King Phisher
Open-source phishing campaign toolkit with client-server architecture, supporting multiple concurrent campaigns, plugins, and SPF checks.
The project README states: "King Phisher is no longer being maintained." The last release, v1.15.0, was published in September 2019.
Technical Architecture & Overview
King Phisher is an open-source phishing campaign toolkit originally developed by SecureState. It uses a client-server architecture where the server runs on Linux and the client connects from Windows or Linux. It supports multiple concurrent campaigns, email templates, landing pages, and plugins.
Targeted Technical Use Cases
Internal red teams or security awareness programs that need a self-hosted, plugin-extensible phishing simulation platform with client-server separation and PostgreSQL or SQLite support.
Evaluation & Trade-offs
Core Strengths
- +Client-server model separates the operator console from the campaign server.
- +Supports multiple simultaneous campaigns and plugin extensions.
- +Includes SPF checks, calendar invitations, and geo-location for realistic email testing.
Trade-Offs & Limitations
- -The project is no longer maintained.
- -The server is Linux-only, and the client authenticates to the server over SSH.
Defensive Security Application
Run simulated phishing campaigns that measure and promote user awareness.
Frequently Asked Questions
What is King Phisher?→
King Phisher is an open-source phishing campaign toolkit originally developed by SecureState. It uses a client-server architecture where the server runs on Linux and the client connects from Windows or Linux. It supports multiple concurrent campaigns, email templates, landing pages, and plugins.
What is King Phisher used for?→
Internal red teams or security awareness programs that need a self-hosted, plugin-extensible phishing simulation platform with client-server separation and PostgreSQL or SQLite support.
What are the strengths of King Phisher?→
- +Client-server model separates the operator console from the campaign server.
- +Supports multiple simultaneous campaigns and plugin extensions.
- +Includes SPF checks, calendar invitations, and geo-location for realistic email testing.
What are the limitations of King Phisher?→
- +The project is no longer maintained.
- +The server is Linux-only, and the client authenticates to the server over SSH.
How is King Phisher used defensively?→
Run simulated phishing campaigns that measure and promote user awareness.