Skip to content

Website Builder: Credential-Harvesting Landing Pages & Dynamic Cloner

Platform Feature: Websites (Website Builder)
UI Location: Main Navigation > Threat Forge > Websites (/website-builder)
Capabilities: 1-Click Dynamic Website Cloner, Mock Credential Harvesting Forms, Multi-Step Landing Pages, Harmless Token Validation
Associated Engines: PhishStrike (/phishstrike), QuishFire (/quishfire)

1. Executive Summary & Value Proposition

Phishing simulations that only measure whether an employee clicks an email link miss the most critical risk: credential disclosure. Threat actors drive traffic to fraudulent login pages (e.g., Microsoft 365, Google Workspace, Okta, internal VPN portals) to harvest employee usernames, passwords, and multi-factor session tokens.

The Website Builder (/website-builder) within Threat Forge allows security administrators to safely simulate modern credential-harvesting attacks. Featuring an automated 1-Click Dynamic Website Cloner and an intuitive landing page designer, security teams can evaluate and train staff against credential theft with guaranteed zero operational risk.

2. Safety & Data Privacy Architecture

[!IMPORTANT] SimuPhish Zero-Knowledge Guarantee: SimuPhish never captures, logs, or stores real employee passwords or confidential input data. When an employee enters credentials on a simulated landing page: 1. The input field is cryptographically sanitized in memory. 2. The platform simply records a boolean event (Credentials Submitted = True) and a timestamp. 3. The employee is immediately transitioned to a Teachable Moment. No plaintext data ever touches a database or disk.

3. Core Capabilities & How It Works

1. 1-Click Dynamic Website Cloner

  • Enter any public URL (e.g., corporate Single Sign-On portal, cloud storage login, HR benefits page).
  • The Cloner securely captures HTML, CSS, images, and brand layouts, generating an editable mock landing page within seconds.

2. Multi-Step Authentication & 2FA Prompts

  • Simulate advanced modern attacks: initial username entry -> password challenge -> simulated 2FA / push prompt challenge, testing employee skepticism across the complete login sequence.

3. Automatic "Oops" Teachable Moment Pairing

  • Every simulated website is paired with an immediate educational redirection. The moment an employee clicks "Sign In," the page seamlessly transforms into an interactive coaching review pointing out fraudulent URL cues and SSL certificate nuances.
sequenceDiagram
    autonumber
    actor Employee as Corporate User
    participant Page as Mock SSO Landing Page
    participant Server as SimuPhish Telemetry Server
    participant Oops as Teachable Coaching Page

    Employee->>Page: Lands on simulated Microsoft 365 login
    Employee->>Page: Enters username & mock password
    Employee->>Page: Clicks "Sign In"
    Page->>Server: Signals "Credential Submission Event" (Zero password data saved)
    Server->>Server: Record Susceptibility Timestamp
    Page->>Oops: Instant transition to Teachable Moment
    Oops-->>Employee: Explains missed URL red flags & safe credential habits

4. Key Business Benefits & Measurable ROI

  • Validates Password Resilience: Pinpoints employees susceptible to credential theft before malicious actors exploit them.
  • Zero Technical Risk: Safe, sanitized capture ensures full compliance with privacy laws (GDPR, CCPA) and enterprise data security policies.
  • Rapid Turnaround: Build or clone customized internal login lures in under 60 seconds without web developer assistance.