Skill UI

This guide details the end-to-end process of conducting a sophisticated spearphishing simulation campaign, mirroring real red team adversary techniques. It covers initial OSINT research and pretext development, building weaponized payloads that bypass security controls, setting up robust email infrastructure (SPF/DKIM/DMARC), executing the campaign in waves, and performing detailed post-campaign metrics analysis for comprehensive security reporting.

This guide details the end-to-end process for executing authorized phishing simulations. It instructs security teams and red teams on designing realistic social engineering pretexts, setting up credential harvesting infrastructure (using tools like GoPhish), and measuring key metrics such as open rates, click-through rates, and credential submission rates. It is crucial for assessing organizational human security awareness and testing email security controls (e.g., DMARC, SPF, DKIM).

This comprehensive guide details how to design, deploy, and measure a robust anti-phishing security awareness program. By combining regular simulations, interactive role-based learning modules, and metric tracking, organizations can build a strong security-conscious culture. It covers initial baseline assessments, continuous difficulty scaling, and compliance alignment using industry-leading tools like KnowBe4 and Proofpoint.

EvilGinx3 is an advanced Adversary-in-the-Middle (AiTM) framework designed for red teaming simulations. It goes beyond traditional credential harvesting by acting as a transparent proxy to intercept the entire authentication flow, including session cookies and Multi-Factor Authentication (MFA) tokens. This capability allows security professionals to assess the robustness of an organization's security posture against sophisticated account takeover attacks.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

This skill provides a comprehensive automation solution for conducting red team phishing simulations using the Python gophish library. It streamlines the entire campaign lifecycle, including creating sophisticated email templates with tracking pixels, configuring SMTP profiles, importing user groups from CSV, launching targeted attacks, and generating detailed reports on open rates, click-through rates, and credential submission statistics for robust security awareness assessments.

This skill provides a comprehensive methodology for identifying and exploiting open redirect vulnerabilities in web applications. It covers advanced bypass techniques (e.g., URL encoding, protocol-relative URLs, path traversal) and demonstrates chaining with other flaws like OAuth redirection for advanced phishing simulations and token theft. Designed for authorized security professionals conducting penetration tests.

This skill details the process of building and maintaining a comprehensive anti-phishing training program. It covers establishing baseline susceptibility assessments, deploying regular, progressive simulations, and providing interactive, role-based learning modules (using platforms like KnowBe4 or Proofpoint). The focus is on measuring and improving the human layer of defense against social engineering and sophisticated phishing attempts, thereby fostering a continuous security culture.