You-Got-Phished email & Dynamic Login Webpage added #37
+52,742
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The "You-Got-Phished" pretext uses an all-image email template that is best utilized with the message padding plugin in order to overcome spam filters which target emails with an insufficient text-image ratio. The pretext preys upon users in organizations which actively look for phishing emails or undergoes significant training. The pretext focuses on users' concerns that they fell for a previous phish and redirects them to the landing page.
The message should be formated simply using an inline_image as follows:
<a href="{{ url.webserver }}">{{ inline_image('/path/to/you-got-phished.png') }}</a>
Note that if you utilize a remote-image, and a user's email client does not automatically load remote content, the image will not render. In this instance, it may be beneficial to create a backup pretext in the alt parameter of your img tag, hence why inline_images are recommended.
The Dynamic login page simply uses jinja tags to generate the user's name & pre-fill the username with their email to make it appear as though they have visited the page before. Additionally, if a company logo is supplied in the `./images/logo.png` file, it will be rendered at the top of the login portal to add to its legitimate appearance.
Worked hard on this one. Hope it gets used 🥂