$ show UndeadSec/SocialFish
SocialFish is a modern dynamic phishing toolkit designed for credential harvesting, session hijacking, and social engineering attacks. It provides a Flask-based web application with an admin dashboard for managing cloned login pages, capturing credentials, intercepting OTP/2FA codes, tracking victim sessions, and injecting post-capture attack payloads (e.g., keyloggers, clipboard stealers, tab jacking). The system supports browser automation via Playwright and Selenium to clone JavaScript-heavy and SPA login flows, and includes tunneling via ngrok/cloudflared for exposing phishing URLs remotely. The architecture is a monolithic Flask app with SQLite storage, WebSocket real-time updates, and a mobile API authenticated by QR tokens. External dependencies include Flask, Flask-SocketIO, Flask-Login, Playwright, Selenium, nmap, qrcode, and PyLaTeX. Despite its feature-rich surface, the codebase exhibits significant quality issues: broken async flows, missing database columns, incomplete routes, version mismatches between requirements files, and security concerns such as default credentials and insecure secret key generation. The project is actively maintained (last commit 2026-05-20) but the code is not production-ready as claimed in documentation.
The LLM identified 4 files worth highlighting for reuse:
A self-contained class for managing ngrok and cloudflared tunnels. Handles automatic installation, token configuration, tunnel start/stop/status, and lure URL generation. This module can be extracted and reused in any project requiring programmatic tunnel management for exposing local servers.
A class for analyzing browser cookies with security-attribute heuristics (secure, HttpOnly, SameSite, auth-token detection) and 2FA detection based on URL keywords and input fields. Supports export to CSV/JSON and DB storage. This is a reusable utility for security auditing or penetration testing tools.
An async Playwright-based recorder that captures login flows by intercepting network requests, detecting forms and CSRF tokens, and saving cloned templates. Includes stealth anti-detection techniques (hiding navigator.webdriver, user-agent randomization). This module demonstrates advanced browser automation patterns and can be reused for web scraping or security testing.
A database migration script that creates all v3.0 tables using idempotent CREATE TABLE IF NOT EXISTS statements with foreign keys. Preserves legacy tables and provides a clean, repeatable schema setup. This pattern is reusable for any SQLite-based project needing versioned schema management.