Flexphish

Flexphish is a flexible and modular phishing framework designed for security professionals, red teams, and researchers to simulate real-world phishing campaigns in controlled environments. It allows controlled testing of phishing scenarios by creating realistic login pages and capturing interactions for analysis, it provides a modern architecture with support for custom templates, campaign management, and traffic monitor, making it ideal for penetration testing, awareness training, and development of phishing simulations.

Features

• Campaign creation and management from a web dashboard
• Wildcard subdomain campaigns
• Realistic phishing templates with multi-step login flows
• Group and target management for recipient segmentation
• SMTP profile and email template management
• Email template editor with open-tracking
• Bulk campaign email delivery with scheduling support
• Credential capture and interaction tracking (open, click, submit)
• Email open tracking via pixel
• Campaign analytics with delivery and conversion metrics
• Built-in settings panel for platform configuration

Releases & Installation Guide

This guide explains how to download, install, and run Flexphish using pre-built binaries or from source.

Releases

You can download the latest stable release from GitHub:

https://github.com/P0cL4bs/flexphish/releases

Pre-built binaries are available for multiple platforms, including:

• Linux (amd64)
• Windows (amd64)

Each release includes compiled binaries and release notes describing changes, improvements, and fixes.

Quick Start (Binary Installation)

Follow the steps below to quickly get Flexphish running on Linux.

Download the Binary

wget https://github.com/P0cL4bs/flexphish/releases/download/flexphish_vx.x.x_linux_amd64.zip 

Extract the Archive

unzip flexphish_vx.x.x_linux_amd64.zip 
cd flexphish

Make the Binary Executable

chmod +x flexphish

Run Flexphish

./flexphish

Flexphish CLI

        ████           
   ██████████████      
  █████▓▓▓▓▓▓█████                                                         
  ███▓▓▓▓▓▓░░▓▓███     ██████ ▄▄    ▄▄▄▄▄ ▄▄ ▄▄ ▄▄▄▄  ▄▄ ▄▄ ▄▄  ▄▄▄▄ ▄▄ ▄▄
 ███▓▓▓▓▓▓▓██▓▓▓███    ██▄▄   ██    ██▄▄  ▀█▄█▀ ██▄█▀ ██▄██ ██ ███▄▄ ██▄██
████▓▓▓██▓▓██▓▓▓████   ██     ██▄▄▄ ██▄▄▄ ██ ██ ██    ██ ██ ██ ▄▄██▀ ██ ██
 ███▓▓▓██▓▓██▓▓▓███                                            version 1.3.1
  ███▓▓▓████▓▓▓███     The ultimate Red Team toolkit for phishing operations.
  █████▓▓▓▓▓▓█████     
   ██████████████      [built for linux amd64]
        ████            by: @mh4x0f (PocL4bs Team  - 10 Years Anniversary
                       )

[+] Campaign server running on http://0.0.0.0:8001  
[+] API server starting on 0.0.0.0:8088  
[+] Dashboard running on http://0.0.0.0:8000  

Creating a User

Flexphish allows user management directly from the command line.

To create a new user:

./flexphish -create-user \
-email admin@example.com \
-password StrongPassword

Accessing the Application

After starting the server, you can access:

• Dashboard → http://localhost:8000
• API → http://localhost:8088
• Campaign Server → http://localhost:8001

Development Build

If you prefer to build Flexphish from source:

Requirements

• Go 1.24.0
• Nginx (for production)
• pnpm (10.11.0)

git clone https://github.com/P0cL4bs/flexphish.git
cd flexphish

go mod tidy
go build -o flexphish

make frontend

./flexphish

Documentation

Full documentation is available in the docs/ directory:

• docs/development.md - Local development setup

• docs/nginx-cloudflare-setup.md - Production deployment

• docs/templates.md - Template structure and behavior of phishing pages

Templates Flows

Flexphish templates define the structure and behavior of phishing pages used in campaigns.

They are built using YAML configuration files combined with HTML pages and static assets, allowing the creation of highly realistic and customizable phishing flows.

What a Template Controls

A template flow is responsible for:

• Capturing user data (credentials, form fields, tokens)
• Input validation and rules enforcement
• Step transitions and flow control
• Redirect behavior after completion
• Dynamic and reusable variables
• Client-side scripts and interactions
• Multi-step authentication sequences (e.g. login → password → 2FA)

Execution Flow

Templates are executed sequentially, step-by-step:

username → password → 2FA → redirect

Full documentation: docs/templates.md

Issues

If you encounter a bug, have a feature request, or need help, please open an issue on GitHub:

https://github.com/P0cL4bs/flexphish/issues

License

This project is licensed under the Apache License 2.0

Disclaimer

This tool is intended for educational purposes and authorized security testing only.
The author is not responsible for any misuse or damage caused by this software.
Users are responsible for complying with applicable laws and regulations.