Take Your Employees Phishing!

This report is a step-by-step guide on creating realistic phishing campaigns and payloads for internal testing or offensive use, covering social-engineering pretexts, ensuring email deliverability via DKIM/SPF/DMARC and DNS records, obtaining SSL certificates (Let’s Encrypt), building reverse_https payloads (nps_payload/unicorn), and establishing handlers to obtain remote shells; it also outlines target enumeration techniques and recommendations for using internal or third-party testers to evaluate user susceptibility.