Skip to content
This repository has been archived by the owner on May 19, 2022. It is now read-only.
/ build_a_phish Public archive

Ansible playbook to deploy a phishing engagement in the cloud.

Notifications You must be signed in to change notification settings

ralphte/build_a_phish

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Build A Phish Logo

Archived

I have archived this project. Please use Warhorse which is a continuation of this project.

Build_A_Phish

GitHub Stars GitHub commit activity GitHub code size in bytes GitHub Contributors

Table of contents

Overview

Build a Phish consist of a Ansible playbook to deploy a phishing engagement in the cloud. The Playbook combines both Terraform & Ansible to deploy and configure virtual machines for different use cases. This playbook is highly customizable and includes operational security out of box. The design of this playbook is much more than automation. This playbook implements real world TTP’s to improve OPSEC, lower operational cost and speedup deployment time. This project is the real-world demonstration from the Black Hills Information Security Webcast “How to Build a Phishing Engagement - Coding TTP's”

Features

  • Pure Ansible playbook with low dependencies and easy modification.
  • Security from the ground up
  • Docker containers for each application.
  • Designed around a phishing engagment

Containers

Logo Service Image
Evilginx2 warhorse/evilginx2
Gophish gophish/gophish
Nginx nginx
Mitmproxy mitmproxy

Supported Cloud Providers

Logo Provider Services
Digital Ocean Droplet,DNS
Azure CDN

Webcast

https://www.youtube.com/watch?v=VglCgoIjztE

Blog Post

Coming Soon

Requirements

  • Managment Domain
  • Linux or MacOS
  • Ansible
  • Terraform
  • (optional) Secrets Provider cli
    • lpass (lastpass)
    • op (onepasword)
    • bw (Bitwarden)

Setup

DNS records

You will need a managment domain. This domain can be the same domian used for phishing emails. After you buy a domain set the name server records to Digital Ocean.

1. Install Ansible & Terraform

Ansible

  • OSX

    brew install ansible

  • Linux

    pip install ansible

  • Install Ansible General Modules

ansible-galaxy collection install community.general

Terraform

2. Git clone this repo

git clone https://github.com/ralphte/build_a_phish

3. Customize the variables inside the vars folder.

4. Create API keys for both Digital Ocean & Azure.

Usage

Create

ansible-playbook deploy.yml --tags phish

Destroy

ansible-playbook destroy.yml --tags phish

Secrets

You have three choices

  1. Hard code (Don't do this)
  2. Use a Secrets CLI https://docs.ansible.com/ansible/latest/collections/community/general/lastpass_lookup.html
  3. Use Ansible Vaults https://docs.ansible.com/ansible/latest/user_guide/vault.html

Evilginx2

If you would like to modify the phishlet or change lures, please edit the following files.

roles\evilginx2-docker\templates\config.yaml.j2

roles\evilginx2-docker\templates\o365.yaml.j2

You can check the evilginx logs for session data with the following command.

docker logs evilginx2

Gophish

You can access gophish via the hostname set for "gophish_admin_hostname"

To get the password on first login check the docker logs

docker logs gophish

Mitmproxy

You can access Mitmproxy via the hostname set for "mitmproxy_hostname"

The mitmproxy web interface allows you to see the RAW traffic between evilginx2 and your target server. You can use this to check for problems and remove any IOC's. Mitmproxy is a dignostic tool to inspect https traffic.

Development

Does none of this work for you? Submit a issue and I will see what the problem is.

Want to add a cool new feature shoot me that sweet pull request.

Acknowledgements

Gophish https://getgophish.com/

Evilginx https://github.com/kgretzky/evilginx2

Mitmproxy https://github.com/mitmproxy/mitmproxy

Ansible roles from https://github.com/geerlingguy

License

MIT.

About

Ansible playbook to deploy a phishing engagement in the cloud.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published