ZPhisher Phishing Simulation Tool for Pentesters

ZPhisher is an open-source phishing simulation tool based on the ShellPhish project. It provides a menu-driven interface and prebuilt page templates that help security professionals demonstrate how deceptive login pages can be used in phishing attacks.

The project includes templates inspired by popular online services and supports several tunneling options for exposing a test environment. These capabilities make ZPhisher useful for authorized security awareness exercises and controlled penetration-testing labs. However, phishing pages can collect credentials and other sensitive information, so testing should take place only with explicit permission.

Key Features of ZPhisher

• Login Page Templates: Offers a collection of page templates modeled on familiar online services, allowing testers to demonstrate how convincing impersonation pages can appear.
• Menu-Driven Interface: Provides a straightforward terminal interface for selecting available templates and configuration options.
• Tunneling Support: Includes options for exposing a test page through supported tunneling services. Availability and compatibility can vary by version.
• Termux Compatibility: Provides a package-based installation option for supported Android environments.
• Docker Support: Offers container-based execution options for users who prefer an isolated environment.
• Open-Source Code: Allows users to inspect the implementation, review dependencies, and examine project changes through GitHub.

Install ZPhisher on Linux

The project’s repository provides installation instructions for supported Linux environments. Review the source code before running third-party scripts, particularly on systems containing personal or production data.

sudo apt update
sudo apt install git php openssh curl -y
git clone https://github.com/htr-tech/zphisher.git
cd zphisher
chmod +x zphisher.sh
bash zphisher.sh

The commands install the listed dependencies, clone the repository, and launch the script. Package availability may differ across distributions. Review the script and its dependencies before execution, and avoid running it with elevated privileges unless required and understood.

Install ZPhisher on Termux

The original project documentation describes installation through the TUR repository on supported Termux setups. Package availability may change, so consult the project’s latest instructions if the package cannot be found.

pkg install tur-repo
pkg install zphisher

After installation, launch the program using the command documented by the package. Use an isolated test environment and do not collect real account credentials.

Install Using a DEB Package

Prebuilt Debian packages may be available from the project’s latest releases page. Select a package that matches your environment. Termux builds, when available, are different from standard Linux packages.

For a compatible Debian-based system, install a downloaded package with:

sudo apt install ./package-name.deb

Replace package-name.deb with the actual downloaded file path. Check the release notes and package requirements before installation.

Run ZPhisher with Docker

The original project documentation lists Docker images hosted on Docker Hub and GitHub Container Registry. Confirm that the images and tags remain available before using them.

docker pull htrtech/zphisher
docker pull ghcr.io/htr-tech/zphisher:latest

The repository also provides a Docker wrapper script. Inspect the script before executing it, since downloaded scripts can make changes to your system or launch network services.

Docker isolation does not automatically make phishing simulations safe. Review network exposure, mounted directories, and any files that the container can access. Do not expose a test page publicly unless the exercise has been explicitly authorized and appropriate safeguards are in place.

ZPhisher Screenshot

The following image is retained from the original Kali Linux Tutorials article to illustrate the tool’s interface.

Responsible Use and Security Considerations

ZPhisher should be used only in an approved lab or a phishing simulation with clearly defined scope. Use test accounts, avoid collecting real passwords, and restrict access to any hosted pages. Remove temporary tunnels and test files when the exercise ends.

Organizations can pair controlled simulations with security awareness training and defensive monitoring. For additional background on security testing resources, see our guide to PayloadsAllTheThings.

For source code, supported installation methods, and project updates, visit the official ZPhisher GitHub repository. Features, templates, and installation steps may change between releases.