Top 20 phishing tools to use in 2024
PreviousHow to Study for OSCP with the PWK Book PDFNextTop 8 Bug Bounty Books for 2025: Must-Reads for Ethical Hackers
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
Phishing remains one of the most common and effective techniques in the world of cybersecurity attacks and awareness. Whether you’re a penetration tester, a cybersecurity enthusiast, or someone responsible for building organizational defenses, understanding how phishing tools operate is crucial. This guide dives into the Top 20 Phishing Tools of 2024, covering tools like Setoolkit, Evilginx2, HiddenEye, and more. Each tool offers unique features, from email and SMS phishing to Wi-Fi and QR code manipulation, designed to simulate real-world attacks.
With detailed descriptions, usage instructions, and feature highlights for each tool, this article provides everything you need to know to use these tools effectively and responsibly. Learn which tools to use for specific scenarios, from social engineering to credential harvesting, and understand how these tools contribute to creating better cybersecurity defenses. Read on to discover how each of these tools can enhance your security assessments and phishing simulations!
Disclaimer: This information is for educational and ethical testing purposes only. Unauthorized use of these tools is illegal and strictly discouraged.
SEToolkit is a powerful and versatile social engineering framework used by penetration testers to simulate real-world phishing attacks.
Key Features:
Spear-phishing Attack Vector: Craft customized emails to target specific individuals.
Website Attack Vector: Clone legitimate websites to capture credentials.
Credential Harvester: Capture login credentials from targets visiting cloned sites.
How to Use:
Run SEToolkit and choose the social engineering vector, such as website or email phishing.
Clone the target website and initiate the attack, awaiting the results in your terminal.
Evilginx2 is an advanced phishing tool focused on bypassing two-factor authentication by capturing session cookies.
Key Features:
Proxy Phishing: Acts as a man-in-the-middle (MITM) proxy, capturing both credentials and session cookies.
Modular Phishing Scenarios: Easily customize for various sites like Facebook or Google.
How to Use:
Configure the domain and set up SSL for realistic HTTPS phishing sites.
Choose a template for the site to be cloned, then share the phishing link with the target.
Once accessed, Evilginx2 captures login details and session cookies.
Known for cloning multiple platforms, HiddenEye captures login details and delivers them to the attacker.
Key Features:
Customizable Login Pages: Includes pre-configured templates for social media and email providers.
Multiple Phishing Methods: Supports phishing via email, SMS, and social media.
How to Use:
Choose a website template and create a phishing link.
Send the link to the target, and the credentials are recorded on the local machine.
SocialFish is an easy-to-use tool for phishing social media credentials.
Key Features:
Social Media Templates: Includes built-in phishing templates for platforms like Facebook and Instagram.
Compatibility: Works with both Windows and Linux systems.
How to Use:
Select the social media platform template and generate the phishing link.
Share the link, and SocialFish captures credentials in real-time.
SeeYou exploits the target’s device by obtaining GPS location data through a phishing link.
Key Features:
Real-time Location Capture: Gets accurate GPS coordinates.
Target Device Identification: Recognizes the type of device used by the victim.
How to Use:
Generate a phishing link, which prompts the target to share location data.
Once the target clicks, the tool records and displays their GPS location.
This tool accesses the target’s webcam to take snapshots through a phishing link.
Key Features:
Webcam Activation: Captures snapshots through a crafted phishing page.
Lightweight and Efficient: Minimal setup needed for quick deployment.
How to Use:
Generate the phishing link and share it with the target.
When the link is accessed, SayCheese activates the webcam and saves the images.
QR Code Jacking manipulates QR codes to redirect victims to phishing sites.
Key Features:
Customizable QR Codes: Creates QR codes for social media and other sites.
Anonymous Tracking: QR codes hide phishing links, making them harder to detect.
How to Use:
Enter the phishing URL, and generate a QR code.
Share the QR code, and await login credentials from targets scanning it.
A highly flexible phishing tool, ShellPhish supports multiple social media and email providers.
Key Features:
Multi-platform Phishing Templates: Supports many popular websites.
Command-line Interface: Easy setup with a few command prompts.
How to Use:
Select a template and send the link to the target.
Credentials are captured and displayed directly in the terminal.
BlackPhish is ideal for generating fake login pages and capturing credentials.
Key Features:
Automatic IP Logging: Tracks target’s IP addresses.
Responsive Phishing Pages: Ensures compatibility across devices.
How to Use:
Choose a phishing page template, generate the link, and wait for the login details.
This is a modified version of ShellPhish, offering more templates and advanced features.
Key Features:
Enhanced Template Variety: Contains many additional templates for social media.
Automatic Login Capture: Credentials are automatically saved.
How to Use:
Select the desired template, share the link, and await captured credentials.
PhishX provides realistic phishing pages for various platforms.
Key Features:
Anti-bot Verification: Ensures only genuine visitors access the page.
Multiple Phishing Vectors: Supports email, SMS, and social media phishing.
How to Use:
Select a platform, generate a link, and await credentials from the target.
Gophish is an open-source phishing framework often used for large-scale campaigns.
Key Features:
Campaign Management: Manages and tracks multiple campaigns.
User-friendly Dashboard: Provides a GUI for configuration and tracking.
How to Use:
Set up email campaigns with custom links and track responses.
Wifiphisher is aimed at creating fake Wi-Fi access points to capture credentials.
Key Features:
Wi-Fi Network Phishing: Users connect to the fake network and enter credentials.
Automatic Network Setup: Simulates legitimate network behavior.
How to Use:
Configure the access point and wait for users to connect.
Phishing Frenzy is a Ruby-based framework built for large-scale phishing campaigns, offering detailed tracking and analytics.
Key Features:
Email Tracking and Analytics: Monitors opened emails, clicked links, and credentials entered.
Template Library: Includes a variety of pre-built email and webpage templates.
How to Use:
Configure email server settings and choose a template.
Deploy a campaign, track metrics, and collect results from the built-in dashboard.
Ghost Phisher emulates Wi-Fi access points and web servers to capture login credentials through fake captive portals.
Key Features:
Fake Captive Portals: Redirects users to a login page when they connect to Wi-Fi.
ARP Spoofing: Redirects legitimate traffic to malicious pages.
How to Use:
Set up a Wi-Fi access point, configure the captive portal, and monitor for connected devices.
BlackEye provides ready-to-use phishing templates for popular sites and is highly customizable.
Key Features:
Pre-configured Templates: Covers social media, email, and e-commerce platforms.
CLI-based: Simple command-line interface for rapid deployment.
How to Use:
Select a template, generate a link, and capture credentials from victims.
King-Phisher is a flexible tool that combines phishing with social engineering tactics for more sophisticated attacks.
Key Features:
Campaign Management: Manages and tracks multiple campaigns.
Email Spoofing: Sends realistic-looking emails for phishing.
How to Use:
Create a phishing campaign and send emails with customized templates.
Track the target’s interaction and gather metrics.
SpookPhish is designed to be lightweight and effective for simple phishing scenarios.
Key Features:
Customizable Phishing Pages: Easily modified to simulate various platforms.
Compact and Fast: Minimal setup required.
How to Use:
Select a template and generate a link, then capture any credentials entered by the target.
PyPhisher is a Python-based tool that offers an easy setup for phishing and is suitable for beginners.
Key Features:
Python-based CLI: Straightforward command-line interface.
Diverse Templates: Pre-configured templates for major sites.
How to Use:
Choose a site to clone, generate a link, and wait for the target to engage.
HiddenPhish is built for undetectable phishing links, making it harder for targets to recognize phishing attempts.
Key Features:
Masked URLs: Creates phishing links that look legitimate.
Multiple Service Support: Includes templates for major platforms.
How to Use:
Configure the phishing page and share the link with your target.
Each tool on this list provides unique features suited to different scenarios in phishing simulations and security awareness. Here’s a quick summary of when to use each:
For beginners: Try PyPhisher or Zphisher, as they offer simple CLI-based setups.
For Wi-Fi phishing: Wifiphisher and Ghost Phisher are top choices, designed for network-based phishing.
For advanced needs: King-Phisher and Phishing Frenzy are highly customizable for complex campaigns.
These tools are incredibly powerful when used responsibly for testing and improving security. Unauthorized use, however, is illegal and unethical.
Download and install SEToolkit from its .
Install Evilginx2 from .
Clone HiddenEye from .
Install SocialFish from .
Download SeeYou from .
Clone SayCheese from .
Get QR Code Jacking from .
Install ShellPhish from .
Download BlackPhish from .
Clone Zphisher from .
Download PhishX from .
Install Gophish from .
Install Wifiphisher from .
Install Phishing Frenzy from .
Download Ghost Phisher from .
Install BlackEye from .
Clone King-Phisher from .
Download SpookPhish from .
Clone PyPhisher from .
Download HiddenPhish from .