{"id":14638041,"url":"https://github.com/tib36/PhishingBook","last_synced_at":"2025-09-07T06:32:02.916Z","repository":{"id":153849196,"uuid":"630446651","full_name":"tib36/PhishingBook","owner":"tib36","description":"红蓝对抗：钓鱼演练资源汇总\u0026备忘录","archived":false,"fork":false,"pushed_at":"2024-11-06T08:26:47.000Z","size":18,"stargazers_count":978,"open_issues_count":0,"forks_count":102,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-11-06T09:18:12.938Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tib36.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-04-20T11:58:15.000Z","updated_at":"2024-11-06T08:26:51.000Z","dependencies_parsed_at":null,"dependency_job_id":"4f5bea0a-c4e6-4cd7-bea0-f6ee7e4cdfcf","html_url":"https://github.com/tib36/PhishingBook","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tib36%2FPhishingBook","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tib36%2FPhishingBook/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tib36%2FPhishingBook/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tib36%2FPhishingBook/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tib36","download_url":"https://codeload.github.com/tib36/PhishingBook/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":232183047,"owners_count":18484725,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-10T02:01:33.955Z","updated_at":"2025-01-02T10:31:26.110Z","avatar_url":"https://github.com/tib36.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n     \u003ch2\u003ePhishingBook \u003c/h2\u003e\n     \u003ca href=\"https://github.com/tib36/PhishingBook\"\u003e \u003cimg src=\"https://badgen.net/github/stars/tib36/PhishingBook?icon=github\u0026color=black\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/tib36/PhishingBook\"\u003e \u003cimg src=\"https://badgen.net/github/forks/tib36/PhishingBook?icon=github\u0026color=black\"\u003e\u003c/a\u003e\n    \u003cbr\u003e\n    \u003cbr\u003e\n    \u003cimg src=\"https://nssctf.wdf.ink//img/WDTJ/202305010317162.png\" width=\"300px\"\u003e\n     \u003ch4\u003e红蓝对抗：钓鱼演练资源汇总\u0026amp;备忘录\u003c/h4\u003e\n       \u003c/div\u003e \n\n#### 目录\n- [Office历史漏洞](#分类Office历史漏洞)\n- [钓鱼辅助工具项目](#分类钓鱼辅助工具项目)\n- [免杀项目](#分类免杀项目)\n- [用于参考的C2项目](#分类用于参考的C2项目)\n- [红队相关其他项目](#分类红队相关其他项目)\n- [蓝队反钓鱼资源](#分类蓝队反钓鱼资源)\n- [杂项堆积](#分类杂项堆积)\n\n\n#### 关于\n\n本项目收集来自网络（主要是github）的钓鱼相关的资源，其中许多来自作者在攻防演练一线的经验，故列出谨供后人参考。\n\n简单粗暴，基本上仅提供分类、链接和简介\n\n持续更新中。。\n\n**如果有帮助，建议师傅顺手点个免费的Star**\n\n**注：**\n\n本项目出现的资源均收集自公开网络，本项目作者未提供且不提供任何相关技术\n\n这些资源仅仅是收集而来，未经验证是否可用，也没有逐一经过后门检测，因此学习及使用前需自行验证其可用性和安全性，**本项目仅仅是一个整理汇总网络公开资源的markdown页面，仅用于安全技术研究讨论**，请勿进行任何非授权渗透行为，否则请自行承担责任。\n\n**本项目设立的目的仅仅是作为一个资源备忘录使用，用于工作中涉及的安全建设及人员安全意识培训。为防止技术滥用，项目内不对任何实际技术细节及工具进行存档，仅转发相关原作者发布的互联网公开链接。正因如此，本项目无法保证相关资源的安全性。如果您需要对其中的任何技术进行研究学习，请使用自行搭建的虚拟环境。**\n\n欢迎任何纠错及补充（当然，额。。最好是和本项目相关的= =）\n\n---\n\n#### 分类:Office历史漏洞\n\n| 项目名称 | 项目简介 |\n|----------|----------|\n[**office-exploits**](https://github.com/SecWiki/office-exploits)|Office-Exploits：Office漏洞集合（包含噩梦公式等历史漏洞，项目较老）|\n[**office-exploit-case-study**](https://github.com/houjingyi233/office-exploit-case-study)|Office 历史EXP及学习项目|\n[**CVE-2023-21716**](https://github.com/Xnuvers007/CVE-2023-21716)|CVE-2023-21716 POC（Windows 10）|\n[**'Follina' MS-MSDT n-day Microsoft Office RCE**](https://github.com/chvancooten/follina.py)|CVE-2022-30190 'Follina' Office RCE 测试工具|\n[**'Follina' MS-MSDT n-day Microsoft Office RCE—修改版**](https://github.com/komomon/CVE-2022-30190-follina-Office-MSDT-Fixed)|修改版Follina，支持自定义Word模板。 |\n[**CVE-2021-40444**](https://github.com/lockedbyte/CVE-2021-40444)|CVE-2021-40444 POC|\n[**CVE-2021-40444**](https://github.com/klezVirus/CVE-2021-40444)|CVE-2021-40444 EXP|\n[**MSHTML-RCE-Exploit**](https://github.com/34zY/Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit)|CVE-2021-40444 Demo|\n[**CVE-2017-0199**](https://github.com/bhdresh/CVE-2017-0199)|CVE-2017-0199 EXP|\n[**PoC Exploit for CVE-2018-0802**](https://github.com/rxwx/CVE-2018-0802)|PoC Exploit for CVE-2018-0802|\n[**CVE-2022-24934**](https://github.com/webraybtl/CVE-2022-24934)|WPS Office 历史漏洞Demo|\n[**WPS-20230809-RCE POC1**](https://github.com/b2git/WPS-0DAY-20230809)|WPS Office RCE|\n[**WPS-20230809-RCE POC2**](https://github.com/ba0gu0/wps-rce)|WPS Office RCE|\n[**Outlook RCE**](https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability)|CVE-2024-21413 Microsoft Outlook漏洞POC|\n[**WPS RCE:CVE-2024-7262\u00267263**](https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/)|WPS Office RCE|\n\n---\n\n#### 分类:钓鱼辅助工具项目\n\n| 项目名称 | 项目简介 |\n|----------|----------|\n[**Swaks**](https://github.com/jetmore/swaks)|邮件伪造工具，集成伪装发信人等功能|\n[**MatryoshkaDollTool**](https://github.com/TheKingOfDuck/MatryoshkaDollTool)|C#实现的程序加壳/捆绑工具|\n[**BeCyIconGrabber Portable**](https://github.com/JarlPenguin/BeCyIconGrabberPortable)|图标提取工具，可用于辅助进行图标伪装|\n[**Restorator**](https://www.bome.com/products/restorator)|资源替换工具，可用于图标伪装，但是似乎是一款需付费的工具|\n[**SigThief**](https://github.com/secretsquirrel/SigThief)|数字签名伪装|\n[**Bad-Pdf**](https://github.com/deepzec/Bad-Pdf)|通过恶意PDF文件窃取NTLM Hash|\n[**Lnk-Trojan**](https://github.com/Yihsiwei/Lnk-Trojan)|Lnk钓鱼工具|\n[**EmailAll**](https://github.com/Taonn/EmailAll)|一款强大的邮箱收集工具 |\n[**sendMail**](https://github.com/1n7erface/sendMail)|批量群发钓鱼邮件|\n[**ditt**](https://github.com/evilsocket/ditto)|生成高仿域名|\n[**PhishingInstall**](https://github.com/sumerzhang/PhishingInstall)|快速搭建钓鱼邮服|\n[**社工字典**](https://github.com/zgjx6/SocialEngineeringDictionaryGenerator)|社会工程学密码生成器|\n[**EasyPersistent**](https://github.com/yanghaoi/CobaltStrike_CNA)|CobaltStrike的权限维持插件，支持多种权限维持方法|\n[**Gophish**](https://github.com/gophish/gophish)|Gophish，一款大型开源钓鱼框架|\n[**Flash-Pop**](https://github.com/r00tSe7en/Flash-Pop)|Flash钓鱼弹窗版|\n[**Fake-flash.cn**](https://github.com/r00tSe7en/Fake-flash.cn)|旧版Flash钓鱼页，中文+英文，可能需要改改再用|\n[**Goblin 钓鱼演练工具**](https://github.com/xiecat/goblin)|适用于红蓝对抗的钓鱼演练工具。通过反向代理，可以在不影响用户操作的情况下无感知的获取用户的信息，或者诱导用户操作。支持隐藏服务端，支持docker快速部署|\n[**Medusa**](https://github.com/Ascotbe/Medusa)|Medusa红队作战平台|\n[**idea-project-fish-exploit**](https://github.com/no-one-sec/idea-project-fish-exploit)|JetBrains系列产品.idea钓鱼反制红队 |\n[**IDE-Honeypot**](https://github.com/wendell1224/ide-honeypot)|一款针对于IDE的反制蜜罐。通过项目文件钓鱼的思路理论上可对部分IDE实现无感触发|\n[**CrossNet**](https://github.com/dr0op/CrossNet-Beta)|红队行动中利用白利用、免杀、自动判断网络环境生成钓鱼可执行文件。 |\n[**LNKUp**](https://github.com/Plazmaz/LNKUp)|恶意Lnk钓鱼生成器|\n[**EBurst**](https://github.com/grayddq/EBurst)|Exchange邮箱爆破|\n[**cli.im在线工具**](https://cli.im/tools)|在线生成和编辑二维码|\n[**Taie-AutoPhishing**](https://github.com/taielab/Taie-AutoPhishing)|钓鱼工具及思路汇总|\n\n---\n\n#### 分类:免杀项目\n\n| 项目名称 | 项目简介 |\n|----------|----------|\n[**BypassAntiVirus**](https://github.com/TideSec/BypassAntiVirus)|TideSec的系列免杀教程|\n[**掩日**](https://github.com/1y0n/AV_Evasion_Tool)|强大的红队免杀工具，截至目前仍在更新，可用性较强|\n[**遮天**](https://github.com/yqcs/ZheTian)|遮天-免杀生成工具|\n[**潮影-在线免杀平台**](http://bypass.tidesec.com/)|线上版免杀工具平台|\n[**darkPulse**](https://github.com/fdx-xdf/darkPulse)|用go编写的多功能Loader|\n[**GobypassAV-shellcode**](https://github.com/Pizz33/GobypassAV-shellcode)|CobaltStrike shellcode强效免杀|\n[**Bundler-bypass**](https://github.com/testxxxzzz/Bundler-bypass)|免杀捆绑器|\n[**GoFileBinder**](https://github.com/Yihsiwei/GoFileBinder)|Golang免杀捆绑器|\n[**CS插件BypassAV**](https://github.com/hack2fun/BypassAV)|Cobalt Strike插件，用于快速生成免杀的可执行文件|\n[**PengCode**](https://github.com/Mephostophiles/PengCode)|将exe转换为shellcode|\n[**rust-shellcode**](https://github.com/b1nhack/rust-shellcode)|rust实现的shellcode加载器，支持多种加载方式|\n[**NimShellCodeLoader**](https://github.com/aeverj/NimShellCodeLoader)|使用小众的Nim语言实现的加载器，主要针对国产杀软|\n[**PicBypass**](https://github.com/soryecker/PicBypass)|远程加载shellcode图片来免杀，可以作为思路然后通过其他语言扩展|\n[**Amsi-Bypass-Powershell**](https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell)|绕过Windows AMSI|\n[**CS-Avoid-killing**](https://github.com/Gality369/CS-Loader)|CobaltStrike免杀加载器|\n[**Bypass Anti-Virus**](https://github.com/midisec/BypassAnti-Virus)|一些杀软绕过姿势|\n[**bypassAV**](https://github.com/pureqh/bypassAV)|免杀shellcode加载器|\n[**GolangBypassAV**](https://github.com/safe6Sec/GolangBypassAV)|Golang下的免杀思路和工具|\n[**Malleable C2**](https://github.com/threatexpress/malleable-c2)|用于混淆CobaltStrike流量特征（实战中还需要修改其他特征，例如证书）|\n[**CrossC2**](https://github.com/gloxec/CrossC2)|经典项目，用于生成跨平台beacon|\n[**NoteRCE**](https://github.com/xiao-zhu-zhu/noterce)|一种另辟蹊径的免杀执行系统命令的木马,防溯源，无需VPS|\n[**KaynLdr**](https://github.com/Cracked5pider/KaynLdr)|用C / ASM编写的反射加载器|\n[**killEscaper**](https://github.com/Anyyy111/killEscaper)|利用shellcode来制作免杀exe的工具，可结合渗透工具生成的shellcode二次转换exe，支持CobaltStrike、metasploit等|\n[**DamnPythonEvasion**](https://github.com/baiyies/DamnPythonEvasion)|基于python pyd的shellcode免杀绕过|\n[**SysWhispers3WinHttp**](https://github.com/huaigu4ng/SysWhispers3WinHttp)|基于SysWhispers3增添WinHttp分离加载+交叉编译|\n[**ShellcodeLoader**](https://github.com/knownsec/shellcodeloader)|Windows平台的shellcode免杀加载器，内置多种加载方式|\n[**pe_to_shellcode**](https://github.com/hasherezade/pe_to_shellcode)|能将绝大部分PE转换为shellcode供外部加载，且shellcode本身可作为PE执行|\n\n---\n\n#### 分类:用于参考的C2项目\n\n| 项目名称 | 项目简介 |\n|----------|----------|\n[**Sliver**](https://github.com/BishopFox/sliver)|Sliver C2框架，貌似最近比较火|\n[**RustDesk**](https://github.com/rustdesk/rustdesk)|一款开源、支持普通用户权限、支持纯内网环境的远程桌面工具|\n[**gotohttp**](http://www.gotohttp.com/)|gotohttp远程桌面工具|\n[**Covenant**](https://github.com/cobbr/Covenant)|Covenant，一款 .NET C2|\n[**AsyncRAT**](https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp)|AsyncRAT|\n[**Manjusaka**](https://github.com/YDHCUI/manjusaka)|一款基于WEB界面的远程主机管理工具|\n[**Havoc**](https://github.com/HavocFramework/Havoc)|Havoc，类似CobaltStrike，基本上相当于重写了CS|\n[**BlackMamba**](https://github.com/loseys/BlackMamba)|Python编写的开源C2框架|\n[**Quasar**](https://github.com/quasar/Quasar)|一款C#编写的开源RAT，项目已停止更新|\n\n---\n\n#### 分类:红队相关其他项目\n\n| 项目名称 | 项目简介 |\n|----------|----------|\n[**APT事件报告汇总-1**](https://apt.360.net/timeline)|国内某公司整理的APT分析报告，部分手法可参考并落地|\n[**APT事件报告汇总-2**](https://ti.qianxin.com/apt/)|国内某公司整理的APT分析报告，部分手法可参考并落地|\n[**APT事件报告汇总-3**](https://starmap.dbappsecurity.com.cn/apt/map)|国内某公司整理的APT分析报告，部分手法可参考并落地|\n[**Fish-Hub**](https://github.com/ybdt/fish-hub)|钓鱼相关案例和参考|\n[**红队防猝死手册**](https://github.com/zhutougg/RedteamStandard)|红队防猝死手册，一些防止犯低级错误的指南|\n[**红队笔记**](https://github.com/biggerduck/RedTeamNotes)|强大且全面的红队指南|\n[**红队知识库**](https://github.com/Threekiii/Awesome-Redteam)|一个红队知识库|\n\n---\n\n#### 分类:蓝队反钓鱼资源\n\n| 项目名称 | 项目简介 |\n|----------|----------|\n[**微步云沙箱**](https://s.threatbook.com/)|通过隔离环境运行程序，初步检测文件是否恶意|\n[**安恒云沙箱**](https://sandbox.dbappsecurity.com.cn/)|通过隔离环境运行程序，初步检测文件是否恶意|\n[**奇安信云沙箱**](https://sandbox.ti.qianxin.com/sandbox/page)|通过隔离环境运行程序，初步检测文件是否恶意|\n[**Freebuf云沙箱**](https://sandbox.freebuf.com/detect)|通过隔离环境运行程序，初步检测文件是否恶意|\n[**360云沙箱**](https://ata.360.net/)|通过隔离环境运行程序，初步检测文件是否恶意|\n[**VirusTotal**](https://www.virustotal.com/gui/home/upload)|经典的VT，在线多引擎检测|\n[**Any.run**](https://any.run/)|Any.Run交互式恶意软件分析工具沙箱服务|\n\n---\n\n#### 分类:杂项堆积\n\n| 杂项 |\n|----------|\n[**企业钓鱼演练总结**](https://xz.aliyun.com/t/13287)|\n[**SMTP Smuggling 分析及实现**](https://www.freebuf.com/articles/web/403860.html)|\n[**钓鱼研判经验**](https://xz.aliyun.com/t/13629)|\n[**钓鱼指南**](https://xz.aliyun.com/t/7958)|\n[**邮件钓鱼平台搭建**](https://xz.aliyun.com/t/11898)|\n[**钓鱼具体手法**](https://xz.aliyun.com/t/11885)|\n[**钓鱼手法分析**](https://xz.aliyun.com/t/11519)|\n[**Office钓鱼姿势**](https://xz.aliyun.com/t/10339)|\n[**Windows凭据钓鱼窃取**](https://xz.aliyun.com/t/7458)|\n[**邮件钓鱼技巧（提高成功率）**](https://xz.aliyun.com/t/6325)|\n[**钓鱼姿势汇总（CHM、自解压等）**](https://www.jianshu.com/p/dcd250593698)|\n[**自解压钓鱼详解**](https://www.cnblogs.com/thespace/p/15520945.html)|\n[**渗透Exchange邮服**](https://zhuanlan.zhihu.com/p/339329927)|\n[**钓鱼优秀战例**](https://xz.aliyun.com/t/10731)|\n[**反制红队的钓鱼优秀战例**](https://zhuanlan.zhihu.com/p/656856056)|\n[**Office钓鱼手法**](https://cloud.tencent.com/developer/article/1917641)|\n[**文档钓鱼汇总**](https://cloud.tencent.com/developer/article/2008720)|\n[**Office宏免杀**](https://cloud.tencent.com/developer/article/1761344)|\n\n---\n\n[![Star History Chart](https://api.star-history.com/svg?repos=tib36/PhishingBook\u0026type=Date)](https://star-history.com/#star-history/star-history\u0026Date)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftib36%2FPhishingBook","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftib36%2FPhishingBook","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftib36%2FPhishingBook/lists"}