search

Raikia / FiercePhish

FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more.
https://github.com/Raikia/FiercePhish/wiki
GNU General Public License v3.0
1.31k stars 249 forks source link

Feature Request: Envelope-From Spoofing #42

Open ad0nis opened 7 years ago

ad0nis commented 7 years ago

Allow the sender to specify if they want to put a different sender name and email address in the Envelope-From header (The "From:" header which goes inside the DATA block of the email.), separate from the SMTP "MAIL FROM:" header. This can allow you to send your legitimately SPF/DKIM-validated message from the domain you own, while presenting the target's actual email domain within their mail client. (Not all mail clients are susceptible to this, and some spam filters may treat this negatively, but in some cases, it's a good social engineering technique.)

Raikia commented 7 years ago

This is actually a solid idea. I know that mailgun does do this, so that is a decent workaround for right now. I think adding a section for "Advanced settings" for both campaign emails and simple send should be a good and scalable for the future. I will add this as an enhancement for future versions