King Phisher
Open-source phishing campaign toolkit with client-server architecture, supporting multiple concurrent campaigns, plugins, and SPF checks.
King Phisher has been unmaintained since September 2019. The project README states it is no longer actively developed. Gophish is the recommended open-source alternative for phishing simulation.
Technical Architecture & Overview
King Phisher is an open-source phishing campaign toolkit originally developed by SecureState. It uses a client-server architecture where the server runs on Linux and the client connects from Windows or Linux. It supports multiple concurrent campaigns, email templates, landing pages, and plugins.
Targeted Technical Use Cases
Internal red teams or security awareness programs that need a self-hosted, plugin-extensible phishing simulation platform with client-server separation and PostgreSQL or SQLite support.
Evaluation & Trade-offs
Core Strengths
- +Client-server model separates the operator console from the campaign server.
- +Supports multiple simultaneous campaigns and plugin extensions.
- +Includes SPF checks, calendar invitations, and geo-location for realistic email testing.
Trade-Offs & Limitations
- -The project is no longer actively maintained by the original authors.
- -The server is Linux-only, and the client setup requires SSH and local accounts.
- -The user interface and plugin ecosystem are less modern than newer alternatives.
Defensive Security Application
Run simulated phishing campaigns that measure user awareness and verify that email controls and landing-page detection work as intended.
Frequently Asked Questions
What is King Phisher?→
King Phisher is an open-source phishing campaign toolkit originally developed by SecureState. It uses a client-server architecture where the server runs on Linux and the client connects from Windows or Linux. It supports multiple concurrent campaigns, email templates, landing pages, and plugins.
What is King Phisher used for?→
Internal red teams or security awareness programs that need a self-hosted, plugin-extensible phishing simulation platform with client-server separation and PostgreSQL or SQLite support.
What are the strengths of King Phisher?→
- +Client-server model separates the operator console from the campaign server.
- +Supports multiple simultaneous campaigns and plugin extensions.
- +Includes SPF checks, calendar invitations, and geo-location for realistic email testing.
What are the limitations of King Phisher?→
- +The project is no longer actively maintained by the original authors.
- +The server is Linux-only, and the client setup requires SSH and local accounts.
- +The user interface and plugin ecosystem are less modern than newer alternatives.
How is King Phisher used defensively?→
Run simulated phishing campaigns that measure user awareness and verify that email controls and landing-page detection work as intended.