishing Club

![Latest Release]()
![Discord]()
![License: AGPL v3]()

Phishing Club is a phishing simulation, training and red team phishing framework.

!Phishing Club Dashboard

Quick start (production)

⚡ For systemd-enabled distributions, installation is quick and easy

Run the following on the server

Remember to copy the admin URL and password

Manual installation

GHCR Images

Production Docker Compose example

Features

Phishing Club provides a lot of features for simulation and red teaming, such as:

Multi-stage phishing flows - Put together multiple phishing pages

Domain proxying - Configure domains to proxy and mirror content from target sites

Flexible scheduling - Time windows, business hours, or manual delivery

Multiple domains - Auto TLS, custom sites and asset management

Ad delivery - SMTP configs or custom API Sender with OAuth support

Recipient tracking - Groups, CS, SCIM pro, repeat offender metrics

Awareness training - Run training campaigns that record started and completed, kept separate from phishing risk

Campaign reports - PDF export with customizable HTML templates for phishing and training, automatically emailed on completion

Analytics - Timelines, dashboards, per-user event history

Automation - HMAC-signed webhooks, REST API and embedded Ja scripting engine

Multi-tenancy - Segregated client handling and statistics for service pro

Anonymization - Pseudonymized campaigns, automatic anonymization on close and retention windows for compliance

Branding - Replace logos and login image with your own

Security features - MFA, SSO (Entra ID and OIDC), session management, IP filtering

Operational tools - In-app updates, CLI installer, config management

AiTM and Red Team Features

Reverse proxy phishing - Capture sessions to bypass weak MFA, import captured cookies with the Session Sushi extension

Remote browser phishing - Stream and interact with a 's li session

Full control - Modify and capture requests and responses independently

DOM rewriting - Modify content using CSS/jQuery-like selectors or regex

Path and param rewriting - Rewrite URL paths and query parameters on the fly

Dynamic obfuscation - Avoid static detection with dynamically obfuscated landing pages

E page - Customize the pre-lure e page

Custom deny page - Decide what bots or evaded see

Access control - Default deny-list until phishing lure URL

Ad filtering - Use JA4, CIDR and geo-IP to control lure URL access

Browser impersonation - Impersonate JA4 fingerprints in proxied requests

Response o - Shortcut proxying with custom responses

Forward proxying - Use HTTP and SOCKS5 proxies to ensure requests originate from the right location

Editor - Use the editor to easily setup a proxy

Import compromised OAuth token - Use compromised tokens to send more phishing enabled endpoints

Device Code phishing - Device code phishing is as simple as adding a single line to a email or landing page

Blogs & Resources

Phishing Club User Guide

Covert red team phishing with Phishing Club

Phishing Simulation vs Red Team Phishing: Understanding Different Approaches

Remote Browser Phishing with Phishing Club

Wrote a blog post or write up about Phishing Club? Tell us about it and we might add it here. Reach out via a GitHub issue, discord or find our email :)

Template De

Phishing Template Workbench

Speed up your template de with our template workbench tool:

Phishing Template Workbench - A de en for creating and testing phishing simulation templates.

Preview - Preview templates

support - See {{.FirstName}}, {{.Email}} substitution with realistic sample data

Nai Testing - Preview templates across mobile, tablet, and desktop

Export Ready - Compatible with Phishing Club formats

Included Templates - Comes with example templates co common phishing scenarios that you can import and customize

De

Run the whole stack locally with Docker and make:

Then open and setup the admin account.

For prerequisites, service ports, make commands, local DNS and SSL setup, see DE.md. For the contribution process, see CONTRIBUTING.md.

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). This means:

✅ You can use, modify, and distribute the software freely

✅ Perfect for educational, research, and commercial use

✅ You can run your own instance for security testing or professional services

⚠️ Important: If you provide the software modified as a network service, you must make your source code a under AGPL-3.0

Contact reqarding license:

Roadmap

There is no official roadmap.

But you can vote with emojis on the [feature] requests on Github or add your own feature request.

Feature request with a high number of votes will be prioritized, however it is no guaranteed they will be implemented. Ultimately what gets implemented, how and when highly depends on me and what I think is right for the project.

Contributing

We welcome contributions from the community! Please read our Contributing Guidelines

Quick Start for Contributors:
1. Check existing issues and create a feature request if needed
2. Wait for appro starting work
3. Fork the repository and create a feature branch
4. Follow our de workflow and coding standards
5. Submit a pull request with signed commits

For complete details, see CONTRIBUTING.md.

Suggestions for Contributors

Improve or add templates to the template project

Check existing feature requests - Want to work on something, make a comment.

Support

Need help? Join the Phishing Club Discord

Community support is provided on a best-effort, basis. For dedicated assistance, paid support is a.

General Support: Join our Discord community or open a GitHub issue

Security Issues: See our Security Policy

Security and Ethical Use

This platform is designed for authorized security testing only.

For important information about:

Reporting security

Ethical use requirements

Legal responsibilities

Security best practices

Please read our Security Policy.

Important: Users are solely responsible for ensuring their use complies with all applicable laws and regulations.

项目信息

开发语言：Go

Star 数：263

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Simulation, Training and Red Team Phishing Framework展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	phishingclub - Simulation, Training and Red Team Phishing Framewo
所属分类	红蓝攻防
发布作者	admin
发布时间	2026-10-06 00:45:10
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	255
讨论数量	0
主题状态	正常讨论中