Attack Simulation Console
94 templates across 89 families — role-targeted, each with up to 3 psychological variations. Rate-limited sends, unique per-target tracking links, live click timelines.
The open-source human-risk platform
Phish your people.
Protect your people.
Phish-Wiz is an open-source phishing-simulation & human-risk platform — a GoPhish superset with KnowBe4-class tooling: a 94-template attack console, a sender-identity engine on your own verified domains, 16 free security tools, and a built-in awareness academy.
- MIT License
- Resend-signed delivery
- 94 templates
- 11 courses
- 16 security tools
0
Templates · 89 families
0
Academy courses
0
Security tools
0
Vishing pretexts
⚙️
Capabilities
The whole human-risk program on one platform.
🧭How it works
Campaign to measurable risk in five steps.
⚔️Attack Modes
Spear, whaling, vishing — with safety wards.
⚡Security Tools
16 open-source assessment modules.
✦Academy
Interactive courses, slides, exec reports.
🔮Live demo
Cast a simulated campaign, no install.
Capabilities
Everything a human-risk program runs on
One platform, one database, one deployment — from simulation to scoring to training.
GoPhish Engine Integration
Drive a real GoPhish 0.12.1 instance from the console: approval-gated launches, a Resend SMTP bridge for verified-domain delivery, live engine activity, and normalized idempotent event sync — with server-enforced target allowlists.
Camera-Permission Training
A consent-first camera-awareness exercise — the safe CamPhish replacement. Explicit opt-in, local-only preview, a simulated attacker dashboard showing zero frames captured, and a timed quiz feeding the Human Risk board.
Sender Identity Engine
20 ready identities — e.g. AWS Security <aws-no-reply@sociris.com> — on your own verified domains, delivered via Resend with SPF/DKIM alignment. Create & edit your own, main-domain and brand-subdomain styles, auto-matched to every template, one-click test sends.
Human Risk Board
Phish-prone %, per-user 0–100 risk scoring, repeat-offender tracking, and campaign-over-campaign trend lines your board actually understands.
OSINT & Geo Intelligence
Click-time enrichment — IP geolocation (IPv4 & IPv6), ISP/org, VPN/proxy, and a full client fingerprint (screen, timezone, languages, CPU/RAM, GPU) — on a live map. Plus an in-app OSINT console that runs Censys, VirusTotal, urlscan, OTX, Hunter.io, PhishTank, Nmap, Recon-ng & SpiderFoot against a target.
Security Tools Suite
16 free, open-source assessment modules — from domain spoof tests to USB drop exercises — plus opt-in GoPhish and SpiderFoot companion servers. The KnowBe4 free-tools lineup, self-hosted.
Explore the 16 modules →Awareness Academy
11 interactive courses with built-in slide decks, quizzes, and auto-generated executive reports. Auto-assign learning paths after clicks.
Browse the academy →Alerting & SOC Pipeline
Click-time webhooks for Slack, Discord, and Teams; a live Prometheus + Grafana stack with a provisioned datasource and dashboard, up in one command; Wazuh-forwarding ready.
Deployment Freedom
localhost, Docker Compose, VPS, or Cloudflare Tunnel — one-command scripts for each. Your data stays on your infrastructure.
How it works
From campaign to measurable risk — in five steps
One platform, one database, one deployment. Scroll the flow.
-
1
Build the campaign
Pick from 94 role-targeted templates in a guided 3-step stepper — template, identity & content, then targets & review.
-
2
Choose a sender identity
20 ready identities on your own verified domains, delivered via Resend with SPF/DKIM alignment — auto-matched to each template.
-
3
Launch & track
Rate-limited sends, unique per-target tracking links, and a live click timeline the moment recipients engage.
-
4
The click becomes a teachable moment
Clickers land on a debrief page — no credentials are ever stored. The moment is logged, scored, and turned into training.
-
5
Watch risk drop on the board
Phish-prone %, per-user 0–100 scores, repeat offenders, and campaign-over-campaign trends your board actually understands.
Attack Modes
Three modes. One ethical framework.
Beyond mass campaigns: targeted simulation with safety rails engineered into the code, not bolted on.
🎯
Spear Phishing
Per-target personalizationEight merge tokens — {{FIRST_NAME}}, {{LAST_NAME}}, {{ROLE}}, {{COMPANY}}, {{COMPANY_DOMAIN}}, {{EMAIL}}, {{LOCATION}}, {{TARGET_FIRST_NAME}} — let every email land pre-personalized for its exact recipient.
- ✓ OSINT dossier-driven targeting
- ✓ Role-matched lure selection (IT admin ≠ finance clerk)
- ✓ Per-target tracking links and click timelines
🐋
Whaling
Executive-grade scenarios — gated
TWO-PERSON APPROVAL GATE
Executive targeting requires explicit dual approval: whaling campaigns are created in pending_approval and cannot send until a different person approves. Every launch is audit-logged.
- ✓ CEO-fraud, board-deck, M&A-NDA scenarios
- ✓ Pre-approval launch rejected at the API layer (403)
- ✓ Full approval trail retained per campaign
📞
Vishing
Operator-assisted, by designA call-script library with 6 pretexts — IT helpdesk MFA reset, bank fraud OTP, courier redelivery, tax-refund verification, MS-support refund, HR records update — each with openings, objection handlers, and debrief points.
- ✓ Masked number storage (
03**-******7) — full numbers never persisted - ✓ Outcome analytics: complied / suspicious / declined / reported
- ✓ No auto-dialing by design — a trained human operator places every call inside an authorized exercise
Ethics & authorization
Consent-first simulations · educational landing debriefs on every click · test-recipient allowlists before any live send · whaling behind dual approval · no telephony integration, ever.
Security Tools
16 free tools. Zero license keys.
The free-tools lineup you know from commercial platforms — rebuilt open-source and self-hosted behind your own perimeter.
01
Attack Simulation Test
Run a controlled phishing simulation against your own mailbox and read the results instantly.
02
Phish Alert Button
One-click suspicious-email reporting with a live SOC feed of employee reports.
03
Industry Benchmarks
Compare your phish-prone rate against industry and org-size benchmarks.
04
Domain Spoof Test
Audit whether your domain's SPF, DKIM and DMARC reject impersonation of your own brand.
05
Domain Doppelgänger
Detect lookalike and homoglyph domains registered to impersonate your organization.
06
Email Exposure Check
Find which of your employees' addresses are exposed in breach corpora and OSINT sources.
07
Mailserver Assessment
GTUBE-based self-test of your own spam-filter posture, sent only to allowlisted recipients.
08
Weak Password Test
Password-strength analysis exposing the patterns your people actually use.
09
Breached Password Test
k-anonymity checks against known-breach corpora — passwords never leave in cleartext.
10
Browser Password Inspector
Assess what browser-stored credentials expose if an endpoint is compromised.
11
Ransomware Simulator
Educational walkthrough of a ransomware chain — no payload, all teaching.
12
BreachSim
Simulate breach scenarios to rehearse your incident-response playbooks.
13
USB Security Test
Managed USB drop exercises with printable kits and outcome logging.
14
Program Maturity Assessment
Questionnaire-based scoring of your awareness program against best practice.
15
Automated Awareness Program
Continuous, scheduled awareness cycles instead of annual-slide-deck theatre.
16
Secure Hiring & Onboarding
Security hygiene built into day one for every new joiner.
Awareness Academy
11 courses that ship as a full package
Every course includes an interactive reader, a presentation slide deck, and an auto-generated executive report. Two are live below as demos.
Core
Demo
Phishing Awareness
Anatomy of phishing — mass campaigns, spear phishing, whaling, smishing and vishing — and the 30-second verification habit.
Core
Demo
Passwords & MFA
Long passphrases, password managers, MFA factor strength, and surviving MFA-fatigue (push bombing) attacks.
Core
Email Security Essentials
How email really works, reading headers, SPF/DKIM/DMARC in plain language, safe attachments and links.
Core
Incident Reporting & No-Blame Culture
What to report, how to report it fast, and why a no-blame culture is your strongest control.
Core
Social Engineering Defense
Six psychological levers, pretexting, tailgating, and deepfake voice/video fraud indicators.
Core
Safe Browsing & Mobile Security
What the padlock really means, sideloaded-app risk, public Wi-Fi, and quishing (QR-code phishing).
Core
Remote Work Security
Home-network hardening, device separation, VPN discipline, and physical document security.
Core
Secure Hiring & Onboarding
Account setup order-of-operations, onboarding-themed phishing, and the first-60-minutes laptop checklist.
Compliance
Data Protection & Privacy Essentials
GDPR-style privacy principles mapped to everyday work and the 72-hour breach clock.
Compliance
Security & Compliance Essentials
ISO 27001 / PCI essentials translated into daily staff behavior.
Advanced
Ransomware Resilience
The ransomware kill chain, backup discipline, and rehearsed recovery decisions.
Awareness Hub
The click is where teaching starts
When someone clicks a simulation link, Phish-Wiz turns the moment into a lesson — instantly.
1
Instant debrief
The educational landing page shows the 4 red flags they missed in the exact email that fooled them.
2
60-second quiz
A rapid refresher quiz locks the lesson in while the surprise is still fresh.
3
Learning path
A personal path into the Awareness Hub courses that matches their weak spot.
Try the demo course readers
Phishing Awareness
Full interactive course reader — the exact experience clickers receive.
Open demo course →Passwords & MFA
Passphrases, managers, and MFA-fatigue defense — quizzes included.
Open demo course →+ 9 more courses
Email security, social engineering, ransomware resilience, GDPR, ISO 27001/PCI and more — available in the platform.
Get the platform →
Live demo
Cast a campaign — watch it land
Click through a simulated launch below, then open the real read-only console.
Choose a lure
Sender identity
Pick a lure to resolve the sender…
✓ SPF / DKIM aligned · delivered via Resend on your verified domain
Inbox preview
Your email preview appears here.
Pick a lure to continue
Target cohort — 8 of 8 selected
Rate limit · 6/min
Casting… 0/8 delivered
Prefer the real thing? Open the live console in read-only mode — real dashboard, real reports, nothing you can break.
Open live console ↗
sign in
demo / demo
Compare
Phish-Wiz vs GoPhish vs KnowBe4
GoPhish built the open-source simulation foundation. Phish-Wiz builds the rest of the program on top of it.
| Capability | Phish-Wiz | GoPhish | KnowBe4 |
|---|---|---|---|
| Simulation engine | 94 role-targeted templates in 89 families, 3 variations each | No built-in library — import your own templates | Commercial template library |
| Sender identities | Owned-domain identity engine — brand display names, SPF/DKIM aligned via Resend | SMTP sending profiles | Managed senders |
| Training | Built-in academy — 11 courses, auto-assign after clicks | None | Largest content library in class |
| Risk scoring | Per-user 0–100 score + phish-prone trend | None | Yes |
| Security tools suite | 16 open-source modules | None | Paid add-ons |
| Attack modes | Spear · whaling (dual-approval gate) · vishing | None | Paid tiers |
| Pricing | Open source — MIT | Open source — MIT | Commercial, per-seat |
Feature comparison as of Oct 2026, community-maintained. GoPhish and KnowBe4 are respected products — this table tracks scope, not quality.
Capstone & Defense
Built in the lab, proven against a SOC
Phish-Wiz is an IBA CICT 2026 capstone, exercised inside a three-tool lab: Phish-Wiz × GoPhish × Cam-Phish, with detection carried by a Wazuh SOC.
≤ 60s
target time from simulated click to Wazuh SOC alert
T1566 / T1204
MITRE ATT&CK mapping — Phishing and User Execution — on every exercise
Quickstart
Deploy in 60 seconds
Three paths, all one command each. Configuration lives in .env — Resend is optional; the Ethereal testing fallback is documented and automatic.
terminal — Node.js 20+
# Clone and run
git clone https://github.com/matx104/Phish-Wiz.git
cd Phish-Wiz && npm install
npm start
# Open http://localhost:5000
terminal — Docker
# Full stack, detached
docker-compose up -d
# Or build manually
docker build -t phish-wiz .
docker run -p 5000:5000 -v $(pwd)/data:/app/data phish-wiz
terminal — Cloudflare Tunnel
# Public HTTPS tracking links in one command
./scripts/serve-tunnel.sh
# Full deployment menu (Docker / VPS / tunnel)
./scripts/deploy.sh
.env holds all config. Production email uses Resend
(EMAIL_PROVIDER=resend + RESEND_API_KEY on your verified domain);
with no key set, Phish-Wiz automatically falls back to Ethereal —
captured, never delivered — so you can test safely from minute one.
Proven End-to-End
Verified pipeline, not a slideware promise
Every stage below was exercised against live infrastructure — real delivery, real tracking, real scoring.
1
Campaign launched
API-driven launch with the AWS identity — sender auto-resolved from the template.
2
Resend delivery
SPF/DKIM-signed send from aws-no-reply@sociris.com to an authorized test inbox.
3
Tracked click
Unique per-target link clicked — landing debrief rendered instantly.
4
OSINT captured
User agent, geolocation and VPN enrichment recorded at click time.
5
Risk engine updated
Phish-prone %, per-user 0–100 score and trend lines recalculated live.
Run your first simulation today
MIT-licensed. Self-hosted. Your people, your infrastructure, your data.