orig_sub: ''
            domain: 'okta.com'
            search: 'X-Frame-Options: DENY'
            replace: 'Test: test'
            mimes: ['text/html', 'charset=utf-8']
          ```
            - Frame Busting Techniques Generally used
              - https://en.wikipedia.org/wiki/Framekiller
              - https://seclab.stanford.edu/websec/framebusting/framebust.pdf
                - Common Techniques to Detect Presence of iframe
                  ```
                    if (top != self)
                    if (top.location != self.location)
                    if (top.location != location)
                    if (parent.frames.length > 0)
                    if (window != top)
                    if (window.top !== window.self)
                    if (window.self != window.top)
                    if (parent && parent != window)
                    if (parent && parent.frames && parent.frames.length>0)
                    if((self.parent&&!(self.parent===self))&&(self.parent.frames.length!=0))
                  ```
                - Websites may use following method once iframe detected to perform redirection
                   ```
                   top.location.replace(self.location)
                    top.location.href = window.location.href
                    top.location.replace(document.location)
                    top.location.href = window.location.href
                    top.location.href = "URL"
                    document.write(’’)
                    top.location = location
                    top.location.replace(document.location)
                    top.location.replace(’URL’)
                    top.location.href = document.location
                    top.location.replace(window.location.href)
                    top.location.href = location.href
                    self.parent.location = document.location
                    parent.location.href = self.document.location
                    top.location.href = self.location
                    top.location = window.location
                    top.location.replace(window.location.pathname)
                    window.top.location = window.self.location
                    setTimeout(function(){document.body.innerHTML=’’;},1);
                    window.self.onload = function(evt){document.body.innerHTML=’’;}
                    var url = window.location.href; top.location.replace(url)
                   ```
                
### Blog e Talk di Ricerca su Evilginx:
- Un mare calmo non ha mai fatto un pescatore esperto - Kuba Gretzky (x33fc0n 2024):
    - Talk: [https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R](https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R)
    - Slide: [https://github.com/kgretzky/talks/blob/main/2024/x33fcon/a-smooth-sea-never-made-a-skilled-phisherman.pdf](https://github.com/kgretzky/talks/blob/main/2024/x33fcon/a-smooth-sea-never-made-a-skilled-phisherman.pdf)
- La tri-forza dell'accesso iniziale: [https://trustedsec.com/blog/the-triforce-of-initial-access](https://trustedsec.com/blog/the-triforce-of-initial-access)
    - Bobber: [https://github.com/Flangvik/Bobber](https://github.com/Flangvik/Bobber)
- Bypassare il rilevamento Canary AiTM: [https://insights.spotit.be/2024/06/03/clipping-the-canarys-wings-bypassing-aitm-phishing-detections/](https://insights.spotit.be/2024/06/03/clipping-the-canarys-wings-bypassing-aitm-phishing-detections/)
- Proteggere Evilginx usando Cloudflare e offuscamento HTML: [https://www.jackphilipbutton.com/post/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation](https://www.jackphilipbutton.com/post/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation)
- (Migliorare la fiducia nella consegna email di Evilginx) Aggiungere record SPF, DMARC, DKIM, MX: [https://fortbridge.co.uk/research/add-spf-dmarc-dkim-mx-records-evilginx/](https://fortbridge.co.uk/research/add-spf-dmarc-dkim-mx-records-evilginx/)
    - [https://m3rcer.netlify.app/redteaming/spamfilterbypass/](https://m3rcer.netlify.app/redteaming/spamfilterbypass/)
- Tattiche di phishing e OPSEC: [https://mgeeky.tech/uploads/WarCon22 - Modern Initial Access and Evasion Tactics.pdf](https://mgeeky.tech/uploads/WarCon22%20-%20Modern%20Initial%20Access%20and%20Evasion%20Tactics.pdf)
- Evilginx + BITB + Tattiche di evasione: [https://youtu.be/p1opa2wnRvg](https://youtu.be/p1opa2wnRvg)
- Hook, Line e Phishlet - Conquistare AD FS con Evilginx: [https://research.aurainfosec.io/pentest/hook-line-and-phishlet/](https://research.aurainfosec.io/pentest/hook-line-and-phishlet/)
- Infrastruttura di phishing O365 - [https://badoption.eu/blog/2023/12/03/PhishingInfra.html](https://badoption.eu/blog/2023/12/03/PhishingInfra.html)
- Non puoi vedermi – Proteggere la tua infrastruttura di phishing: [https://redsiege.com/blog/2024/01/you-cant-see-me-protecting-your-phishing-infrastructure/](https://redsiege.com/blog/2024/01/you-cant-see-me-protecting-your-phishing-infrastructure/)
- [https://janbakker.tech/evilginx-resources-for-microsoft-365/](https://janbakker.tech/evilginx-resources-for-microsoft-365/)
- Evilginx + BITB - [https://www.youtube.com/watch?v=luJjxpEwVHI&feature=youtu.be](https://www.youtube.com/watch?v=luJjxpEwVHI&feature=youtu.be)
- Hook, Line e Sinker: Phishing di Windows Hello for Business usando Evilginx: [https://medium.com/@yudasm/bypassing-windows-hello-for-business-for-phishing-181f2271dc02](https://medium.com/@yudasm/bypassing-windows-hello-for-business-for-phishing-181f2271dc02)
- Phishing del resistente - Phishing del token di aggiornamento primario in Microsoft Entra di Dirk Jan: [https://youtu.be/tNh_sYkmurI?si=qcb917IB5zHU1fQk](https://youtu.be/tNh_sYkmurI?si=qcb917IB5zHU1fQk)
- X33fcon 2024 - [https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R](https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R)
- Come sparare ai pesci in un barile - Bypassare i crawler di link: [https://posts.specterops.io/like-shooting-phish-in-a-barrel-926c1905bb4b](https://posts.specterops.io/like-shooting-phish-in-a-barrel-926c1905bb4b)
- Bevi come un pesce - Come far mimetizzare i tuoi siti di phishing: [https://posts.specterops.io/drink-like-a-phish-b9e91d0b5677](https://posts.specterops.io/drink-like-a-phish-b9e91d0b5677)
- Nutrire i pesci: [https://posts.specterops.io/feeding-the-phishes-276c3579bba7](https://posts.specterops.io/feeding-the-phishes-276c3579bba7)
- [https://posts.specterops.io/phish-out-of-water-aaeb677a5af3](https://posts.specterops.io/phish-out-of-water-aaeb677a5af3)
- [https://youtu.be/6jYZQKDlKco?si=cpfd4tWQ4V8ZAZaI](https://youtu.be/6jYZQKDlKco?si=cpfd4tWQ4V8ZAZaI)
- [https://posts.specterops.io/one-phish-two-phish-red-teams-spew-phish-1a2f02010ed7](https://posts.specterops.io/one-phish-two-phish-red-teams-spew-phish-1a2f02010ed7)
- Rilevamento degli strumenti di phishing Push Security: [https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d](https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d)
    - L'estensione Chrome di Push Security rileva evilginx con alcune regole piuttosto fragili
        - Regola 1: Nome cookie=XXXX-XXXX e valore=64_hex_chars
        - Regola 2: Percorso script=/s/64_hex_chars.js con content-length=0
        - Regola 3: Entrambe le Regole 1 e 2 presenti
        - la logica completa dello snippet JS blob è qui [https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d](https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d)
- [https://janbakker.tech/evilginx-loves-temporary-access-passes-too/](https://janbakker.tech/evilginx-loves-temporary-access-passes-too/)
          
### Tattiche difensive contro Evilginx
- Svelare e contrastare il phishing Avversario nel mezzo - X33fcon 2024 - [https://youtu.be/-W-LxcbUxI4](https://youtu.be/-W-LxcbUxI4?feature=shared)
- Usare HoneyTokens per rilevare AiTM: [https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/](https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/)
- Proteggersi contro il phishing moderno: [https://bleekseeks.com/blog/how-to-protect-against-modern-phishing-attacks](https://bleekseeks.com/blog/how-to-protect-against-modern-phishing-attacks)
- [https://www.youtube.com/watch?v=wTLB0Yh70_0](https://www.youtube.com/watch?v=wTLB0Yh70_0)
- Rilevare evilginx usando l'impronta digitale JA3, JA3S, JA4
    - Database JA4: [https://ja4db.com/](https://ja4db.com/)
    

    



## Mettere in sicurezza l'infrastruttura GoPhish

> Queste modifiche funzioneranno anche con l'ultima versione di evilginx + gophish, ovvero evilginx3.3
> 
- Suggerimenti: Usa il parametro {{.URL}} nel modello di phishing quando usi evilginx ( [https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864](https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864))
- Modifiche nel codice sorgente e nella struttura dei file di gophish per mettere in sicurezza l'infrastruttura GoPhish
    - Rimuovere le istanze di `X-Gophish` (`X-Gophish-Contact`, `X-Gophish-Signature`)
    - Rimuovere `const ServerName= "gophish"` e cambiarlo in `const ServerName= "IGNORE"` nel file `config/config.go`
    - Cambiare la porta predefinita del server Admin nel file `config.json`.
    - Modificare le firme dei messaggi email di test, per evitare il rilevamento durante i test SMTP.
        
        ```yaml
        Controllers > api > util.go
        models > testdata > email_request.go
        models > testdata > email_request_test.go
        models > testdata > maillog.go
        models > testdata > maillog_test.go
        models > testdata > smtp_test.go
        ```
        
    - Cambiare la risposta 404
        - Aggiungere la funzione personalizzata qui sotto nel file `controllers/phish.go`
            
            ```go
            func customNotFound(w http.ResponseWriter, r *http.Request) {
            	http.Error(w, "Try again!", http.StatusNotFound)
            }
            ```
            
        - Ora sostituisci tutte le istanze di `http.NotFound(w, r)` con `customNotFound(w, r)`
    - Rimuovere la risposta hardcoded di robots.txt e modificarla nel file `controllers/phish.go`
        - Modificare il codice corrispondente nel file phish.go con quello sotto.
            
            ```go
            //Risposta modificata
            // RobotsHandler impedisce ai motori di ricerca, ecc. di indicizzare materiali di phishing
            func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
            	fmt.Fprintln(w, "User-agent: *\nDisallow: /*/*\nDisallow: /.git/*")
            }
            ```
            
    - Modificare il parametro GET `"rid"` nelle richieste
        - Assicurati di modificare tutte le istanze di `"rid"` in qualcos'altro.
        - Questi sono presenti anche nel codice sorgente di evilginx3.3, quindi assicurati di modificarli anche lì.
    - Per prevenzioni avanzate, puoi modificare anche la cartella static e rinominarla in qualcos'altro, così come rinominare i file al suo interno per evitare il rilevamento basato sul percorso. Non dimenticare di modificare anche il codice sorgente pertinente.
        - Come i nomi delle immagini, ad esempio: pixel.png, modificalo in qualcos'altro.
    - Cambiare le proprietà del certificato nel file `util/util.go`
        
        ```go
        	template := x509.Certificate{
        		SerialNumber: serialNumber,
        		Subject: pkix.Name{
        			//Organization: []string{"Gophish"},
        			Organization: []string{"Microsoft Corporation"},
        		},
        ```
        
    - Usa Nginx per proxyare il traffico attraverso di esso per evitare qualsiasi impronta del server Golang
        - `service nginx start`
        - Devi cambiare il `config.json` di gophish per cambiare le porte per http da 80 a 8080 e https da predefinita a 60002, come mostrato sotto
            
            ```yaml
            {
            	"admin_server": {
            		"listen_url": "127.0.0.1:60002",
            		"use_tls": true,
            		"cert_path": "gophish_admin.crt",
            		"key_path": "gophish_admin.key",
            		"trusted_origins": []
            	},
            	"phish_server": {
            		"listen_url": "127.0.0.1:8080",
            		"use_tls": false,
            		"cert_path": "example.crt",
            		"key_path": "example.key"
            	},
            	"db_name": "sqlite3",
            	"db_path": "gophish.db",
            	"migrations_prefix": "db/db_",
            	"contact_address": "",
            	"logging": {
            		"filename": "",
            		"level": ""
            	}
            }
            ```
            
        - La configurazione qui sotto bloccherà tutte le richieste con user agent contenente “Bot” o “bot”
            
            ```yaml
            # /etc/nginx/nginx.conf
            
            events {
                # Define event processing parameters here
                worker_connections 1024; # Adjust according to your requirements
            }
            
            http {
            
                upstream backend {
                    server localhost:8080;
                }
                # HTTP server
                server {
                    listen 80 default_server;
                    
            
                    # Reject requests with "bot" or "Bot" in User-Agent
                    if ($http_user_agent ~* (bot|Bot)) {
                        return 403;
                    }
            
                    location / {
                        proxy_pass http://backend;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            
                upstream backend_https {
                    server localhost:60002;
                }
                # HTTPS server
                server {
                    listen 60001 ssl default_server;
            
                    ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
                    ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;
            
                    # Reject requests with "bot" or "Bot" in User-Agent
                    if ($http_user_agent ~* (bot|Bot)) {
                        return 403;
                    }
            
                    location / {
                        proxy_pass https://backend_https;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            }
            
            ```
            
        - Per permettere solo un user agent specifico, usa la configurazione qui sotto. Questo bloccherà tutte le richieste e permetterà solo quelle con user agent “`iamdevil`”.
            
            ```yaml
            # /etc/nginx/nginx.conf
            
            events {
                # Define event processing parameters here
                worker_connections 1024; # Adjust according to your requirements
            }
            
            http {
            
                upstream backend {
                    server localhost:8080;
                }
            
                # HTTP server
                server {
                    listen 80 default_server;
            
                    # Reject requests with user agent other than "iamdevil"
                    if ($http_user_agent != "iamdevil") {
                        return 403;
                    }
            
                    location / {
                        proxy_pass http://backend;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            
                upstream backend_https {
                    server localhost:60002;
                }
            
                # HTTPS server
                server {
                    listen 60001 ssl default_server;
            
                    ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
                    ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;
            
                    # Reject requests with user agent other than "iamdevil"
                    if ($http_user_agent != "iamdevil") {
                        return 403;
                    }
            
                    location / {
                        proxy_pass https://backend_https;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            }
            ```
            
    - Modificare la firma del pixel di tracciamento di Gophish per evitare il rilevamento basato sul pixel di tracciamento firmato.
    - Cambiare il pattern della sequenza delle intestazioni email di gophish. Può essere usato per rilevare gophish (dalla community BreakDev Red).
    - Configurare PostFix davanti a gophish per rimuovere IOCs e altri rilevamenti e la natura spam delle email, e anche rimuovere e correggere le intestazioni.

- **Blog e talk di ricerca su GoPhish:**
    - [https://edermi.github.io/post/2021/modding_gophish/](https://edermi.github.io/post/2021/modding_gophish/)
    - [https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls](https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls)
    - [https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf](https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf)
    - [https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls](https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls)
    - [https://github.com/puzzlepeaches/sneaky_gophish](https://github.com/puzzlepeaches/sneaky_gophish)
    - [https://cybercx.co.nz/blog/identifying-gophish-servers/](https://cybercx.co.nz/blog/identifying-gophish-servers/)
    - [https://github.com/gophish/gophish/issues/1553#issuecomment-523969887](https://github.com/gophish/gophish/issues/1553#issuecomment-523969887)

- **Alternative a Gophish:**
    - SniperPhish: https://github.com/GemGeorge/SniperPhish
    - Mailcow: https://github.com/mailcow/mailcow-dockerized


## Blog e talk di ricerca su Post-Exploitation / Phishing AiTM

- AiTM (Post-Exploitation): https://www.youtube.com/live/WY4mH-8TbWY?si=LkZ1LuduDln1vRuj
    - https://youtu.be/py68OE4tQ4Q?si=n6QlNuro88c1PRzn
- https://trustedsec.com/blog/the-triforce-of-initial-access
- https://www.youtube.com/live/tOzURCc-qUc?si=DMkLwXHVQomRMEJD## Altre Tecniche/Blog/Ricerche
- Per abusare di siti legittimi per il Phishing : https://lots-project.com/
- Muraena : https://github.com/muraenateam/muraena
- NecroBrowser : https://github.com/muraenateam/necrobrowser
- BITB : https://mrd0x.com/browser-in-the-browser-phishing-attack/
    - Frameless-bitb : https://github.com/waelmas/frameless-bitb
        - https://youtu.be/luJjxpEwVHI?si=sk8kMfdfhZbTz8qR
    - CuddlePhish : https://github.com/fkasler/cuddlephish
    - https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/
    - Okta concatenato con Azure con auto MFA Subscription per Okta e Frame Buster Bypass per eseguire BITB : https://x.com/otterhacker/status/1929487165458641045?s=46&t=mlJvZy0Zrkrxzuvtt7m2cQ
        - https://github.com/OtterHacker/OktaGinx/
- Progressive Web Apps (PWA) Phishing : https://mrd0x.com/progressive-web-apps-pwa-phishing/
- noVNC Phishing : https://adepts.of0x.cc/novnc-phishing/
    - EvilnoVNC : https://github.com/JoelGMSec/EvilnoVNC
    - MultiEvilnoVNC : https://blog.wanetty.com/blog/tools/multievilnovnc
    - https://fhlipzero.io/blogs/6_noVNC/noVNC.html
    - Delusion (Toolkit basato su NoVNC) : https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-browser-in-the-middle
    - Rilevamento di NoVNC : https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d
- noVNC e Docker : https://powerseb.github.io/posts/Another-phishing-tool/
    - https://github.com/powerseb/NoPhish
    - https://fhlipzero.io/blogs/6_noVNC/noVNC.html
    - https://github.com/Macmod/YesPhish/tree/patchright-chrome
- EvilQR - QR Phishing
    - Genera QR : https://github.com/Flangvik/QRucible
    - https://badoption.eu/blog/2024/01/08/mobilephish.html
    - QR2Ascii : https://github.com/Jojodicus/qr2eascii
    - https://github.com/kgretzky/evilqr , https://breakdev.org/evilqr-phishing/
    - https://github.com/swagkarna/EvilJack
    - https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/hunting-for-qr-code-aitm-phishing-and-user-compromise/bc-p/4054850
- NoPhish (docker e noVNC) : https://github.com/powerseb/NoPhish e https://badoption.eu/blog/2023/07/12/entra_phish.html
- EvilGoPhish : https://github.com/fin3ss3g0d/evilgophish
- Smishing : https://blog.shared-video.mov/systematic-destruction-hacking-the-scammers-pt.-2
- Phishing con CloudFlare Workers
    - TryCloudflare : https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
    - https://github.com/zolderio/AITMWorker
    - https://gist.github.com/RedTeamOperations/33f245a777c9b322b0466b59d6687f15
    - https://cyberwarfare.live/wp-content/uploads/2023/08/Certified-Red-Team-CredOps-Infiltrator-CRT-COI-1.pdf
- Phishing con Cloudflare Public Buckets : https://developers.cloudflare.com/r2/buckets/public-buckets/
    - https://medium.com/trac-labs/aitm-phishing-hold-the-gabagool-analyzing-the-gabagool-phishing-kit-531f5bbaf0e4
- Google Open Redirection per phishing
    - https://untrustednetwork.net/en/2024/02/26/google-open-redirect/
    - Open Redirect non funzionante : https://googleweblight.com/i?u=m4lici0u5.com
    - Open Redirect : https://www.google.com/url?q=https://m4lici0u5.com
    - Open Redirect : https://business.google.com/website_shared/launch_bw.html?f=https://m4lici0u5.com
    - Altri possono essere trovati su : https://lots-project.com/
- https://blog.delivr.to/delivr-tos-top-10-payloads-dec-24-pastejacking-image-less-qr-codes-and-concatenated-zip-a32e668106dd#878d
- Phishing oltre i controlli di protezione della posta utilizzando Azure Information Protection
    - https://youtu.be/tHNi5BzScVo?si=H2czog19AmTp_O26
    - https://youtu.be/EYUp_MNtJIk?si=sg_9RQggDvqOSLNL
    - https://youtu.be/KhdzIPPW4W0?si=E4CmWx0iO8EaR6JF
- https://nicolasuter.medium.com/aitm-phishing-with-azure-functions-a1530b52df05
- https://pushsecurity.com/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation/
- https://blog.delivr.to/delivr-tos-top-10-payloads-dec-24-pastejacking-image-less-qr-codes-and-concatenated-zip-a32e668106dd#878d
- https://trustedsec.com/blog/oops-i-udld-it-again
- Phishing di credenziali tramite abuso di Docusign : https://sublime.security/blog/living-off-the-land-credential-phishing-via-docusign-abuse/
- Phishing di credenziali nascosto con allegati EML : https://sublime.security/blog/hidden-credential-phishing-within-eml-attachments/
- https://sublime.security/blog/talking-year-end-credential-phishing-scams-over-turkey/
- Utilizzo di Microsoft Customer Voice per Phishing : https://cofense.com/blog/microsoft-customer-voice-urls-used-in-latest-phishing-campaign
- https://www.youtube.com/live/tOzURCc-qUc?si=DMkLwXHVQomRMEJD
- DoubleClickJacking : https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html
    - https://safetyscience.info/labs/doubleclickjacking/
- Confronto tra varie tecniche : https://blog.quarkslab.com/technical-dive-into-modern-phishing.html
- https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-browser-in-the-middle
- Abuso di webhook in arrivo di Microsoft Teams per phishing : https://www.blackhillsinfosec.com/wishing-webhook-phishing-in-teams/
    - https://www.youtube.com/live/kMMZrd9intI?si=rd_EKWmXeKbbGAEI
- Rogue RDP o RDP (.rdp) per phishing : https://github.com/GoSecure/pyrdp
    - https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol
    - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
- https://easydmarc.com/blog/google-spoofed-via-dkim-replay-attack-a-technical-breakdown/
- SVG per phishing : https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pixel-perfect-trap-the-surge-of-svg-borne-phishing-attacks/
- Utilizzo di ClickOnce con Phishing per accesso iniziale  : https://www.netspi.com/blog/technical-blog/adversary-simulation/all-you-need-is-one-a-clickonce-love-story/
- https://denniskniep.github.io/posts/09-device-code-phishing/
- https://badoption.eu/blog/2025/04/25/github.html
- https://atticsecurity.com/blog/aitm-for-whfb-persistence/
- [Da controllare] Evilworker : https://github.com/Ahaz1701/EvilWorker
    - https://medium.com/@ahaz1701/evilworker-da94ae171249

## Talk di Ricerca sul Phishing
- https://youtu.be/zmo_tPbCXtA?si=4imjZtwQ6I9iu_tP