King Phisher
A phishing campaign toolkit for simulating real-world attacks to test and promote user security awareness.
What is King Phisher?
King Phisher is an open-source phishing campaign toolkit that simulates real-world phishing attacks to test and improve user security awareness. It allows organizations to run controlled campaigns, from basic training to advanced credential harvesting, with full control over email and server content. The tool is designed for legal use with explicit permission from targeted organizations.
Security professionals, penetration testers, and IT administrators responsible for conducting security awareness training and phishing simulations within their organizations.
Developers choose King Phisher for its flexible architecture, extensibility via plugins, and comprehensive feature set—including email customization, credential harvesting, and visitor tracking—all within a self-hosted, open-source platform.
Overview
Phishing Campaign Toolkit
Use Cases
Best For
- Conducting employee security awareness training with simulated phishing emails
- Running penetration tests that involve social engineering and credential harvesting
- Cloning legitimate websites for phishing campaign landing pages
- Tracking geographic locations of phishing campaign visitors
- Sending phishing emails with embedded tracking images and calendar invites
- Extending phishing tool functionality with custom plugins
Not Ideal For
- Organizations needing a fully managed, cloud-based phishing simulation service with automatic updates
- Teams lacking in-house IT expertise for server deployment and ongoing maintenance
- Use cases requiring out-of-the-box integration with enterprise security platforms like SIEMs
- Rapid deployment scenarios where pre-built campaigns and automated reporting are critical
Pros & Cons
Pros
Allows full control over email content and server pages, enabling highly customized phishing simulations as highlighted in the Overview section.
Both client and server support plugins, with additional plugins available in a separate repository, enhancing functionality beyond core features.
Includes geo-location, tracking images, and SMS alerts for detailed campaign insights, as specified in the Feature Overview.
Uses Jinja2 templates for messages and pages, supported by a dedicated templates repository for easy customization and reuse.
Cons
The project is explicitly stated as no longer being maintained in the README, meaning no future updates, bug fixes, or security patches.
Requires following detailed instructions in INSTALL.md and the wiki, involving server setup and dependency management, which can be daunting for non-technical users.
User documentation is on the wiki while technical documentation is on ReadTheDocs, potentially causing confusion and inefficiency when seeking help.
Frequently Asked Questions
Related Projects
phishing_catcherPhishing catcher using Certstream
CertSpotterLightweight Certificate Transparency Log Monitor
SwordphishSwordphish Phishing Awareness Tool
Phishing Intelligence Engine (PIE):mailbox: The Phishing Intelligence Engine - An Active Defense PowerShell Framework for Phishing Defense with Office 365
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.