security-labs

🎣 Project 01 — Phishing Attack Simulation

Simulated phishing campaigns to assess organisational vulnerability and improve security awareness.

---

🎯 Objective

Built controlled phishing awareness campaigns using GoPhish to simulate real-world credential harvesting and social engineering attacks — in a lab environment — to measure how susceptible teams are to phishing and improve their response.

---

🔧 Lab Setup

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│   Attacker VM   │────▶│  GoPhish Server  │────▶│   Target Email  │
│  (VirtualBox)   │     │   (SMTP Setup)   │     │   (Lab Accts)   │
└─────────────────┘     └─────────────────┘     └─────────────────┘
                              │
                              ▼
                    ┌─────────────────┐
                    │ Landing Page    │
                    │ (Fake Login)    │
                    └─────────────────┘
                              │
                              ▼
                    ┌─────────────────┐
                    │ Creds Captured  │
                    │ (GoPhish Panel) │
                    └─────────────────┘

---

🧪 Methodology

1. Reconnaissance
   • Collected publicly available email patterns from LinkedIn (lab accounts only)
   • Identified email service providers and mail security configurations
2. Campaign Design
   • Created convincing email templates mimicking common services (Google, Microsoft)
   • Built pixel-perfect login phishing pages using HTML/CSS
   • Configured GoPhish with proper SMTP routing
3. Execution
   • Sent phishing emails to controlled lab accounts
   • Tracked: open rates, link clicks, credential submissions, session duration
4. Metrics Captured
   • Open rate %
   • Link click rate %
   • Credential submission rate %
   • Time spent on phishing page
5. Findings
   • Identified which email subject lines had highest open rates
   • Measured average time before users reported suspicious activity
   • Documented which departments were most vulnerable

---

📊 Results

Metric	Value
Emails Sent	50 (lab accounts)
Open Rate	~65%
Link Click Rate	~40%
Credential Submission	~25%
Reported to IT	<10%

---

🛡️ Defensive Recommendations (Documented)

• Implement DMARC, DKIM, SPF email authentication
• Deploy email filtering rules for known phishing domains
• Conduct quarterly phishing awareness training
• Enable MFA on all corporate accounts
• Set up real-time email threat detection in SIEM

---

🔧 Tech Stack

GoPhish · VirtualBox · HTML/CSS · SMTP · Social Engineering

---

📁 Folder Structure

phishing-simulation/
├── README.md
├── methodology.md
└── (lab-notes.txt — private, not uploaded)

---

⚠️ Disclaimer

This project was conducted entirely within a controlled lab environment. All target accounts were owned by me or set up with explicit written consent. No attacks were launched against any system without permission.