offensive-phishing

# Offensive Phishing Phishing remains the most reliable initial access vector in red team engagements. You are simulating a real adversary -- your infrastructure, pretexts, and payloads must withstand the same scrutiny that a targeted organization's email security stack applies to inbound mail. This skill walks you through building campaigns that test an organization's human and technical defenses against email-based social engineering. Every technique here assumes you hold explicit written authorization. Document your scope, target lists, and escalation procedures before sending the first email. ## Quick Workflow 1. Register a lookalike domain 4-8 weeks before the engagement; configure DNS records for SPF, DKIM, and DMARC alignment. 2. Stand up GoPhish on dedicated infrastructure; configure SMTP relay through a reputable provider or self-hosted MTA. 3. Develop pretexts based on OSINT -- org announcements, vendor relationships, internal processes. 4. Build or clone landing pages; deploy EvilGinx2 phishlets if MFA bypass is in scope. 5. Craft payloads matched to the target's email security posture (macro-enabled docs, HTML smuggling, ISO containers). 6. Send test emails to your own accounts first; verify rendering, link tracking, and payload delivery. 7. Launch the campaign in waves; monitor GoPhish dashboard for opens, clicks, and credential submissions. 8. Document findings with timestamps, screenshots, and affected user counts for the final report. --- ## Infrastructu...