phishim - Easy red team phishing with Puppeteer

项目说明

Phishim - let the user log in for you

Phishim is a phishing tool which reduces configuration time and bypasses
most types of MFA by running a chrome tab on the server that the user unknowingly
interacts with.

What is different about Phishim?

Most phishing infrastructure works in one of two ways: either you create
static HTML pages (manually or by grabbing them during setup), or you proxy
traffic to the impersonated domain (possibly modifying contents on the fly).

Phishim works differently by proxying at the user interaction layer rather
than the traffic layer, reducing the amount of configuration required.
In particular, I no longer had to spend time removing troublesome Ja
from my landing pages like I had to with GoPhish,
and I no longer had to spend time configuring rewrite rules like I had to
with E. The tradeoff is
that these other tools allow you to create much higher-fidelity impersonations
than this approach.

Usage

First, install node and npm.

Then clone this repo and install dependencies:

You should now configure the at the top of src/index.ts. The first
string is where you are hosting your phish, and the others are how you interact
with the impersonated website. You may also want to add a favicon.ico file
at the root so that the correct favicon is displayed in the browser.

Once doing so you can start the server:

The phish interface by default runs on port 8080, and the admin interface
runs on port 3333. Once a user has logged in on the phish interface,
you can open up the admin interface to reconnect to their session and
browse as them.

Demo

To run the demo, first clone the repo:

Start the demo server, which will run on port 3000:

Start the phishim server

Go to localhost:8080 to view the phishim client and localhost:3333 to view the admin panel.

How it works

Phishim depends very heavily on Puppeteer. Puppeteer is
a browser automation library which primarily focuses on testing automation,
but it has also been used extensively for web scraping. Phishim spins up
a Puppeteer browser for each user that the site. The ser
screenshots of the web page and sends them down to the client over a web
socket connection for display, and the client sends up clicks and keyboard
presses to the server to be played on the page. Once the user successfully
logs in, they are redirected to the real website.

Limitations

Does not work for all types of MFA

While this approach has been tested for many of the most common MFA approaches
such as SMS, authenticator apps, in-app notifications, and the like, any
MFA approach which in authenticating the URL in the browser will
succeed in protecting the user. For example, WebAuthn
uses a different key pair per website which would prevent Phishim from
using the data received on the impersonated host.

Some websites are able to detect something phishy is going on

In my testing multiple websites determined that my login attempts were
abo risk and instituted higher-friction MFA techniques than
would otherwise be used, for example requiring the user enter a two-digit
number from the site into their mobile app, and one website outright
blocked the login altogether e I had valid credentials. I
was able to work around some of these problems by modifying Phishim's
behavior.

Requires the target to have a fast internet connection

The slower the internet connection between the server and the user, the
more noticeable it is that this is not the real site. Login pages are
often quite simple but delayed interactions can cause suspicion. As
high internet speeds proliferate this will be less of a concern.

项目信息

开发语言：TypeScript

Star 数：136

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Easy red team phishing with Puppeteer展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。