Phishery

Phishery serves as a Basic Auth Credential Harvester paired with a Word Doc Template Injector. Its primary purpose is to set up an HTTP server that captures credentials entered by users when prompted for Basic Authentication. This is particularly effective in phishing scenarios where the server URL is embedded in Microsoft Word documents.

The tool's strength lies in its ability to modify .docx files by injecting a phishery URL as the document template. When the victim opens the modified Word file, Microsoft Word automatically requests the template from the specified URL, prompting the user for credentials without suspicion.

Use cases include penetration testing for social engineering assessments, demonstrating credential phishing risks in corporate environments, and educational purposes to showcase phishing techniques via document templates.

Phishery operates an SSL-enabled HTTP server configured via a JSON settings file. When a client, such as Microsoft Word, requests a resource from the phishery URL, the server responds with a Basic Authentication challenge (HTTP 401). Harvested credentials from successful authentications are stored in a specified JSON credentials file. For template injection, phishery modifies the .docx file's template reference to point to the phishery server URL, causing Word to fetch it on open and trigger the auth dialog transparently to the user.