phishing-overview
Phishing / social-engineering catalog for the Phisher agent. Use ONLY when the engagement RoE authorizes a phishing engagement. Covers pretext design, GoPhish campaigns, evilginx2 MFA-bypass proxying, O365 credential/token harvest, lookalike domains, and the mandatory blue-team deconfliction handshake.
来源信息
- 仓库
- BitterSecurity/Decepticon
- 最近来源活动
- 2026年6月29日 01:38
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 5,565
- 分支
- 1,053
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
文件资源管理器
11 个文件正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- phishing-overview
- description
- Phishing / social-engineering catalog for the Phisher agent. Use ONLY when the engagement RoE authorizes a phishing engagement. Covers pretext design, GoPhish campaigns, evilginx2 MFA-bypass proxying, O365 credential/token harvest, lookalike domains, and the mandatory blue-team deconfliction handshake.
- metadata
- {"subdomain":"phishing","when_to_use":"phishing, social engineering, initial access, gophish, evilginx2, mfa bypass, lure, pretext, o365 oauth, lookalike domain, deconfliction","mitre_attack":["T1566","T1566.001","T1566.002","T1598","T1656"],"tags":["phishing","social-engineering","initial-access","evilginx","gophish"]}
# Phishing / Social-Engineering Skill Catalog
**Gating.** Every skill here refuses to execute unless the engagement
RoE authorizes a phishing engagement and the blue-team
deconfliction handshake (`lure-deconfliction`) has completed. Phishing
real employees without written authorization is a crime — the RoE +
deconfliction ack are the operator's legal coverage.
## Playbooks
| Skill | Use for |
|---|---|
| `/skills/standard/phisher/pretext-engineering/SKILL.md` | Design the pretext + target shortlist from OSINT (LinkedIn / Hunter.io) |
| `/skills/standard/phisher/gophish-campaign/SKILL.md` | GoPhish API: groups, email templates, landing pages, campaign launch + tracking |
| `/skills/standard/phisher/evilginx2-proxy/SKILL.md` | evilginx2 phishlet authoring; capture session cookies past MFA |
| `/skills/standard/phisher/o365-credential-harvest/SKILL.md` | O365 / Entra OAuth device-code + token capture and replay |
| `/skills/standard/phisher/lookalike-domain/SKILL.md` | Punycode / lookalike domain + DNS + TLS provisioning |
| `/skills/standard/phisher/lure-deconfliction/SKILL.md` | MANDATORY pre-send handshake with the blue-team contact |
## Infrastructure pattern
```
[Target inbox] -> [NGiNX reverse proxy on attacker domain]
├─ /login → evilginx2 phishlet (MFA bypass + session capture)
└─ /landing → GoPhish (campaign tracking + analytics)
```
- The NGiNX layer is OPSEC: blue-team URL classifiers see one domain;
internal routing splits phishlet vs landing by path / referer.
- TLS via Let's Encrypt + `acme.sh`; keep ACME challenges off the
phishlet path.
- SPF / DKIM / DMARC must be correct on the sender domain or modern
inboxes drop the mail. Soundwave's phishing template walks the
operator through DNS setup.
## Deconfliction (mandatory)
Every outbound mail carries an engagement header
(`X-Decepticon-Eng: <slug>`) the SOC allow-lists so simulated phishing
is distinguishable from a real attack. The `lure-deconfliction` skill
is a hard gate before the first send — skipping it is a critical RoE
violation.
## Failsafe
On operator stop or SOC request, wind down within 5 minutes: pause the
GoPhish campaign, return 502 on the evilginx2 phishlet, and repoint the
sender domain to a static "this was an authorized test — contact your
security team" page.
在 GitHub 查看