---
name: rt-exploit-phishing
description: "Email-based social engineering testing skill. Requires explicit SEAD authorization for phishing simulation. Tests organization's email security posture, employee awareness, and DMARC/SPF/DKIM configuration. Output: phishing simulation results and email security hardening recommendations."
---

# rt-exploit-phishing — Email Security Testing

> ⚠️ **AUTHORIZATION REQUIRED**: This skill must only be executed with explicit written authorization in the SEAD document. Phishing simulation must be within defined engagement scope.

## Overview

This skill tests an organization's email security posture by:
1. Analyzing DNS email security records (DMARC, SPF, DKIM)
2. Identifying email spoofing vulnerabilities
3. Conducting authorized phishing simulations (if in scope)
4. Providing email security hardening recommendations

## Prerequisites

- [ ] SEAD explicitly authorizes phishing simulation
- [ ] Target email domains confirmed in scope
- [ ] Phishing simulation type approved (generic vs. spear phishing)
- [ ] Notification procedures confirmed with client
- [ ] GoPhish or approved platform configured

---

## Step 1 — Email Security DNS Analysis

```bash
TARGET_DOMAIN="target.com"

# Check DMARC policy
dig _dmarc.$TARGET_DOMAIN TXT
# CRITICAL: p=none = report only (spoofing may succeed)
# p=quarantine = suspicious mail to spam
# p=reject = unauthorized mail blocked

# Check SPF record
dig $TARGET_DOMAIN TXT | grep "v=spf1"
# ~all = softfail (may deliver)
# -all = hardfail (reject)

# Check DKIM (requires selector knowledge)
dig selector1._domainkey.$TARGET_DOMAIN TXT
dig google._domainkey.$TARGET_DOMAIN TXT

# Full email security assessment
python3 << 'EOF'
import subprocess

domain = "target.com"

dmarc = subprocess.run(["dig", f"_dmarc.{domain}", "TXT", "+short"],
                       capture_output=True, text=True).stdout
spf = subprocess.run(["dig", domain, "TXT", "+short"],
                     capture_output=True, text=True).stdout

print("=== EMAIL SECURITY ASSESSMENT ===")
print(f"DMARC: {dmarc.strip()}")
print(f"SPF: {[l for l in spf.splitlines() if 'spf1' in l]}")

if "p=none" in dmarc:
    print("[CRITICAL] DMARC p=none: Email spoofing may bypass enforcement")
elif "p=quarantine" in dmarc:
    print("[HIGH] DMARC p=quarantine: Spoofed emails may reach spam folder")
elif "p=reject" in dmarc:
    print("[SECURE] DMARC p=reject: Unauthorized emails blocked")
else:
    print("[CRITICAL] No DMARC record: No email authentication enforcement")
EOF
```

## Step 2 — GoPhish Campaign Setup (Authorized Simulation)

```bash
# Installation
wget https://github.com/gophish/gophish/releases/latest/download/gophish-linux-64bit.zip
unzip gophish-linux-64bit.zip
chmod +x gophish
./gophish
# Admin UI: https://localhost:3333 (default: admin / gophish)

# Campaign components needed:
# 1. Sending Profile (SMTP configuration)
# 2. Landing Page (credential capture or awareness page)
# 3. Email Template (authorized simulation email)
# 4. User Group (target employees from scope)
# 5. Campaign (combines all above)
```

## Step 3 — Email Template Design

Design emails that test employee awareness for common scenarios:

**Scenario 1 — IT Support Password Reset**
- From: IT Support (authorized test email)
- Subject: Action Required: Password Expiration Notice
- Content: Links to awareness training page
- Objective: Test response to urgency + authority

**Scenario 2 — HR Annual Review Document**
- From: HR Team (authorized test email)
- Subject: Your Performance Review is Ready
- Content: Links to credential harvest page (if authorized)
- Objective: Test response to relevant/expected communications

**Scenario 3 — Finance Invoice Verification**
- From: Finance Team (authorized test email)
- Subject: Invoice Approval Needed
- Content: Attachment or link requiring interaction
- Objective: Test response to financial urgency

## Step 4 — Email Security Testing Results

Document findings:

```markdown
## Email Security Assessment Results

### DNS Configuration
| Check | Result | Risk |
|-------|--------|------|
| DMARC Policy | p=none | CRITICAL |
| SPF Strictness | ~all | HIGH |
| DKIM | Configured | PASS |

### Phishing Simulation Results (if authorized)
| Metric | Result |
|--------|--------|
| Emails sent | X |
| Emails opened | X (X%) |
| Links clicked | X (X%) |
| Credentials entered | X (X%) |
| Reports by employees | X (X%) |
```

## Skill Levels

| Level | Activities |
|-------|-----------|
| BEGINNER | DNS record analysis, manual DMARC check |
| INTERMEDIATE | GoPhish setup, basic campaign execution |
| ADVANCED | Spear phishing with OSINT targeting, evasion techniques |
| EXPERT | BEC scenario design, multi-stage campaigns |

## Remediation Recommendations

For `p=none` DMARC:
```dns
v=DMARC1; p=reject; rua=mailto:dmarc-reports@domain.com; pct=100
```

For SPF `~all`:
```dns
v=spf1 include:spf.protection.outlook.com -all
```

## Log Activity

```bash
python3 {project-root}/_rtexit/scripts/autodoc_engine.py log \
  --skill rt-exploit-phishing \
  --phase exploitation \
  --cmd "dig _dmarc.target.com TXT" \
  --output "DMARC p=none confirmed"
```

## Resources
- GoPhish: github.com/gophish/gophish
- DMARC Guide: dmarc.org
- SPF Record Syntax: openspf.org
- Email Security Testing: emailsecuritygrader.com
