Phishing Simulation Tools

About Phishing Simulation Tools

Social engineering and phishing simulation tools let authorized teams test employee awareness and email security controls through controlled campaigns. The category includes phishing campaign platforms like Gophish, and the no longer maintained King Phisher, that send simulated phishing emails to employees, track who opens them, and measure credential submission rates. Evilginx and Modlishka are adversary-in-the-middle proxies that bypass two-factor authentication by proxying login pages and capturing session tokens, used to test whether MFA implementations resist phishing attacks. The Social-Engineer Toolkit (SET) provides guided attack vectors for authorized social engineering assessments. Security awareness teams use these tools to measure how many employees click phishing links, submit credentials, or open attachments, then target training at the identified weak points. Email security teams use phishing simulations to test whether mail filters, DMARC policies, and endpoint protections catch phishing payloads before they reach users. The category overlaps with red team tools, since social engineering is often the initial access vector in red team campaigns. All tools in this category are for authorized use only, typically run by internal security teams or contracted assessors against their own organization.