A world first in
Secure Email Gateway Evaluation.

Phishious is an open-sourced Secure Email Gateway evaluation toolkit designed for red-teamers. It provides the ability to see how various Secure Email Gateway technologies behave when presented with phishing material.

See the GitHub Project or Run a Manual Scan
Phishious Result Output
Square dotted pattern
Square dotted pattern
Gray semi-circle header
Gray semi-circle header

Why use Phishious?

We're not joking when we say that Phishious is a world first in Secure Email Gateway evaluation. There is currently no other tool available (free or paid) that provides the ability for you as a red-teamer to scan your phish against an array of Secure Email Gateways. The closest utility is VirusTotal however this specifically focuses on Malware detection and not Spam/Phish detection.

Through use of Phishious, you'll be able to freely test your phishing material against the world's most popular Secure Email Gateways. This is an invaluable capability as it provides you an indication of how successful your phishing campaign may be.

How does Phishious work?

Phishious exploits a common misconfiguration where many organisations broadcast overly sensitive information in email bounce responses and non-delivery reports. The sensitive information typically comes in the form of original untampered inbound message headers.

By feeding this information into Phishious, it can extract the relevant information and detect when an email is likely to end up in a targets quarantine folder or be completely blocked by the SEG. When we scale this up from 1 target to many, we're able to aggregate this information to provide a holistic view on how various SEGs behave when delivered certain phishing material.

To better understand email bounce attacks and the resulting issues, please read the following Linkedin Article or watch this BSides Canberra presentation.

How to run a automated Phishious scan

Documentation is underway. Please check the GitHub project regularly for an update. If using Gmail then use a throwaway Gmail address with "Less secure app access" enabled. This setting is required so Phishious can connect to your Gmail account using a username + password instead of access token. This setting can be toggled by clicking here.

How to run a manual Phishious scan

A Phishious scan is comprised of four distinct phases. These phases are outlined in detail below:

Phase 1: Identification of Vulnerable Mail Receivers
As Phishious is designed to abuse public infrastructure, you need to identify a variety of targets who use differing mail security technologies (e.g. Target 1 uses Sophos PureMessage, Target 2 uses Cisco IronPort, etc.). Identification of Vulnerable Mail Receivers can be found through manual analysis (e.g. CanIPhish Supply Chain Analysis and CanIPhish Global Historic Search) or programmatic means (e.g. CanIPhish Supply Chain API).

Image: The accompanying image is of a CanIPhish Supply Chain Scan which shows a vulnerable 'Mail Receiver Supply Chain' that comprises of Symantec MessageLabs and Exchange Online Protection.

CanIPhish Supply Chain Domain Scan

Phase 2: Filter Priming
Step 1. Email non-malicious content to a non-existent address at various target domains where a bounce attack vulnerability exists and a known Secure Email Gateway (SEG) is in-use.
Note: At this stage, only Amazon SES and Gmail have been tested for the receipt of bounce responses. Do not use Exchange Online.

Image: The accompanying image is of an email (within Gmail) directed towards non-existent addresses at 15 targets. Each target was uniquely identified and selected for their differing Secure Email Gateway technologies.

Email being sent within Gmail

Step 2. Wait 180 seconds. Download all received bounce responses and then upload them to Phishious for Filter Priming. Upon Priming, you will see the status of all Secure Email Gateway technologies identified. For filter detonation (Phase 3), only these technologies will be targeted.

Image: The accompanying images show the email bounce responses being uploaded to Phishious and then the observed result of Filter Priming.

Multiple Non-Delivery-Reports being uploaded to Phishious for Priming
Phishious Priming Output

Phase 3: Filter Detonation
Step 1. Email malicious content to a non-existent address at the same target domains emailed in Phase 2.
Note: At this stage, only Amazon SES and Gmail have been tested for the receipt of bounce responses. Do not use Exchange Online.

Image: The accompanying image is of an email (within Gmail) directed towards the same non-existent addresses at targeted in Phase 2. Each target was uniquely identified and selected for their differing Secure Email Gateway technologies.

Email being sent within Gmail with keywords

Step 2. Wait 180 seconds. Download all received bounce responses and then upload them to Phishious for Filter Detonation. Upon Detonation, you will see the status of all Secure Email Gateway technologies identified and whether the phish was blocked or remained undetected.

Image: The accompanying images show the email bounce responses being uploaded to Phishious and then the observed result of Filter Detonation.

Multiple Non-Delivery-Reports being uploaded to Phishious for Detonation
Phishious Detonation Output

Phase 4: Results Analysis
Analyse the results to determine whether your phishing material was blocked or remained undetected. Click 'View Detail' to gain insight into what text was analysed within the Email Headers and how this impacted the overall Phishious assessment.

Image: The accompanying images show the detailed view of two seperate SEG technologies. This view shows how Phishious analysed Email Headers to provide two seperate results from a single Phishing Email.

Phishious Detonation Detailed View for Trend Micro HES
Phishious Detonation Detailed View for Exchange Online Protection

CanIPhish SaaS Platform

Schedule and deliver phishing emails to train users or assist with red-team engagements.

Get Started Now
Woman reading mobile phone

CanIPhish Domain Tools

Discover mail sender and receiver supply chain vulnerabilities through a variety of proprietary techniques.

Get Started Now
Man at desk typing on laptop