Hacking-Social_Media-Accounts is a GitHub repository that bundles GoPhish phishing email templates, landing pages, OSINT tool lists, and Windows exploitation guides for security testing and social engineering education.
What is Hacking-Social_Media-Accounts?
This repository, maintained by user DevVj-1, provides ready-to-use phishing templates for GoPhish, an open-source phishing toolkit. It includes an Instagram login landing page, an Instagram security alert email, and a Google Chrome OS sign-in notification email. The templates are HTML files that can be configured directly in GoPhish or any compatible phishing platform. Alongside the templates, the repo contains documentation on campaign setup, port forwarding for exposing phishing servers, and a collection of OSINT resources.
Key Features
- Instagram Landing Page — A replica of the Instagram login page that captures usernames and passwords when configured with GoPhish's data capture options.
- Instagram Mail Template — A phishing email titled "New Instagram Login" from [email protected], designed to direct victims to the fake login page.
- Google Chrome OS Mail Template — An email titled "New Sign In" from [email protected] that mimics Google's account activity alert.
- GoPhish Installation Steps — Instructions for downloading GoPhish, logging in at https://127.0.0.1:3333/, and importing the provided HTML configurations.
- Form Data Capture Troubleshooting — A minimal HTML form example explaining the required action="", method="POST", and named input fields needed for GoPhish to log submissions.
- Port Forwarding with localhost.run — A one-line SSH command that exposes a local GoPhish instance to the internet for remote phishing campaigns.
- OSINT Tool Collection — Curated links to email lookup, mobile number tracking, username search, geolocation maps, and AI-based image location tools.
- Windows Payload Generation — msfvenom commands for HTA reverse shells and VBA macro code for Word documents, including a password-protection bypass tip.
Who is it for?
- Penetration testers — Simulate credential-harvesting attacks using the Instagram and Google templates during authorized assessments.
- Red team operators — Deploy the email templates through GoPhish to measure an organization's susceptibility to social engineering.
- Security researchers — Use the bundled OSINT links for open-source intelligence gathering, email tracing, and image geolocation.
- Cybersecurity students — Learn practical phishing campaign mechanics and basic Windows exploitation using the step-by-step guides.
What can you do with Hacking-Social_Media-Accounts?
- Launch a phishing campaign: Import the Instagram landing page and mail template into GoPhish, configure a sending profile, and collect credentials from a target.
- Expose your server publicly: Use the localhost.run SSH command to port forward a local GoPhish instance, enabling campaign access from the internet.
- Troubleshoot data capture: Follow the repository's HTML form requirements to ensure submitted credentials appear in GoPhish.
- Generate malicious payloads: Create HTA or Word macro reverse shells with msfvenom and the provided VBA scripts for Windows exploitation exercises.
FAQ
Why isn't submitted form data being captured in GoPhish?
The landing page HTML must have a form with action="" and method="POST", and every input needs a name attribute. Additionally, enable both "Capture Submitted Data" and "Capture Passwords" when saving the page, and remove any JavaScript that interferes with submission.
How do I set up a phishing campaign in GoPhish?
Log in to GoPhish at https://127.0.0.1:3333/ using the credentials shown in the terminal, then upload the provided templates and landing pages. Create a new campaign, choose the email template and landing page, add targets, and launch. The repository links to a Hacker Cool Magazine guide for more detail.
What templates are included?
The repository includes an Instagram login page, an Instagram mail template, and a Google Chrome OS mail template. All are basic HTML layouts tested in GoPhish, but they will work with other phishing services as well.
Are these tools legal to use?
The repo is intended for educational and authorized security testing only. It includes a disclaimer that files are offered "as-is" with no guarantees or support. Use them only on systems you own or have explicit permission to assess.
