SocialFish

Phishing Tool & Information Collector

4,841

1,434

4,841

View on GitHub

Top Related Projects

social-engineer-toolkit

15,108

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.

zphisher

16,485

An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !

maskphish

3,157

Introducing "URL Making Technology" to the world for the very FIRST TIME. Give a Mask to Phishing URL like a PRO.. A MUST have tool for Phishing.

evilginx2

15,346

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Quick Overview

SocialFish is an educational tool designed to demonstrate the risks of phishing attacks. It creates fake login pages that mimic popular social media platforms and websites, capturing entered credentials for educational purposes. The project aims to raise awareness about online security and the importance of verifying website authenticity.

Pros

Provides a hands-on learning experience for cybersecurity education
Supports multiple templates for various popular websites
Includes both command-line and graphical user interfaces
Regularly updated to maintain effectiveness and relevance

Cons

Can be misused for malicious purposes if not handled responsibly
Requires careful legal and ethical considerations before use
May not accurately represent all aspects of real-world phishing attacks
Limited to specific pre-defined templates

Getting Started

To set up and run SocialFish:

Clone the repository:

git clone https://github.com/UndeadSec/SocialFish.git

Navigate to the project directory:
```
cd SocialFish
```
Install dependencies:
```
pip3 install -r requirements.txt
```
Run the tool:
```
python3 SocialFish.py
```
Follow the on-screen prompts to select a template and start the phishing simulation.

Note: Always use this tool responsibly and only in controlled, authorized environments for educational purposes. Ensure you have proper permissions and comply with all relevant laws and regulations.

Competitor Comparisons

social-engineer-toolkit

15,108

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.

Pros of social-engineer-toolkit

More comprehensive toolkit with a wider range of social engineering attacks
Actively maintained with regular updates and contributions
Extensive documentation and community support

Cons of social-engineer-toolkit

Steeper learning curve due to its complexity
Requires more setup and dependencies
May be overkill for simple phishing campaigns

Code Comparison

SocialFish (Python):

def runPhishing(social, custom):
    system('rm -Rf base/Server/www/*.* && touch base/Server/www/index.html')
    if social == "Facebook":
        system('cp base/WebPages/fb_standard/*.* base/Server/www/')
    if custom == True:
        print(cyan("\n[*] Custom server"))

social-engineer-toolkit (Python):

def site_cloner(website, exportpath, *args):
    grab_ipaddress()
    ipaddr = grab_ipaddress()
    filewrite = open(setdir + "/ipaddr.txt", "w")
    filewrite.write(ipaddr)
    filewrite.close()
    subprocess.Popen("wget -c -r -l1 -O " + setdir + "/web_clone/index.html --no-check-certificate " + website, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True).wait()

Both tools use Python for their core functionality, but social-engineer-toolkit offers more advanced features and a broader scope of social engineering techniques.

zphisher

16,485

An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !

Pros of zphisher

More frequent updates and active development
Supports a wider range of phishing templates (30+)
Includes built-in tunneling options (Cloudflared, Ngrok)

Cons of zphisher

Less focus on social engineering aspects
May require more manual setup for some features
Potentially less stable due to rapid development

Code Comparison

SocialFish:

def runPhishing(social, custom):
    system('rm -Rf base/Server/www/*.* && touch base/Server/www/index.html')
    if social == "Facebook":
        system('cp base/WebPages/fb_standard/*.* base/Server/www/')
    if custom == True:
        print(cyan("\n[*] Custom Folder found. Please note that you need to have index.html in your "
                   "folder!"))

zphisher:

tunnel_menu() {
    if [[ -e ".cld.log" ]]; then
        rm -rf ".cld.log"
    fi
    printf "\n${RED}[${WHITE}-${RED}]${GREEN} Select a Port Forwarding Service:\n"
    printf "\n${RED}[${WHITE}01${RED}]${ORANGE} Localhost    ${RED}[${CYAN}For Developers${RED}]"
    printf "\n${RED}[${WHITE}02${RED}]${ORANGE} Ngrok.io     ${RED}[${CYAN}Best${RED}]"
    printf "\n${RED}[${WHITE}03${RED}]${ORANGE} Cloudflared  ${RED}[${CYAN}New${RED}]"
    printf "\n"
    read -p "${RED}[${WHITE}-${RED}]${GREEN} Select a Port Forwarding Service: ${BLUE}"

Both repositories focus on creating phishing pages, but their implementations differ. SocialFish uses Python and emphasizes social engineering, while zphisher is written in Bash and offers more templates and tunneling options. The code snippets show these differences in approach and functionality.

maskphish

3,157

Introducing "URL Making Technology" to the world for the very FIRST TIME. Give a Mask to Phishing URL like a PRO.. A MUST have tool for Phishing.

Pros of maskphish

Simpler and more lightweight tool focused specifically on URL masking
Easier to set up and use for quick phishing campaigns
Generates masked links that can be shared directly

Cons of maskphish

Less comprehensive feature set compared to SocialFish
Lacks advanced customization options for phishing pages
No built-in support for capturing and storing credentials

Code comparison

maskphish:

url_checker() {
    if [ ! "${1//:*}" = http ]; then
        if [ ! "${1//:*}" = https ]; then
            echo -e "\e[31m[!] Invalid URL. Please use http or https.\e[0m"
            exit 1
        fi
    fi
}

SocialFish:

def runPhishing(social, custom):
    system('rm -Rf base/Server/www/*.* && touch base/Server/www/index.html')
    if social == "custom":
        print(custom)
        system('cp base/WebPages/custom/* base/Server/www/')
    else:
        system('cp base/WebPages/%s/* base/Server/www/' % social)

The code snippets show that maskphish focuses on URL validation, while SocialFish handles phishing page setup and customization. This reflects the different scopes and approaches of the two tools.

gophish

14,131

Open-Source Phishing Toolkit

Pros of Gophish

More comprehensive and feature-rich phishing simulation platform
Better suited for enterprise-level security testing and training
Actively maintained with regular updates and a larger community

Cons of Gophish

Steeper learning curve due to more complex setup and configuration
Requires more resources to run and manage effectively
Less focused on social media phishing compared to SocialFish

Code Comparison

SocialFish (Python):

def runPhishing(social, custom):
    system('rm -Rf base/Server/www/*.* && touch base/Server/www/index.html')
    if social == "Facebook":
        system('cp base/WebPages/fb_standard/*.* base/Server/www/')
    if custom == True:
        print(custom_folder)

Gophish (Go):

func (s *Server) handleLanding(w http.ResponseWriter, r *http.Request) {
    ps := struct {
        Title    string
        Org      string
        Custom   interface{}
        URL      string
        Redirect string
    }{Title: "Landing Page", Org: "Gophish", URL: r.URL.String()}
    getTemplate(w, "landing").Execute(w, ps)
}

The code snippets show that SocialFish focuses on specific social media platforms, while Gophish provides a more generalized approach to creating phishing campaigns. Gophish's code demonstrates its flexibility in handling various landing page scenarios.

evilginx2

15,346

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Pros of evilginx2

More advanced and feature-rich phishing framework
Supports multiple phishing scenarios and customizable templates
Capable of bypassing two-factor authentication (2FA)

Cons of evilginx2

Steeper learning curve and more complex setup
Requires more technical knowledge to operate effectively
May be overkill for simpler phishing campaigns

Code Comparison

SocialFish (Python):

def runPhishing(social, custom):
    system('sudo docker-compose up -d')
    if social:
        system('sudo docker-compose exec socialfish python3 SocialFish.py ' + social)
    elif custom:
        system('sudo docker-compose exec socialfish python3 SocialFish.py custom')

evilginx2 (Go):

func (p *Phishlet) GetLureUrls(domain string) ([]string, error) {
    var ret []string
    for _, au := range p.authUrls {
        ret = append(ret, "https://"+domain+au)
    }
    return ret, nil
}

SocialFish is simpler and easier to use, focusing on social media phishing. evilginx2 offers more advanced features and flexibility but requires more expertise. SocialFish uses Python and Docker, while evilginx2 is written in Go. evilginx2's code demonstrates its capability to handle multiple phishing scenarios, whereas SocialFish's code shows a more straightforward approach to launching phishing campaigns.

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

SocialFish v3.0

Modern Dynamic Phishing Toolkit

SocialFish v3.0 brings powerful new features for cloning modern login pages, capturing cookies, and intercepting 2FA codes with a live operator panel.

ð What's New in v3.0

Playwright Browser Automation â Clone modern JS-heavy login pages
Full Cookie Capture & Analysis â Detailed metadata, security attributes, auth tokens
Template System â Save and reuse clones across multiple victims
Live OTP Interception Panel â Real-time 2FA code capture and injection
MITM Reverse Proxy â ngrok/cloudflared tunneling with auto-installation
6 Clone Modes â Login-only, cookies-only, or full capture
Multi-step Login Detection â Automatic heuristics for complex flows (Office365, etc.)
Webhook Notifications â Real-time alerts to Slack, Discord, custom APIs
Session Management â Full session tracking with export to JSON/CSV
Network Interception â Log all HTTP requests/responses
Victim Tracking â Track clicks, IP addresses, geolocation, device type

ð Documentation

FEATURES_v3.md â Complete feature guide with workflows
IMPLEMENTATION_SUMMARY.md â Technical implementation details
Wiki â Original setup and advanced guides

ð Quick Start

Option 1: Interactive Setup (Recommended)

python setup.py

This will:

Install all dependencies
Setup Playwright browsers
Initialize database
Configure tunneling (optional)
Display quick-start guide

Option 2: Manual Setup

pip install -r requirements.txt
playwright install chromium
python SocialFish.py admin password

Then access: http://localhost:5000/neptune

ð¯ Basic Workflow

Create Template

/templates â New Template â Enter target URL

Setup Tunnel (optional, for remote testing)

Click "Tunnel" â Choose ngrok/cloudflared â Authorize

Generate Lure URL

Click "Lure" â Copy unguessable URL

Send to Victims

Distribute lure URL in emails, messages, etc.

Monitor in Real-Time

/sessions â View captured credentials, cookies, OTP codes
/admin/otp_panel.html â Intercept & inject 2FA codes

ð§ Key Features

Templates Library

Save clone configurations
Reuse across multiple users
Clone modes: both (credentials + cookies), login (credentials only), cookies (session only)
Browser engines: Playwright (default), Selenium (optional)

Cookie Capture

Full cookie jar (domain, path, secure, httponly, samesite, expiry)
JavaScript cookie interception
Auth token detection
Security attribute analysis
Export to JSON/CSV

Live OTP Panel

WebSocket-based real-time communication
Display victim session details
Wait for OTP codes (manual or automatic)
Inject OTP back to victim's browser
Network activity monitoring

MITM & Reverse Proxy

Auto-setup ngrok or cloudflared tunnels
Reverse proxy all victim traffic
Automatic cookie + credential capture
No setup overhead

Webhook Notifications

Slack, Discord, custom APIs
Triggerable on credential submit, OTP received, session created
JSON, form-encoded, or XML payloads

Multi-step & 2FA Detection

Automatic heuristics for complex flows
OTP endpoint detection
Manual breakpoints for user interaction
2FA indicators in analytics

ð Supported Sites

Works with any login page that uses:

â HTML forms
â JavaScript form submission
â XHR/fetch-based authentication
â SPA logins (React, Vue, Angular)
â 2FA/OTP flows
â Multi-step authentication (Office365, Gmail, GitHub, etc.)

ð API & CLI

Web API

# List templates
curl http://localhost:5000/templates

# Generate lure URL
curl -X POST http://localhost:5000/lure/generate \
  -d "template_id=1"

# View session
curl http://localhost:5000/session/1

CLI Commands

# Setup
python setup.py                    # Interactive setup

# Tunneling
python core/tunnel_manager.py setup
python core/tunnel_manager.py start --type ngrok

# Database
python core/db_migration.py

ð Project Structure

SocialFish/
âââ SocialFish.py               # Main Flask app
âââ setup.py                    # Interactive setup wizard
âââ FEATURES_v3.md             # Feature documentation
âââ IMPLEMENTATION_SUMMARY.md   # Technical details
âââ core/
â   âââ recorder_playwright.py  # Browser automation
â   âââ cookie_inspector.py     # Cookie analysis
â   âââ tunnel_manager.py       # Tunneling support
â   âââ db_migration.py         # Database schema
â   âââ ... (other modules)
âââ templates/
    âââ admin/
        âââ templates.html      # Templates library UI
        âââ otp_panel.html     # OTP interception UI
        âââ sessions.html       # Session management UI
        âââ ... (other templates)

ð Security & Ethics

â ï¸ EDUCATIONAL USE ONLY

â Consent Required â Only test systems you own or have explicit written permission for
â Audit Logging â All operations logged with user attribution
â Data Protection â Implement proper data retention policies
â GDPR Compliance â Comply with local privacy regulations
â Disclosure â Report vulnerabilities responsibly

See CODE_OF_CONDUCT.md and LICENSE for details.

ð± Mobile Controller

Looking for the mobile controller? Check SocialFishMobile

âï¸ Disclaimer

TO BE USED FOR EDUCATIONAL PURPOSES ONLY

The use of the SocialFish is COMPLETE RESPONSIBILITY of the END-USER. Developers assume NO liability and are NOT responsible for any misuse or damage caused by this program.

"DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."

Taken from LICENSE.

ð³ Docker

Run with Docker:

docker compose up

Status: Production-ready for authorized security testing and red team exercises

CONTRIBUTING

We encourage you to contribute to SocialFish! Please check out the Contributing to SocialFish guide for guidelines about how to proceed. Join us!

Special Contributors

@carinamary2448 - https://github.com/carinamary2448

Top Related Projects

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

Top Related Projects

Quick Overview

Pros

Cons

Getting Started

Competitor Comparisons

Pros of social-engineer-toolkit

Cons of social-engineer-toolkit

Code Comparison

Pros of zphisher

Cons of zphisher

Code Comparison

Pros of maskphish

Cons of maskphish

Code comparison

Pros of Gophish

Cons of Gophish

Code Comparison

Pros of evilginx2

Cons of evilginx2

Code Comparison

Convert designs to code with AI

README

SocialFish v3.0

Modern Dynamic Phishing Toolkit

ð What's New in v3.0

ð Documentation

ð Quick Start

Option 1: Interactive Setup (Recommended)

Option 2: Manual Setup

ð¯ Basic Workflow

ð§ Key Features

Templates Library

Cookie Capture

Live OTP Panel

MITM & Reverse Proxy

Webhook Notifications

Multi-step & 2FA Detection

ð Supported Sites

ð API & CLI

Web API

CLI Commands

ð Project Structure

ð Security & Ethics

ð± Mobile Controller

âï¸ Disclaimer

ð³ Docker

CONTRIBUTING

Special Contributors

Top Related Projects

Convert designs to code with AI

ð What's New in v3.0

ð Documentation

ð Quick Start

ð¯ Basic Workflow

ð§ Key Features

ð Supported Sites

ð API & CLI

ð Project Structure

ð Security & Ethics

ð± Mobile Controller

âï¸ Disclaimer

ð³ Docker