Dark-Phish: A Phishing Tool for Security Assessment

Hack accounts with the Dark-Phish tool.

What is phishing?

Phishing is a deceptive cyberattack technique that involves impersonating trustworthy entities to trick individuals into revealing their confidential information. Attackers often use emails, websites, or other communication channels to create a false sense of trust and persuade their targets to provide sensitive data such as usernames, passwords, or financial details. Phishing is a significant cybersecurity threat, and understanding its tactics is vital for protecting oneself and organizations from potential harm.

Dark-Phish: Empowering Ethical Phishing for Security Assessment.

Dark-Phish is a powerful phishing tool designed for educational and security assessment purposes. It provides users with a range of features and capabilities to simulate and assess phishing attacks, enhancing security awareness.

Dark-Phish has been tested on Kali Linux and Android, but it may also work on other operating systems.

Features of Dark-Phish

• Phishing Pages: Dark-Phish offers over 50 phishing pages and a customizable phishing template to simulate various scenarios.
• OTP Capture: It allows the capture of one-time passwords (OTPs) for improved security assessment.
• Tunneling Options: Multiple tunneling options, including ngrok, cloudflared, localxpose, servio, and more, for flexible attack simulations.
• URL Obfuscation: Dark-Phish can obfuscate phishing URLs to make them appear more trusted and less suspicious.
• Credential Management: It automatically saves credentials in a database. User can easy access and manage the saved data.

Dark-Phish is intended for responsible and ethical use, strictly for educational and testing purposes. Any illegal or unethical activities are prohibited, and users are advised to comply with applicable laws and regulations.

Installing Dark-Phish

Install Required Packages -

Install the necessary packages and dependencies.

apt install python3 -y

 

apt install curl -y

 

apt install php -y

 

apt install git -y

 

apt install openssh -y

 

Install Python Packages -

Ensure you have pip3 installed. If not, you can install it with:

apt install python3-pip -y

Then, install the required Python packages-

pip3 install requests wget pyshorteners

Clone the Dark-Phish Repository -

git clone https://github.com/Cyber-Anonymous/Dark-Phish.git

Navigate to the Dark-Phish Directory -

cd Dark-Phish

To Run the Dark-Phish tool-

python3 dark-phish.py

When using Dark-Phish, you gain access to an extensive library of over 50 phishing templates. To begin, select the phishing template that aligns with your intended scenario, and enter the corresponding number in the 'OPTION' section.
Next, you'll be prompted to choose the tunneling service you want to utilize for hosting your phishing page. Dark-Phish offers multiple tunneling options for your convenience.

Once you've made your selection, Dark-Phish will automatically download the necessary components for hosting. Depending on the service, you may be asked to provide an authentication token. In the case of ngrok, simply enter the token; there's no need for 'ngrok config add-authtoken.'
After successful configuration, Dark-Phish initiates a local host on port 8080 and starts the chosen hosting service to make your phishing page accessible over the internet.

But that's not all; Dark-Phish goes the extra mile. It provides an option for URL masking or obfuscation. If you wish to modify the URL to make it less suspicious, enter 'y' when prompted. Dark-Phish will generate a masked link for you to use.
With your link ready, it's time to engage your target. Share the link, and when they log in, Dark-Phish captures their credentials. But that's not the end of the story.

If you're aiming to obtain one-time passwords (OTPs) from your target, Dark-Phish has you covered. When your target logs in using their phone number, email, or username, their credentials are sent your way. Then, the victim is redirected to an OTP page.
Here's where you make your move: visit the legitimate site and input the credentials you've obtained. The original site will send the OTP to the victim's credentials (the ones you have). When the victim enters the OTP in the designated field, Dark-Phish captures it. Now, quickly proceed to the legitimate site and submit the OTP.
With these seamless steps, Dark-Phish empowers you to efficiently capture credentials and OTPs for your security assessments and testing.