GitHub RadarRed team tool

Yaman-RedTeam/ghostphish

Modern Docker-based phishing framework for authorized red team engagements. 8 pixel-perfect templates (Instagram, Facebook, Netflix, Twitter/X, LinkedIn, Snapchat, Microsoft, Gmail) + Cloudflare tunnel + SQLite capture. Primary language: Python. 7 stars.

Python7 stars3 forkspushed Sep 4, 2026NOASSERTION

Project links:Open GitHub project Back to radar

README Preview

Fetched from GitHub

ghostphish

A modern, Docker-based phishing framework for authorized red team engagements and security research. Ships with 8 pixel-perfect login page replicas, one-command cloudflared tunneling, and structured credential capture in SQLite.

⚠️ AUTHORIZED USE ONLY — Ghostphish is intended for penetration testers, red teamers, and security researchers operating under a signed rules-of-engagement or explicit written permission. Using this tool against systems or people you do not own or lack authorization to test is illegal in most jurisdictions.

---

Why ghostphish?

Most public phishing kits ship with outdated templates that no longer match the real login pages of their targets — a giveaway to any target who is even moderately observant. Ghostphish takes a different approach:

Modern replicas — pixel-close copies of the current login pages (2025/2026 designs), including 2-step Google/Microsoft OAuth flows and dark themes where applicable.
Real data storage — SQLite with a proper schema, not flat text files. Query, export, or feed into other tooling.
Production-ish backend — FastAPI + Docker, honeypot detection, structured logging.
Permanent links — Unified supervisor keeps app + tunnel alive together with auto-restart. Links work even if terminal closes, app crashes, or network interrupts.
One-command tunnel — ./start.sh spins up a Cloudflare quick-tunnel and prints every phishing URL, ready to send.

Permanent Links (NEW 🎯)

Links no longer die when you close your terminal or if the app crashes:

./start.sh
# → Links work immediately and stay alive FOREVER
# → Even if you close terminal, SSH disconnects, or app crashes
# → Supervisor auto-restarts failed components in background
# → Same URL stays active (no regeneration needed per crash)

What changed:

✅ Unified supervisor keeps app + tunnel alive together
✅ Auto-restart on any failure (app crash, network blip)
✅ Survives terminal close (background setsid process)
✅ Health checks every 10s ensure continuous availability
✅ Backward compatible — still use ./start.sh as shown in videos

If something breaks:

./diagnose.sh          # Quick health check
./launch-and-maintain.sh status   # Current URL + all templates
./launch-and-maintain.sh logs     # Watch live logs

See `TROUBLESHOOTING.md` for complete guide.

Templates

| # | Service | Route | Style | |---|-----------|--------------|-------| | 1 | Instagram | /instagram | Dark theme, "close friends" hero, real embedded photos | | 2 | Facebook | /facebook | White bg, photo collage, "Explore the things you love." | | 3 | Netflix | /netflix | Dark hero, red wordmark, floating labels | | 4 | Twitter/X | /twitter | Black bg, huge X logo, Google/Apple SSO buttons | | 5 | Snapchat | /snapchat | Yellow header, ghost logo, minimalist form | | 6 | LinkedIn | /linkedin | Beige bg, real logo, Google/Apple SSO | | 7 | Microsoft | /microsoft | Cosmic dark bg, 2-step email→password flow | | 8 | Gmail | /gmail | Dark theme, colored G, 2-step flow, email chip |

All templates:

Are self-contained (no external CDN calls — everything base64-embedded)
Match the real target's redirect after submit (e.g. /facebook submit → facebook.com)
Show a realistic error state on repeat submissions
Include the correct favicon, page title, and footer

Screenshots

<table> <tr> <td align="center" width="50%"> <img src="assets/screenshots/instagram.png" alt="Instagram — dark theme"> Instagram — dark theme with "close friends" hero and embedded photo collage </td> <td align="center" width="50%"> <img src="assets/screenshots/facebook.png" alt="Facebook — Explore the things you love"> Facebook — white bg, floating photo cards, real FB & Meta logos </td> </tr> <tr> <td align="center"> <img src="assets/screenshots/netflix.png" alt="Netflix — Sign In"> Netflix — dark hero, red wordmark, floating labels, reCAPTCHA disclaimer </td> <td align="center"> <img src="assets/screenshots/twitter.png" alt="X (Twitter) — Sign in"> Twitter / X — pure black bg, huge X logo, Google & Apple SSO </td> </tr> <tr> <td align="center"> <img src="assets/screenshots/linkedin.png" alt="LinkedIn — Sign in"> LinkedIn — beige bg, real logo, Google/Apple SSO, "show" password toggle </td> <td align="center"> <img src="assets/screenshots/snapchat.png" alt="Snapchat — Log in"> Snapchat — yellow header, ghost logo, minimalist form, pill button </td> </tr> <tr> <td align="center"> <img src="assets/screenshots/microsoft.png" alt="Microsoft — Sign in"> Microsoft — cosmic dark bg, 2-step email→password flow, 4-square logo </td> <td align="center"> <img src="assets/screenshots/gmail.png" alt="Gmail — Sign in"> Gmail — real dark theme, colored G logo, email chip on step 2 </td> </tr> </table>

All screenshots taken with a 1280×800 headless Chromium against localhost. Fonts and layout match the current (2025/2026) design of each target.

Architecture

┌──────────────┐     ┌───────────────┐     ┌──────────────┐
│  Target      │────▶│  Cloudflare   │────▶│  Docker      │
│  (browser)   │     │  quick-tunnel │     │  FastAPI     │
└──────────────┘     └───────────────┘     └──────┬───────┘
                                                  │
                                                  ▼
                                          ┌──────────────┐
                                          │  SQLite      │
                                          │  captures.db │
                                          └──────────────┘

`app.py` — FastAPI app, one route per template + /submit + /admin/captures
`data/captures.db` — SQLite, table captures(id, timestamp, service, email, password, otp, honeypot, ip_address, user_agent, referer, attempt_number)
Honeypot field — hidden form input; non-empty submissions get logged and flagged
Unlimited submissions — no rate limit (target may retry as many times as needed)

Quick start

1. Requirements

Ghostphish detects your environment and picks the right runtime automatically:

| Platform | Runtime | Command | |----------|---------|---------| | Linux / macOS | Docker + docker-compose | ./start.sh | | Termux (Android) | Python (no Docker needed) | bash termux-setup.sh → ./start.sh | | Bare-metal / VPS without Docker | Python | ./start.sh (auto-fallback) |

Optional but recommended: cloudflared binary for public HTTPS tunneling. On Termux, termux-setup.sh installs it for you. On Linux / macOS install it explicitly so the tunnel step never fails with cloudflared not installed:

# Debian/Kali/Ubuntu (amd64)
sudo wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 \
  -O /usr/local/bin/cloudflared && sudo chmod +x /usr/local/bin/cloudflared

# macOS
brew install cloudflared

# verify
cloudflared --version

ARM64 host? Swap -amd64 for -arm64 in the URL above. Full download list: Cloudflare docs.

2a. Linux / macOS

git clone https://github.com/Yaman-RedTeam/ghostphish.git
cd ghostphish
./start.sh

2b. Termux (Android)

Run this once inside Termux:

pkg install -y git
git clone https://github.com/Yaman-RedTeam/ghostphish.git
cd ghostphish
bash termux-setup.sh

termux-setup.sh installs Python, git, curl, cloudflared, and all pip deps. Then run:

./start.sh

3. Interactive CLI

start.sh is a fully interactive CLI:

Auto-detects runtime (Docker or Python)
Boots the server (docker-compose up or uvicorn app:app)
Checks cloudflared
Shows a numbered template menu
Asks for delivery mode (public tunnel / localhost)
Asks for URL mask (default / custom / preset)
Prints the exact URL for the selected template
Streams captures live in the same terminal

4. Expose publicly with cloudflared

You have two launchers. Use the persistent one for real engagements — it survives your SSH/terminal session closing and auto-restarts the tunnel if cloudflared crashes, so your links stop dying mid-engagement.

Recommended — persistent supervisor (background, self-healing):

./tunnel-persistent.sh start      # launch in background, print the public URL
./tunnel-persistent.sh status     # show current URL + every phishing page link
./tunnel-persistent.sh url        # print just the current URL (for scripts)
./tunnel-persistent.sh logs       # tail the live tunnel log
./tunnel-persistent.sh stop       # stop the supervisor + tunnel

Manual — foreground one-shot (dies on `Ctrl+C`):

./tunnel.sh

tunnel.sh now refuses to start a second, competing tunnel while the persistent supervisor is running — stop the supervisor first (./tunnel-persistent.sh stop) if you deliberately want the manual one.

Why cloudflared over ngrok:

No account or auth token needed (quick-tunnel is anonymous)
No warning interstitial page (ngrok's free tier shows one)
HTTPS by default with a valid Cloudflare cert
URL rotates per launch — harder to blacklist

⚠️ Quick-tunnel URLs are ephemeral. Every (re)start — including an auto-restart — hands out a new random *.trycloudflare.com URL. Any link you already sent dies on restart. Re-read the current one with ./tunnel-persistent.sh url and re-send. For a URL that never changes you need a cloudflared named tunnel + a Cloudflare account + your own domain (see Cloudflare docs).

Troubleshooting: "the link isn't working"

Nine times out of ten the app is fine and the tunnel died — the app runs in Docker on :8000 independently of cloudflared.

curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8000/health   # 200 = app is UP
./tunnel-persistent.sh status                                           # is the tunnel alive? what's the URL?
./tunnel-persistent.sh start                                            # (re)start it if not running

`Permission denied` writing a log to `/tmp` — fixed: both launchers now write their logs to the repo directory, not /tmp.
Old link 404s / times out — the URL rotated on a restart; grab the current one with ./tunnel-persistent.sh url.
Live watcher spams `fetch error: HTTP Error 500` / `/admin/captures` returns 500 — the container's ./data b