SocialFish
Phishing Tool & Information Collector
A Docker-based security testing tool for penetration testers to simulate phishing scenarios, fake login pages and credential capture, so organizations can test whether their defenses hold up against those tactics.
SocialFish is a phishing and information-gathering tool built for security research and penetration testing. Phishing tools in this context are used by security professionals to simulate the kinds of fake login pages and credential-capture setups that real attackers use, so that organizations can test whether their defenses and employee training hold up against those tactics.
The README itself is brief and points to a separate wiki for full setup instructions. The project can be run using Docker with a single command. There is also a companion mobile app, listed as a separate repository, that acts as a controller for the tool.
The project labels itself for educational use only, and its disclaimer places full responsibility for how it is used on the person running it. It is maintained by two developers and accepts community contributions. The primary language listed is CSS, though the tool also involves Python based on the topic tags.
The README does not describe the tool's specific phishing capabilities in detail, so the exact feature set is not clear from this file alone. Anyone looking to understand or run the project would need to consult the linked wiki.
Where it fits
- Simulate a phishing attack on your own organization to test whether employees recognize and report fake login pages.
- Run the tool in an authorized penetration test to demonstrate credential-capture risk to a client.
- Use the Docker setup to spin up a test environment quickly without installing Python dependencies manually.
- Control the tool remotely during a security engagement using the companion mobile controller app.