<commit_before># Ares
Phishing toolkit for red teams and pentesters.

Ares allows security testers to create a phishing environment easily. Ares acts as a proxy between the original site and the phished site, and allows modifications and injects. 

# Getting started

## Docker

Make sure the config toml is located and valid. 

```
docker run -d -p 8080:8080 --name ares -v $(pwd)/config.toml:/etc/ares.toml dutchsec/ares
```

navigate to http://wikipedia.lvh.me:8080/


## Features

* transparant 1 to 1 of original site
* modify specific paths to return static files, rendered as Go templates
* create redirects (short urls)
* inject scripts into target site
* support ssl (using lets encrypt)
* multiple targets / hosts
* enhanced filtering on path, method, ip addresses and useragent
* all requests and responses are being logged into Elasticsearch
* all data is being stored for caching / retrieval

## Todo

* create frontend for configuration, monitoring and dashboard
* send emails from toolkit

## Installation

Make sure you have Go 1.7 installed. 

```
git clone <EMAIL>:dutchcoders/ares.git
go run main.go -c config.toml
```

## Injects

The injects can be inserted in the target site, currently we have the following injects:

* **location** will ask the client for longitude and latitude and post to server
* **snap** will generate screenshots and post to server
* **clipboard** will copy text from clipboard and post to server

## Configuration

```
listener = "0.0.0.0:8080"
tlslistener = "0.0.0.0:8443"

#data = "/data"
#elasticsearch_url = "http://127.0.0.1:9200"

#socks = "socks4://127.0.0.1:9050"

[[host]]
host = "wikipedia.lvh.me"
target = "https://en.wikipedia.org"

[[host.action]]
path = "^.*"
action = "inject"
method = ["GET"]
scripts = ["injects/webrtc.js"]  #"injects/location.js", "injects/snap.js", "injects/clipboard.js"]

[[host.action]]
path = "^/dump"
action = "serve"
content_type = "text/plain"
body = ""

[[host.action]]
path = "^/.*"
action = "replace"
regex = "Wikipedia"
replace = "Blikipedia"

[[host.action]]
path = "/login.html"
action = "file"
method = ["GET"]
file = "static/login.html"

[[host.action]]
path = "^/login.html"
action = "file"
method = ["POST"]
file = "static/login-failed.html"

[[host.action]]
path = "^/short-rul
statuscode = 302
action = "redirect"
location = "/login.html"

[[logging]]
output = "stdout"
level = "info"
```

## Gophish

Ares will work seamless with Gophish, where you'll use Ares for the landing page functionality. <commit_msg>updated documentation<commit_after># Ares

Phishing toolkit for red teams and pentesters. Ares allows security testers to create a phishing environment easily, based on real sites. Ares acts as a proxy between the phised and original site, and allows (realtime) modifications and injects. 

# Getting started

## Docker

Make sure the config toml is located and valid. 

```
docker run -d -p 8080:8080 --name ares -v $(pwd)/config.toml:/etc/ares.toml dutchsec/ares
```

navigate to http://wikipedia.lvh.me:8080/


## Features

* realtime 1 to 1 of original site
* modify specific paths to return static (rendered as Go template) files
* create redirects (short urls)
* inject scripts into target site
* support ssl (using lets encrypt)
* multiple targets / hosts
* enhanced filtering on path, method, ip addresses and useragent
* all requests and responses are being logged into Elasticsearch
* all data is being stored for caching / retrieval

## Todo

* create small frontend for configuration, monitoring and dashboard
* send emails from toolkit

## Installation

Make sure you have Go 1.7 installed. 

```
git clone <EMAIL>:dutchcoders/ares.git
go run main.go -c config.toml
```

## Injects

The injects can be inserted in the target site, currently we have the following injects:

* **location** will ask the client for longitude and latitude and post to server
* **snap** will generate screenshots and post to server
* **clipboard** will copy text from clipboard and post to server

## Configuration

See config.toml.sample for a sample configuration file.

## Gophish

Ares will work seamless with Gophish, where you'll use Ares for the landing page functionality. 
{'fraction_non_alphanumeric': 0.10779158699808795, 'fraction_numerical': 0.017208413001912046, 'mean_word_length': 4.2974683544303796, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4273872', 'n_tokens_mistral': 1342, 'n_tokens_neox': 1252, 'n_words': 518}