king-phisher

• Add support to select visible columns for tables in the Campaign tab
• Add support for printing pipenv running output in real time
• Windows build will now install PyPI requirements for plugins during installation
• Multiple bug fixes

MSI Build Hashes:

md5: 7b31e812bbb5cff462d8fc6c1ab147b4
sha1: ae460a46b985a55c9e704006dee12341acd00858
sha512: 9edff03aeb4755780f6f7c0b8fc926e80e1495b996e42d7a0572ecb63d42e2c0de17d597c26e3d8106b22e7e7703bf51ab034c95b38933a603b593641bae992f

• Added the Message-ID MIME header to outgoing messages
• Attempt SSH authentication with all agent-provided SSH keys
• Deleted Pipfile.lock from repository to prevent hash issues between python interpreter versions
• Add --three to pipenv install and pipenv --update startup procedures to force use of Python 3
• Added server support for installing missing plugin requirements during initialization
• Added asynchronous RPC methods to the client
• Added GraphQL and database schema documentation
• Changed Target URL to Web Server URL in Campaign Editor
• Added the ability issue SSL Certificates through certbot

MSI Build Hashes:

md5: 1738e4b4fe8c5e4c758a8af60a87ff8d
sha1: c18702d782bb8ff37b88d3f2dc63d210b993555b
sha512: 11f803e4f3fed93a0edc0f8a1ec49c6eb9e10a9a663af24ebb3831a345b63fb6

• Fixed broken references to start_process
• Fixed a KeyError when creating a campaign for the first time (see: #365)
• Updated SQLAlchemy and Jinja2 libraries for security patches

MSI Build Hashes:

md5: f9e53a0b282a06d2838557caf848a94d
sha1: bb81992c45b6dda9bd41f30f0e5222f965f1686b
sha512: 312a9a3e7b0765a0db439babf50460e1b30a2765189230f3d72a9c3dd67081e57e9d5525d38267c0790bcb7a8f630fb6e82adaa09fb5318f57380795df384b4e

• Added support for logging MFA tokens with credentials
• Added support for using regular expressions to validate credentials
• Automatically try to install plugin dependencies with pip from PyPi
• Added advanced, rule-based filtering support to the Campaign tabs
• Added site template metadata
  • Site templates can now include a metadata file for describing their content
  • The Campaign Assistant will help select a target URL based on available templates

MSI Build Hashes:

md5: 08ee0dad5a668a9908370f2d24126080
sha1: 7458c504e9766ae6491b22c40dfd2f6faa361111
sha512: bb2f864cfb31f797c4582127f49ee00b4a06730dbd89668e76bcbcdad75cc87e

• Added support for users to set their email address for campaign alerts via email
• Added additional plugin metadata fields for reference URLs and category classifiers
• Added additional documentation including an architecture overview for reference
• Multiple improvements to the client plugin manager
  • There is now an option to update plugins in the menu
  • Plugins can ship with dedicated documentation in markdown files that will be displayed
  • The GUI no longer locks up while tasks like downloading plugins are taking place
• Added the new fetch Jinja function and fromjson Jinja filter
• Added campaign-alert-expired and campaign-expired server signals
• Switched to using Pipenv to manage the environment and dependencies

MSI Build Hashes:

md5: fe86670b43eae41f5a1ad3d25eb131ed
sha1: d2d4dc73e682f3bb7c4d51429637bb27b01eba1a
sha512: 8ca2bd0c4e34ef71a56c930040712b3bda9ee8c3905b6379f3dd193cdaabf706f5408a1a8b241c377eed6f72f71ec0bfd69975856916885092137dc5731a44ea

• Updated to support matplotlib version 2.2.0
• Removed docker server support
• Multiple improvements to the installation script
  • Users can now specify a supported Linux distro when it is not automatically detected
  • The database connection string is kept to avoid PostgreSQL password resets
• Added support for setting message UID character set options
• Bumped the required minimum version of Python to 3.4 and GTK to 3.14
• Update Windows build to use pygi-aio-3.24.1_rev1 PyGObjects
• Multiple bug fixes.

MSI Build Hashes:

md5: d8b584378d573f26d49a68572b955e26
sha1: 91d98a8ba324a97e9f4c8a3867a1a45a4ef98ee2
sha512: 26c1d3efa1ca3429e412fc35a658f376e91070f7f9dccd29878091eb189cc529258600dbccee69e276754c541e271dc00807c9e06e774d6e09acd602c6b7e23e

• Added a campaign-alert server signal for custom alert delivery mechanisms

• Use GraphQL for loading data instead of the legacy table-based API

• Support fault-tolerance when dispatching server signals

• Allow a country code to be set in users' phone numbers

• Visits will now be tracked if the landing page is any existing type

• Multiple RPC Terminal improvements

  • Fix a bug regarding line wrapping due to the TERM environment variable
  • Use ipython when it's installed
  • Added %graphql and %graphql_file magic commands

• Tweaks to the default MIME-encoded HTML message to reduce it's SpamAssassin score

• Modified client signals to allow better API control

  • Added message-create and target-create for modifying the respective objects
  • Added message-send and target-send to allow skipping the message and target
  • Removed the send-message and send-target signals in favor of the new ones

MSI Build Hashes:

md5: d425bd6f40b5989db1384c3bd86cbb43
sha1: 3880253db0e56d21fae86477ca88f3114d0e0f7a
sha512: 42102fa1a4f7f89b11ca2aaf0aebb6bfcf50a7cf2a2f02cb72c3d83095ba21fa01d01c7928ee44fed372ee24941d3c3bfac07805d971029e8ecc565786fd9a81

• Support resetting plugins options to their respective defaults
• Moved Office 2007+ metadata removal to a new plugin
• Added support for installing plugins from remote sources through the UI
• Added timeout support for SPF DNS queries
• Support for installing on Arch Linux
• Multiple server improvements
  • Upgrade AdvancedHTTPServer to v2.0.11 to support async SSL handshakes
  • Support using an include directive in the server configuration file
  • Added a request-handle signal for custom HTTP request handlers
  • Removed address support from the server config in favor of addresses
  • Support login as an alias of the username parameter for credentials

MSI Build Hashes:

md5: 156b51730e03f0a23c4bb9dc9826d09d
sha1: f126824cec862ed6431f81f12e5995f0a95c9346
sha512: e4a4d3ba34d2072345c46904bc7424846044840604619d217798428e1a3ca7193562c84d6838f17157f86ed2861f941dbaa71b73117e47e48566fff33c00d800

• Warn Python 2.7 user that this is the last release Python 2.7 will be supported
• The Windows MSI Build is now in Python 3.4
• Install script now supports Red Hat Server 7
• Support the client on OS X by using Docker
• Support for issuing certificates with acme while the server is running
• Add a wrapping tool for certbot to make the process easier
• Updated tools/cx_freeze.py to build the King Phisher client in Python 3.4
• Updated documentation for the Windows build
• Multiple Bug Fixes, and tweaks to make things run smoother

MSI Build Hashes:

md5: 7cd7379597f43015d0f5972821c607c7
sha1: 3ed770dedd0bfce12b443e2fd1e40e90cf1f54e7
sha512: 199f81dee0cffb29d5b1d441f798e2271f4bbdf6a11aa618123aa41b14e2d9970b1af3db77a1fefb0cc553ed33def57923e7f9c4d921a8e779c072f6d3b3ff77

• Bug fix in the Windows build for HTTPS connections from the requests package

MSI Build Hashes:

md5: d8d5712e821b4e5fb84ecd8745eba0c5
sha1: 9501b7f6df8dfdba005e0d49f084e0e37490c7eb
sha512: 517c93b281b9dc56bf2168e4ace4dae7ab6782457406a9c155a07497b5a6fa4fb6dc650376eb7cddd8cde2b6180af631d67cb0dad1998c2c00d8be16bfd09d02

• Better error messages for malformed server configuration files
• Support for sending to targets via To / CC / BCC fields
• New features for client and server plugins
• Add comparison of "trained" statistics to the campaign comparison
• Support for including and importing Jinja templates from relative paths
• Support for including custom HTTP headers in server responses
• New feature to import Campaigns from XML files
• Support for emails address with longer top level domain names

MSI Build Hashes:

md5: 6347ab2a70c04f62d17a6e417a222e15
sha1: a0013415968f4ce2f77519707921093ceef233a7
sha512: 1b4f102950865c9916206c1cf4697ae2cead1037e6dabca7d845c1b35c97d9fc98fb77da6050bba0d7319561805db720aeaae03c453aa74b79e929727ebf7665

• Support negotiating STARTTLS with SMTP servers that support it
• Support for real time event publishing to the client
• Support for a new GraphQL API for more efficient data queries
• More flexibility in configuring server logging
• Add persistent storage for server plugin data
• Add a Jinja function to check if a password is complex
• Add client message-data-export and message-data-import signals
• King Phisher now starts with Python3 by default
• tools/install.sh now creates a backup of server_config.yml when present
• Minor bug fixes
  • Minor CSS fixes
  • Special characters now display in the UI correctly

MSI Build Hashes:
md5: 05f0164b3af02ad731871923ecd75f2b
sha1: a02e960999a746266db29c7290d993bf86d77425

• Minor bug fixes
  • Use Default SMS sender to fix SMS subscription with T-Mobile
  • Upgrade AHS to v2.0.6 to fix select polling
  • Corrected issue when attachment file is inaccessible
  • Fixed issue when message file directory is gone
  • Fixed server side encoding error with basic auth
  • Fixed TypeError handling while rendering templates
  • Fixed a unicode bug when processing targets csv
  • Fixed install.sh script for CentOS7 and python3
  • Fixed show exception dialog with Glib idle_add
  • Fixed a logic bug causing premature SMTP reconnects
  • Fixed Webkit-1 load_string Null error

MSI Build Hashes
md5: 53471bad68db464cbaea007eda75dd4d
sha1: 439a6a8a13b27d0ddefe5d37e316773f452d2731

• Automated installation script improvements
  • Backup an existing server configuration file
  • Log warnings when the PostgreSQL user exists
• Improve the Metasploit plugin for session notifications via SMS
• Support exporting credentials for use with Metasploit's USERPASS_FILE option.

MSI Build Hashes
MD5: f155c0130a620d5f27d498aa100cef16
SHA1: 8e37f4c95285de7b5c5bf703e3c2eca7b7c99ec3

• Added an SPF button to the client for on demand SPF record checking
• Fixed missing packages in the Windows build for timezone data
• Transitioned to the dnspython package for Python 2.x and 3.x

MSI Build Hashes
MD5: beea200f78b74fefb2356ffda1434435
SHA1: 9248bf1a85bd17fefa2b6bd70551bed82e67f4da

• Added additional Jinja variables for server pages
• Upgraded to AdvancedHTTPServer version 2
  • Added support for binding to multiple interfaces
  • Added support for multiple SSL hostnames via SNI
• Support for plugins in the server application
• Campaign Comparison Tools
• Added server signals for event subscriptions in plugins
• Updated the style for GTK 3.20
• Start to warn users about the impending Python 2.7 deprecation
• Change to installing for Python 3
• Added an uninstallation script

MSI Build Hashes
MD5: f7e06eee3b59417b4f032c22bdb051cc
SHA1: 81d92ed5abdd43d2e12cfe21c728f433c0a58a64

• Added automatic setup of PostgreSQL database for the server
• Server bug fixes when running on non-standard HTTP ports
• Added completion to the message editor
• Support for plugins in the client application
• Added a client plugin to automatically check for updates
• Added a client plugin to generate anonymous statistics
• Added debug logging of parameters for key RPC methods
• Lots of Python 3.x compatibility fixes

MSI Build Hashes
MD5: 4a7f09ef275d661e2d712f78f618d0b1
SHA-1: b6bf502eba9a2cec4efa0b02b8c80676092d99b1

• SSH host key validation
• Install script command line flags
• Support for authenticating to SMTP servers
• Style and compatibility changes for Kali

MSI Build Hashes
MD5: 5f93317261d1f54b71b7f7d0d6ced625
SHA-1: 551ad0ac115e772cc7a09099b49a2021bc477d85

• Added an option to send a message to a single target
• Support for sending calendar invite messages
• Added PostgreSQL setup to the installer
• Support for exporting to Excel
• Added a Jupyter notebook for interactive data analysis
• Added additional campaign filtering options
• Support for removal of metadata from Microsoft Office 2007+ documents

MSI Build Hashes
MD5: 227b80125d63b25cbeb69542bff8aad3
SHA-1: 9dc0edb115c5b21682b9db5bc2ffb6448231943d

• Moved templates to a dedicated separate repository
• Added a custom theme for the client
• Added support for two factor authentication with TOTP
• Support for specifying an img style attribute for inline images in messages

MSI Build Hashes
MD5: eaefe53b2358a33e8125b84284c2df9d
SHA-1: 5a45657d3c09f72d45307e83df921229fa137298