Phishing: Recon to Creds with the SpeedPhishing Framework
Adam Compton and Eric Gershman introduce the SpeedPhishing Framework (SPF), automating target email harvesting, domain staging, and campaign deployment.
Summary
The Operational Bottlenecks of Penetration Testing Phishing
Manually standing up dedicated phishing infrastructure, generating cloned templates, and harvesting target emails consumes extensive red team engagement time.
Introducing the SpeedPhishing Framework (SPF)
Adam Compton and Eric Gershman present SPF, an open-source Python tool that automates the end-to-end phishing lifecycle.
Automating OSINT Harvesting and Infrastructure Staging
The authors demonstrate automated LinkedIn scraping, SMTP relay configuration, DNS SPF/DKIM record creation, and cloned portal generation.
Tracking Campaign Telemetry and Credential Capture
The presentation details real-time click tracking, credential interception, and automated PDF report generation for executive stakeholders.
Related talks
Village Presentations·51 min
Dave Kennedy
TrustedSec founder Dave Kennedy analyzes the dominance of targeted phishing attacks, demonstrating macro weaponization, PowerShell evasion, and lateral movement.
Main Stage·44 min
Nick Powers · Steven Flores
Nick Powers and Steven Flores show how Microsoft ClickOnce technology can be abused for stealthy phishing initial access, bypassing Mark-of-the-Web and AppLocker.
Adversary Village·13 min
Stephan Wampouille
Stephan Wampouille demonstrates autonomous lateral movement in Linux networks, chaining benign system behaviors to traverse internal infrastructure undetected.