< Back to projects

Phishing Awareness Campaign Platform

M1 SI - ESGI Pair project 4th year annual project - 2025 Completed

Awareness-training scope only: this platform was built to run internal, controlled phishing simulations for security awareness purposes - it was never used against real, unconsenting targets. It was developed as the annual project for the 4th year (4SIJ), in a pair.

Awareness campaign simulation flow Target list SMTP email send Fake login page + MFA trap page Flask backend click / IP / UA tracking SQLite + admin dashboard awareness debrief stats
End-to-end simulation flow, from the outbound email to the awareness debrief statistics - run only against internal, consenting targets.

Context

A Flask application simulating a full phishing campaign lifecycle end to end: a convincing fake login page, a follow-up MFA trap page, per-click/IP/user-agent tracking stored in SQLite, an admin statistics dashboard, target list management, and outbound email delivery over SMTP using a template that imitates a trusted brand identity - all built for running sanctioned, internal awareness campaigns.

What was built

  • Flask backend serving a credible fake login page and a secondary fake MFA verification step, mirroring a real two-stage credential-harvesting flow.
  • SQLite-backed tracking of every click: source IP, user agent, and timestamp, recorded against the target that was sent the link.
  • Admin statistics page to review campaign results (click-through rate, per-target breakdown) for the awareness debrief.
  • Target list management and outbound email delivery via SMTP, using an HTML template that imitates a trusted corporate identity to test realistic pretexting.

Stack

Python / Flask SQLite IP/UA tracking SMTP Security awareness

Status

Completed and submitted as the 4th-year annual project.

< All projects