resources-phish.md

Phishing Resources

Guides

General

• Outlooks forms and shells - sensepost
• Red Team Techniques - Spear Phishing (josh kamdjou)
• red team infrastructure - bluescreenofjeff
• Silencing Cylance - A Case Study
• Spear Phishing Red Team Techniques
• Parent Process Spoof
• Various Visual Basic Macros (rvrsh3ll)
• The Art of the Device Code Phish - Bobby Cooke

• Spear Phishing on Modern Platforms - optiv
  • desc: cloud spear phish research
  • tags: cloud

• Modern Initial Access and Evasion Tactics
  • desc: Moder (2022) initial access research
  • tags: phish, redteam

Techniques

• htmlsmuggling - outflank
• Fun with ClickOnce

HTA

• ZipLink - Combine Zips and Lnk for fun and profit | BadOption.eu
• Hacking around HTA files - [ Sevagas]

Keyying Payloads

• Keying Payloads for Scripting Languages
• keyring

gophish setup

• Gophish on AWS
• Postfix Server Setup (n0pe-sled)
• Install & Configure DKIM
• gophish documentation for Template References
• Never had a bad day phishing. How to set up GoPhish to evade security controls
  • puzzlepeaches/sneaky_gophish
  • Gophish MODs
• Create phishing campaign with Gophish (Step-by-Step)

Mail

• Email Security (SPF, DKIM, and DMARC)

Tools

• Complete IP Check for Sending Mailservers
• SpoofCheck
• Modishka - 2fa phishing
• evilginx
• EvilClippy
• Demiguise -HTA Encryption Tool
• Macro Pack
• EXCELntDonut
• NameMash
• www.mail-tester.com - Test the Spammyness of your Emails
• Living Off Trusted Sites (LOTS) Project
• CanIPhish/Phishious - An open-source Secure Email Gateway (SEG) evaluation toolkit designed for red-teamers.
• fkasler/cuddlephish - Weaponized Browser-in-the-Middle (BitM) for Penetration Testers
• D00Movenok/BounceBack - Stealth redirector for your red team operation security
• Email Deliverability Tester: Inbox, Spam, or Promotions? - Email Deliverability Tester: Inbox, Spam, or Promotions?

DNS Health Check

See infra resource