Building out Phishing Capability

2025-07-04 17:07:51 -04:00
parent 41f7d0b46c
commit 8743a4cfdf
16 changed files with 2551 additions and 0 deletions
@@ -0,0 +1,137 @@
+---
+# Advanced evasion techniques for red team phishing
+
+- name: Install advanced evasion tools
+  apt:
+    name:
+      - python3-dnspython
+      - python3-requests
+      - python3-selenium
+      - chromium-browser
+      - chromium-chromedriver
+      - tor
+      - proxychains4
+    state: present
+
+- name: Create SMTP smuggling configuration
+  template:
+    src: "../templates/smtp-smuggling.py.j2"
+    dest: "/root/Tools/phishing/smtp-smuggling.py"
+    mode: '0755'
+    owner: root
+    group: root
+  when: enable_smtp_smuggling | default(false) | bool
+
+- name: Configure SPF bypass techniques
+  template:
+    src: "../templates/spf-bypass.sh.j2"
+    dest: "/root/Tools/phishing/spf-bypass.sh"
+    mode: '0755'
+    owner: root
+    group: root
+  when: enable_spf_bypass | default(false) | bool
+
+- name: Create domain aging simulation
+  template:
+    src: "../templates/domain-aging.py.j2"
+    dest: "/root/Tools/phishing/domain-aging.py"
+    mode: '0755'
+    owner: root
+    group: root
+  when: aged_domain_mode | default(false) | bool
+
+- name: Set up MTA fronting configuration
+  template:
+    src: "../templates/mta-fronting.conf.j2"
+    dest: "/etc/postfix/mta_fronting.cf"
+    mode: '0644'
+    owner: root
+    group: root
+  when: enable_mta_fronting | default(false) | bool
+  notify: restart postfix
+
+- name: Create file format manipulation tools
+  copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0755'
+    owner: root
+    group: root
+  with_items:
+    - { src: "../files/pdf-weaponizer.py", dest: "/root/Tools/phishing/pdf-weaponizer.py" }
+    - { src: "../files/office-macro-generator.py", dest: "/root/Tools/phishing/office-macro-generator.py" }
+    - { src: "../files/lnk-generator.py", dest: "/root/Tools/phishing/lnk-generator.py" }
+
+- name: Create Living off the Land (LOtL) payload templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: root
+    group: root
+  with_items:
+    - { src: "../templates/lotl-powershell.ps1.j2", dest: "/root/Tools/phishing/templates/lotl-powershell.ps1" }
+    - { src: "../templates/lotl-wmic.cmd.j2", dest: "/root/Tools/phishing/templates/lotl-wmic.cmd" }
+    - { src: "../templates/lotl-bitsadmin.cmd.j2", dest: "/root/Tools/phishing/templates/lotl-bitsadmin.cmd" }
+
+- name: Set up CDN abuse configuration
+  template:
+    src: "../templates/cdn-abuse.py.j2"
+    dest: "/root/Tools/phishing/cdn-abuse.py"
+    mode: '0755'
+    owner: root
+    group: root
+  when: enable_cdn_abuse | default(false) | bool
+
+- name: Create domain reputation monitoring
+  template:
+    src: "../templates/reputation-monitor.py.j2"
+    dest: "/root/Tools/phishing/reputation-monitor.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Set up cron job for reputation monitoring
+  cron:
+    name: "Domain reputation monitoring"
+    minute: "0"
+    hour: "*/4"
+    job: "/root/Tools/phishing/reputation-monitor.py >> /root/Tools/phishing/logs/reputation.log 2>&1"
+
+- name: Create email header spoofing tools
+  template:
+    src: "../templates/header-spoofing.py.j2"
+    dest: "/root/Tools/phishing/header-spoofing.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Configure Tor for anonymization
+  template:
+    src: "../templates/torrc-phishing.j2"
+    dest: "/etc/tor/torrc"
+    backup: yes
+  notify: restart tor
+  when: enable_tor_routing | default(false) | bool
+
+- name: Create user-agent rotation script
+  template:
+    src: "../templates/user-agent-rotation.py.j2"
+    dest: "/root/Tools/phishing/user-agent-rotation.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Set up automated evasion techniques
+  template:
+    src: "../templates/automated-evasion.py.j2"
+    dest: "/root/Tools/phishing/automated-evasion.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+handlers:
+  - name: restart tor
+    systemd:
+      name: tor
+      state: restarted
@@ -0,0 +1,111 @@
+---
+# FedRAMP compliance configuration for user awareness testing
+
+- name: Create FedRAMP compliant landing pages
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+  with_items:
+    - { src: "../templates/fedramp-success-page.html.j2", dest: "/var/www/phishing/fedramp-success.html" }
+    - { src: "../templates/fedramp-education-page.html.j2", dest: "/var/www/phishing/fedramp-education.html" }
+    - { src: "../templates/fedramp-training-materials.html.j2", dest: "/var/www/phishing/training.html" }
+
+- name: Create FedRAMP compliant email templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: root
+    group: root
+  with_items:
+    - { src: "../templates/fedramp-email-template.html.j2", dest: "/root/Tools/phishing/templates/fedramp-email.html" }
+    - { src: "../templates/fedramp-notification-email.html.j2", dest: "/root/Tools/phishing/templates/fedramp-notification.html" }
+
+- name: Configure anonymized reporting
+  template:
+    src: "../templates/fedramp-reporting.py.j2"
+    dest: "/root/Tools/phishing/fedramp-reporting.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create role-based tracking system
+  template:
+    src: "../templates/role-tracking.py.j2"
+    dest: "/root/Tools/phishing/role-tracking.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Set up immediate phish identification
+  template:
+    src: "../templates/immediate-identification.js.j2"
+    dest: "/var/www/phishing/assets/immediate-identification.js"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Create educational content delivery system
+  template:
+    src: "../templates/education-delivery.php.j2"
+    dest: "/var/www/phishing/api/education.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Configure compliance database schema
+  shell: |
+    sqlite3 /root/Tools/phishing/compliance.db << EOF
+    CREATE TABLE IF NOT EXISTS fedramp_campaigns (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        csp_organization TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        status TEXT DEFAULT 'active'
+    );
+    
+    CREATE TABLE IF NOT EXISTS role_interactions (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        user_role TEXT NOT NULL,
+        interaction_type TEXT NOT NULL,
+        interaction_time DATETIME DEFAULT CURRENT_TIMESTAMP,
+        education_completed BOOLEAN DEFAULT FALSE
+    );
+    
+    CREATE TABLE IF NOT EXISTS compliance_metrics (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        metric_type TEXT NOT NULL,
+        metric_value INTEGER NOT NULL,
+        recorded_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
+    EOF
+  args:
+    creates: /root/Tools/phishing/compliance.db
+
+- name: Set database permissions for compliance
+  file:
+    path: /root/Tools/phishing/compliance.db
+    owner: www-data
+    group: www-data
+    mode: '0644'
+
+- name: Create compliance report generator
+  template:
+    src: "../templates/compliance-report-generator.py.j2"
+    dest: "/root/Tools/phishing/generate-compliance-report.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Configure email allowlisting instructions
+  template:
+    src: "../templates/allowlist-instructions.md.j2"
+    dest: "/root/Tools/phishing/ALLOWLIST_INSTRUCTIONS.md"
+    mode: '0644'
+    owner: root
+    group: root
@@ -0,0 +1,198 @@
+---
+# Advanced Gophish configuration with enhanced evasion and features
+
+- name: Create Gophish user
+  user:
+    name: gophish
+    system: yes
+    shell: /bin/bash
+    home: /opt/gophish
+    create_home: yes
+
+- name: Download latest Gophish release
+  get_url:
+    url: "https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip"
+    dest: /tmp/gophish.zip
+    mode: '0644'
+
+- name: Extract Gophish
+  unarchive:
+    src: /tmp/gophish.zip
+    dest: /opt/gophish
+    owner: gophish
+    group: gophish
+    remote_src: yes
+
+- name: Install additional packages for advanced features
+  apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - sqlite3
+      - jq
+      - curl
+      - wget
+      - php-fpm
+      - php-sqlite3
+      - nodejs
+      - npm
+    state: present
+
+- name: Configure advanced Gophish settings
+  template:
+    src: "../templates/phishing/gophish-advanced-config.j2"
+    dest: /opt/gophish/config.json
+    owner: gophish
+    group: gophish
+    mode: '0600'
+
+- name: Create enhanced email templates directory
+  file:
+    path: /opt/gophish/templates/{{ item }}
+    state: directory
+    owner: gophish
+    group: gophish
+    mode: '0755'
+  loop:
+    - email
+    - landing
+    - static
+
+- name: Deploy email templates
+  template:
+    src: "../templates/phishing/email-templates/{{ item }}.j2"
+    dest: "/opt/gophish/templates/email/{{ item }}.html"
+    owner: gophish
+    group: gophish
+    mode: '0644'
+  loop:
+    - office365_login
+    - password_expiry
+    - security_alert
+    - file_share
+  when: not fedramp_mode | default(false) | bool
+
+- name: Deploy FedRAMP compliant templates
+  template:
+    src: "../templates/phishing/fedramp-compliance.j2"
+    dest: "/opt/gophish/templates/email/fedramp_template.html"
+    owner: gophish
+    group: gophish
+    mode: '0644'
+  when: fedramp_mode | default(false) | bool
+
+- name: Create advanced landing pages
+  template:
+    src: "../templates/phishing/phishing-landing-page.j2"
+    dest: "/opt/gophish/templates/landing/{{ item }}_landing.html"
+    owner: gophish
+    group: gophish
+    mode: '0644'
+  loop:
+    - office365
+    - generic
+    - fedramp
+  vars:
+    template_type: "{{ item }}"
+
+- name: Install enhanced tracking pixel
+  copy:
+    src: "../files/simple_email_tracker.py"
+    dest: /opt/gophish/tracker.py
+    owner: gophish
+    group: gophish
+    mode: '0755'
+
+- name: Create Gophish database backup script
+  template:
+    src: "../templates/phishing/gophish-backup.sh.j2"
+    dest: /opt/gophish/backup.sh
+    owner: gophish
+    group: gophish
+    mode: '0755'
+
+- name: Set up database backup cron
+  cron:
+    name: "Backup Gophish database"
+    minute: "0"
+    hour: "*/6"
+    job: "/opt/gophish/backup.sh"
+    user: gophish
+
+- name: Create Gophish systemd service
+  template:
+    src: "../templates/phishing/gophish.service.j2"
+    dest: /etc/systemd/system/gophish.service
+    mode: '0644'
+
+- name: Enable and start Gophish service
+  systemd:
+    name: gophish
+    state: started
+    enabled: yes
+    daemon_reload: yes
+
+- name: Create campaign automation script
+  template:
+    src: "../templates/phishing/campaign-automation.py.j2"
+    dest: /opt/gophish/campaign-automation.py
+    owner: gophish
+    group: gophish
+    mode: '0755'
+
+- name: Install Python dependencies for automation
+  pip:
+    name:
+      - requests
+      - python-dateutil
+      - jinja2
+    state: present
+
+- name: Configure SMTP relay to MTA front
+  blockinfile:
+    path: /opt/gophish/config.json
+    marker: "// {mark} ANSIBLE MANAGED SMTP CONFIG"
+    block: |
+      "smtp": {
+        "host": "{{ mta_front_ip }}:587",
+        "username": "{{ smtp_relay_user }}",
+        "password": "{{ smtp_relay_pass }}",
+        "from": "{{ sender_email }}",
+        "ignore_cert_errors": true
+      }
+
+- name: Create phishing metrics dashboard
+  template:
+    src: "../templates/phishing/metrics-dashboard.html.j2"
+    dest: /opt/gophish/static/metrics.html
+    owner: gophish
+    group: gophish
+    mode: '0644'
+
+- name: Set up log aggregation
+  lineinfile:
+    path: /etc/rsyslog.conf
+    line: "local0.*    /var/log/gophish.log"
+    state: present
+  notify: restart rsyslog
+
+- name: Configure log rotation for Gophish
+  copy:
+    dest: /etc/logrotate.d/gophish
+    content: |
+      /var/log/gophish.log {
+          daily
+          missingok
+          rotate 30
+          compress
+          delaycompress
+          notifempty
+          create 0644 gophish gophish
+      }
+
+handlers:
+  - name: restart rsyslog
+    service:
+      name: rsyslog
+      state: restarted
@@ -0,0 +1,151 @@
+---
+# Configure MTA Front server for email relay and SMTP smuggling
+
+- name: Update system packages
+  apt:
+    update_cache: yes
+    upgrade: dist
+
+- name: Install MTA packages
+  apt:
+    name:
+      - postfix
+      - postfix-pcre
+      - dovecot-core
+      - dovecot-imapd
+      - opendkim
+      - opendkim-tools
+      - python3-pip
+      - python3-venv
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - dnsutils
+      - swaks
+      - telnet
+    state: present
+
+- name: Configure Postfix for MTA fronting
+  template:
+    src: "../templates/phishing/postfix-mta-front.j2"
+    dest: /etc/postfix/main.cf
+    backup: yes
+  notify: restart postfix
+
+- name: Configure Postfix master.cf for advanced relaying
+  blockinfile:
+    path: /etc/postfix/master.cf
+    block: |
+      # SMTP smuggling and advanced relay configurations
+      587      inet  n       -       y       -       -       smtpd
+        -o syslog_name=postfix/submission
+        -o smtpd_tls_security_level=encrypt
+        -o smtpd_sasl_auth_enable=yes
+        -o smtpd_tls_wrappermode=no
+        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+        -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+        -o milter_macro_daemon_name=ORIGINATING
+      
+      # SMTP smuggling support
+      cleanup   unix  n       -       y       -       0       cleanup
+        -o header_checks=pcre:/etc/postfix/header_checks
+        -o nested_header_checks=pcre:/etc/postfix/nested_header_checks
+
+- name: Create SMTP smuggling header checks
+  copy:
+    dest: /etc/postfix/header_checks
+    content: |
+      # SMTP smuggling techniques
+      /^Content-Transfer-Encoding:\s*7bit/i REPLACE Content-Transfer-Encoding: 8bit
+      /^Content-Type:\s*text\/plain/i REPLACE Content-Type: text/html
+    mode: '0644'
+  notify: 
+    - reload postfix
+    - postmap header_checks
+
+- name: Create nested header checks for advanced smuggling
+  copy:
+    dest: /etc/postfix/nested_header_checks
+    content: |
+      # Advanced SMTP smuggling patterns
+      /^\s*<script/i IGNORE
+      /^\s*<iframe/i IGNORE
+    mode: '0644'
+  notify:
+    - reload postfix
+    - postmap nested_header_checks
+
+- name: Configure DKIM for domain reputation
+  include_tasks: ../tasks/configure_mail.yml
+
+- name: Create relay authentication
+  copy:
+    dest: /etc/postfix/sasl_passwd
+    content: |
+      {{ phishing_domain }} {{ smtp_relay_user }}:{{ smtp_relay_pass }}
+    mode: '0600'
+    owner: root
+    group: root
+  notify:
+    - postmap sasl_passwd
+    - restart postfix
+
+- name: Configure transport maps for backend routing
+  copy:
+    dest: /etc/postfix/transport
+    content: |
+      {{ phishing_domain }}    smtp:[{{ gophish_ip }}]:25
+      .{{ phishing_domain }}   smtp:[{{ gophish_ip }}]:25
+    mode: '0644'
+  notify:
+    - postmap transport
+    - restart postfix
+
+- name: Install Python SMTP testing tools
+  pip:
+    name:
+      - smtplib-extended
+      - email-validator
+      - faker
+    state: present
+
+- name: Create SMTP smuggling test script
+  template:
+    src: "../templates/phishing/smtp-smuggling-test.py.j2"
+    dest: /root/Tools/smtp-smuggling-test.py
+    mode: '0755'
+
+- name: Create email reputation monitoring script
+  template:
+    src: "../templates/phishing/reputation-monitor.sh.j2"
+    dest: /root/Tools/reputation-monitor.sh
+    mode: '0755'
+
+- name: Set up log monitoring for deliverability
+  cron:
+    name: "Monitor email deliverability"
+    minute: "*/15"
+    job: "/root/Tools/reputation-monitor.sh >> /var/log/reputation.log 2>&1"
+
+handlers:
+  - name: restart postfix
+    service:
+      name: postfix
+      state: restarted
+
+  - name: reload postfix
+    service:
+      name: postfix
+      state: reloaded
+
+  - name: postmap header_checks
+    command: postmap /etc/postfix/header_checks
+
+  - name: postmap nested_header_checks
+    command: postmap /etc/postfix/nested_header_checks
+
+  - name: postmap sasl_passwd
+    command: postmap /etc/postfix/sasl_passwd
+
+  - name: postmap transport
+    command: postmap /etc/postfix/transport
@@ -0,0 +1,157 @@
+---
+# Configure phishing redirector with advanced evasion techniques
+
+- name: Install packages for phishing redirector
+  apt:
+    name:
+      - nginx
+      - nginx-extras
+      - certbot
+      - python3-certbot-nginx
+      - socat
+      - netcat-openbsd
+      - jq
+      - curl
+      - geoip-database
+      - libgeoip1
+      - php-fpm
+      - php-geoip
+    state: present
+
+- name: Configure advanced nginx for phishing redirector
+  template:
+    src: "../templates/phishing/nginx-phishing-redirector.j2"
+    dest: /etc/nginx/sites-available/phishing-redirector
+    mode: '0644'
+  notify: restart nginx
+
+- name: Enable phishing redirector site
+  file:
+    src: /etc/nginx/sites-available/phishing-redirector
+    dest: /etc/nginx/sites-enabled/phishing-redirector
+    state: link
+  notify: restart nginx
+
+- name: Remove default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: restart nginx
+
+- name: Create legitimate website content
+  template:
+    src: "../templates/phishing/legitimate-website.html.j2"
+    dest: /var/www/html/index.html
+    mode: '0644'
+
+- name: Create robots.txt for SEO legitimacy
+  copy:
+    dest: /var/www/html/robots.txt
+    content: |
+      User-agent: *
+      Allow: /
+      Sitemap: https://{{ phishing_subdomain }}.{{ phishing_domain }}/sitemap.xml
+
+- name: Create sitemap for legitimacy
+  template:
+    src: "../templates/phishing/sitemap.xml.j2"
+    dest: /var/www/html/sitemap.xml
+    mode: '0644'
+
+- name: Install MaxMind GeoIP for location-based filtering
+  get_url:
+    url: "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key={{ maxmind_license_key | default('') }}&suffix=tar.gz"
+    dest: /tmp/geoip.tar.gz
+  when: maxmind_license_key is defined
+  ignore_errors: yes
+
+- name: Create security research filtering script
+  template:
+    src: "../templates/phishing/security-filter.lua.j2"
+    dest: /etc/nginx/security-filter.lua
+    mode: '0644'
+
+- name: Configure nginx stream module for advanced traffic analysis
+  template:
+    src: "../templates/phishing/stream-analysis.conf.j2"
+    dest: /etc/nginx/modules-enabled/stream-analysis.conf
+    mode: '0644'
+
+- name: Create phishing campaign analytics
+  template:
+    src: "../templates/phishing/analytics.js.j2"
+    dest: /var/www/html/analytics.js
+    mode: '0644'
+
+- name: Set up legitimate SSL certificate
+  shell: |
+    certbot --nginx -d {{ phishing_subdomain }}.{{ phishing_domain }} \
+    --non-interactive --agree-tos -m {{ letsencrypt_email }}
+  args:
+    creates: /etc/letsencrypt/live/{{ phishing_subdomain }}.{{ phishing_domain }}/fullchain.pem
+  ignore_errors: yes
+
+- name: Create fail2ban configuration for suspicious activity
+  copy:
+    dest: /etc/fail2ban/jail.d/phishing-protection.conf
+    content: |
+      [phishing-scanner-protection]
+      enabled = true
+      port = 80,443
+      filter = phishing-scanner
+      logpath = /var/log/nginx/access.log
+      maxretry = 3
+      bantime = 3600
+      findtime = 300
+
+- name: Create fail2ban filter for security tools
+  copy:
+    dest: /etc/fail2ban/filter.d/phishing-scanner.conf
+    content: |
+      [Definition]
+      failregex = ^<HOST>.*"(GET|POST).*(nmap|nikto|sqlmap|burp|w3af|nessus|openvas).*"
+                  ^<HOST>.*".*User-Agent.*(scanner|bot|crawl|security|test).*"
+                  ^<HOST>.*"(GET|POST).*\.(php|asp|jsp)\?.*"
+      ignoreregex =
+
+- name: Start and enable fail2ban
+  systemd:
+    name: fail2ban
+    state: started
+    enabled: yes
+
+- name: Create traffic monitoring script
+  template:
+    src: "../templates/phishing/traffic-monitor.sh.j2"
+    dest: /root/Tools/traffic-monitor.sh
+    mode: '0755'
+
+- name: Set up traffic monitoring cron
+  cron:
+    name: "Monitor phishing traffic"
+    minute: "*/5"
+    job: "/root/Tools/traffic-monitor.sh >> /var/log/phishing-traffic.log 2>&1"
+
+- name: Configure rate limiting for suspicious patterns
+  blockinfile:
+    path: /etc/nginx/nginx.conf
+    insertbefore: "http {"
+    block: |
+      # Rate limiting zones
+      limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
+      limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
+      
+      # GeoIP configuration
+      geoip_country /usr/share/GeoIP/GeoIP.dat;
+      map $geoip_country_code $allowed_country {
+          default 1;
+          CN 0;
+          RU 0;
+          KP 0;
+      }
+
+handlers:
+  - name: restart nginx
+    service:
+      name: nginx
+      state: restarted
@@ -0,0 +1,296 @@
+---
+# Common tasks for configuring advanced phishing server
+# Supports both red team and FedRAMP compliance modes
+
+- name: Update system packages
+  apt:
+    update_cache: yes
+    upgrade: dist
+
+- name: Install base packages for phishing server
+  apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - postfix
+      - dovecot-core
+      - dovecot-imapd
+      - opendkim
+      - opendkim-tools
+      - sqlite3
+      - git
+      - curl
+      - wget
+      - jq
+      - unzip
+      - python3-pip
+      - python3-venv
+      - nodejs
+      - npm
+      - php-fpm
+      - php-sqlite3
+      - php-curl
+      - php-json
+      - swaks
+      - dnsutils
+      - net-tools
+      - fail2ban
+    state: present
+
+- name: Create phishing tools directory
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+  with_items:
+    - /root/Tools/phishing
+    - /root/Tools/phishing/templates
+    - /root/Tools/phishing/campaigns
+    - /root/Tools/phishing/logs
+    - /var/www/phishing
+    - /var/www/phishing/assets
+    - /var/www/phishing/api
+
+- name: Set up GoPhish directory
+  file:
+    path: /root/Tools/gophish
+    state: directory
+    mode: '0755'
+
+- name: Download latest GoPhish release
+  shell: |
+    LATEST_URL=$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')
+    curl -L "$LATEST_URL" -o /tmp/gophish.zip
+    unzip /tmp/gophish.zip -d /root/Tools/gophish
+    chmod +x /root/Tools/gophish/gophish
+    rm -f /tmp/gophish.zip
+  args:
+    creates: /root/Tools/gophish/gophish
+
+- name: Create advanced GoPhish configuration
+  template:
+    src: "../templates/advanced-gophish-config.j2"
+    dest: "/root/Tools/gophish/config.json"
+    mode: '0600'
+    owner: root
+    group: root
+
+- name: Create GoPhish systemd service
+  template:
+    src: "../templates/gophish.service.j2"
+    dest: "/etc/systemd/system/gophish.service"
+    mode: '0644'
+    owner: root
+    group: root
+
+- name: Configure Postfix for outbound email
+  template:
+    src: "../templates/postfix-phishing.conf.j2"
+    dest: "/etc/postfix/main.cf"
+    backup: yes
+  notify: restart postfix
+
+- name: Configure OpenDKIM for email authentication
+  template:
+    src: "../templates/opendkim-phishing.conf.j2"
+    dest: "/etc/opendkim.conf"
+    backup: yes
+  notify: restart opendkim
+
+- name: Create DKIM keys directory
+  file:
+    path: "/etc/opendkim/keys/{{ phishing_domain }}"
+    state: directory
+    owner: opendkim
+    group: opendkim
+    mode: '0700'
+
+- name: Generate DKIM keys
+  command: >
+    opendkim-genkey -D /etc/opendkim/keys/{{ phishing_domain }} 
+    -d {{ phishing_domain }} -s phishing
+  args:
+    creates: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
+
+- name: Set DKIM key permissions
+  file:
+    path: "/etc/opendkim/keys/{{ phishing_domain }}/phishing.private"
+    owner: opendkim
+    group: opendkim
+    mode: '0600'
+
+- name: Create phishing landing page templates
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+  with_items:
+    - { src: "../templates/phishing-landing-office365.html.j2", dest: "/var/www/phishing/office365.html" }
+    - { src: "../templates/phishing-landing-gmail.html.j2", dest: "/var/www/phishing/gmail.html" }
+    - { src: "../templates/phishing-landing-aws.html.j2", dest: "/var/www/phishing/aws.html" }
+    - { src: "../templates/phishing-landing-generic.html.j2", dest: "/var/www/phishing/generic.html" }
+
+- name: Create credential capture API
+  template:
+    src: "../templates/credential-capture-api.php.j2"
+    dest: "/var/www/phishing/api/capture.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Create tracking pixel endpoint
+  template:
+    src: "../templates/tracking-pixel.php.j2"
+    dest: "/var/www/phishing/track.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Configure Nginx for phishing sites
+  template:
+    src: "../templates/nginx-phishing.conf.j2"
+    dest: "/etc/nginx/sites-available/phishing"
+    mode: '0644'
+  notify: reload nginx
+
+- name: Enable phishing site
+  file:
+    src: /etc/nginx/sites-available/phishing
+    dest: /etc/nginx/sites-enabled/phishing
+    state: link
+  notify: reload nginx
+
+- name: Create phishing campaign management scripts
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: '0755'
+    owner: root
+    group: root
+  with_items:
+    - { src: "../templates/campaign-launcher.sh.j2", dest: "/root/Tools/phishing/launch-campaign.sh" }
+    - { src: "../templates/stats-collector.sh.j2", dest: "/root/Tools/phishing/collect-stats.sh" }
+    - { src: "../templates/email-validator.py.j2", dest: "/root/Tools/phishing/validate-emails.py" }
+
+- name: Create database for tracking
+  shell: |
+    sqlite3 /root/Tools/phishing/tracking.db << EOF
+    CREATE TABLE IF NOT EXISTS email_opens (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        recipient_email TEXT NOT NULL,
+        ip_address TEXT,
+        user_agent TEXT,
+        opened_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        location TEXT
+    );
+    
+    CREATE TABLE IF NOT EXISTS link_clicks (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        recipient_email TEXT NOT NULL,
+        link_url TEXT NOT NULL,
+        ip_address TEXT,
+        user_agent TEXT,
+        clicked_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        location TEXT
+    );
+    
+    CREATE TABLE IF NOT EXISTS credential_submissions (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        campaign_id TEXT NOT NULL,
+        recipient_email TEXT,
+        username TEXT,
+        password_hash TEXT,
+        ip_address TEXT,
+        user_agent TEXT,
+        submitted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        location TEXT,
+        additional_data TEXT
+    );
+    
+    CREATE TABLE IF NOT EXISTS campaigns (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        template TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        status TEXT DEFAULT 'active',
+        target_count INTEGER DEFAULT 0,
+        opened_count INTEGER DEFAULT 0,
+        clicked_count INTEGER DEFAULT 0,
+        submitted_count INTEGER DEFAULT 0
+    );
+    EOF
+  args:
+    creates: /root/Tools/phishing/tracking.db
+
+- name: Set database permissions
+  file:
+    path: /root/Tools/phishing/tracking.db
+    owner: www-data
+    group: www-data
+    mode: '0644'
+
+- name: Install Python dependencies for advanced features
+  pip:
+    name:
+      - requests
+      - beautifulsoup4
+      - lxml
+      - flask
+      - flask-cors
+      - dnspython
+      - python-whois
+      - selenium
+      - fake-useragent
+    state: present
+
+- name: Create SSL certificate setup script
+  template:
+    src: "../templates/setup-phishing-ssl.sh.j2"
+    dest: "/root/Tools/phishing/setup-ssl.sh"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create domain reputation checker
+  template:
+    src: "../templates/domain-reputation.py.j2"
+    dest: "/root/Tools/phishing/check-reputation.py"
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Start and enable services
+  systemd:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+    daemon_reload: yes
+  with_items:
+    - postfix
+    - opendkim
+    - nginx
+    - php7.4-fpm
+    - gophish
+
+handlers:
+  - name: restart postfix
+    systemd:
+      name: postfix
+      state: restarted
+
+  - name: restart opendkim
+    systemd:
+      name: opendkim
+      state: restarted
+
+  - name: reload nginx
+    systemd:
+      name: nginx
+      state: reloaded
@@ -0,0 +1,183 @@
+---
+# Configure security groups and firewall rules for phishing infrastructure
+
+- name: Configure MTA Front security
+  block:
+    - name: Create MTA Front security group
+      amazon.aws.ec2_security_group:
+        name: "mta-front-{{ deployment_id }}"
+        description: "Security group for MTA Front server"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # SMTP services - public facing
+          - proto: tcp
+            ports: 25
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "SMTP from anywhere"
+          
+          - proto: tcp
+            ports: 587
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "SMTP submission"
+          
+          - proto: tcp
+            ports: 465
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "SMTPS"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.mta_front | default(false) | bool
+
+- name: Configure Gophish security (hidden backend)
+  block:
+    - name: Create Gophish security group
+      amazon.aws.ec2_security_group:
+        name: "gophish-{{ deployment_id }}"
+        description: "Security group for Gophish server (hidden)"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access only
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          - proto: tcp
+            ports: 3333
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "Gophish admin interface"
+          
+          # Internal communication only
+          - proto: tcp
+            ports: 80
+            cidr_ip: "{{ phishing_redirector_ip }}/32"
+            rule_desc: "HTTP from phishing redirector"
+          
+          - proto: tcp
+            ports: 25
+            cidr_ip: "{{ mta_front_ip }}/32"
+            rule_desc: "SMTP from MTA front"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.gophish | default(false) | bool
+
+- name: Configure Phishing Redirector security (public facing)
+  block:
+    - name: Create Phishing Redirector security group
+      amazon.aws.ec2_security_group:
+        name: "phish-redirector-{{ deployment_id }}"
+        description: "Security group for Phishing Redirector"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # Public web access
+          - proto: tcp
+            ports: 80
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "HTTP from anywhere"
+          
+          - proto: tcp
+            ports: 443
+            cidr_ip: "0.0.0.0/0"
+            rule_desc: "HTTPS from anywhere"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.phishing_redirector | default(false) | bool
+
+- name: Configure Phishing Web Server security (hidden backend)
+  block:
+    - name: Create Phishing Web Server security group
+      amazon.aws.ec2_security_group:
+        name: "phish-webserver-{{ deployment_id }}"
+        description: "Security group for Phishing Web Server (hidden)"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access only
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # Internal communication only
+          - proto: tcp
+            ports: 80
+            cidr_ip: "{{ phishing_redirector_ip }}/32"
+            rule_desc: "HTTP from phishing redirector"
+          
+          - proto: tcp
+            ports: 443
+            cidr_ip: "{{ phishing_redirector_ip }}/32"
+            rule_desc: "HTTPS from phishing redirector"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.phishing_webserver | default(false) | bool
+
+- name: Configure Payload Server security (hidden backend)
+  block:
+    - name: Create Payload Server security group
+      amazon.aws.ec2_security_group:
+        name: "payload-server-{{ deployment_id }}"
+        description: "Security group for Payload Server (hidden)"
+        vpc_id: "{{ vpc_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          # Management access only
+          - proto: tcp
+            ports: 22
+            cidr_ip: "{{ operator_ip }}/32"
+            rule_desc: "SSH from operator"
+          
+          # Internal communication only
+          - proto: tcp
+            ports: 80
+            cidr_ip: "{{ payload_redirector_ip }}/32"
+            rule_desc: "HTTP from payload redirector"
+          
+          - proto: tcp
+            ports: 443
+            cidr_ip: "{{ payload_redirector_ip }}/32"
+            rule_desc: "HTTPS from payload redirector"
+        
+        rules_egress:
+          - proto: -1
+            cidr_ip: "0.0.0.0/0"
+        state: present
+      when: deployment_components.payload_server | default(false) | bool
+
+- name: Display security configuration summary
+  debug:
+    msg:
+      - "Phishing Infrastructure Security Configuration"
+      - "============================================="
+      - "✓ Least privilege access implemented"
+      - "✓ Backend servers hidden from public access"
+      - "✓ Only redirectors/MTA fronts are publicly accessible"
+      - "✓ Operator-only SSH access configured"
+      - "✓ Internal communication secured"