Home

Awesome

Mercure

Build Status Coverage Status Documentation Status Code Health Requirements Status

Mercure is a tool for security managers who want to teach their colleagues about phishing.

What Mercure can do:

What Mercure will do:

Docker Quickstart

Requirements

Available configuration

Environment variable nameStatusDescriptionValue example
SECRET_KEYRequiredDjango secret keyRandom string
URLRequiredMercure URLhttps://mercure.example.com
EMAIL_HOSTRequiredSMTP servermail.example.com
EMAIL_PORTOptionalSMTP port587
EMAIL_HOST_USEROptionalSMTP userphishing@example.com
EMAIL_HOST_PASSWORDOptionalSMTP passwordP@SSWORD
DEBUGOptionalRun on debug modeTrue
SENTRY_DSNOptionalSend debug info to sentry.iohttps://23xxx:38xxx@sentry.io/1234
AXE_DISABLEDOptionalForcebrute protection is disabledTrue
AXES_LOCK_OUT_AT_FAILUREOptionalBan on forcebrute loginTrue
AXES_COOLOFF_TIMEOptionalBan duration on forcebrute login (in hours)0.8333
DONT_SERVES_STATIC_FILEOptionalDon't serve static files with djangoTrue

Sample deployment

Edit docker compose configuration (docker-compose.yml)

version: '2'

services:
  front:
    image: atexio/mercure
    restart: always
    ports:
      - 8000:8000
    environment:
      SECRET_KEY: '<random value>'
      URL: 'https://preprod.mercure.io'
      EMAIL_HOST:  'mail.example.com'
      EMAIL_HOST_USER: 'phishing@example.com'
      EMAIL_HOST_PASSWORD: 'P@SSWORD'
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./data/database:/code/database
      - ./data/media:/code/media
      - ./data/migrations/phishing:/code/phishing/migrations

To generate the SECRET_KEY variable, you can use this command:

# generate random SECRET_KEY
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 200 | head -n 1

The SECRET_KEY is used as a salt for django password hashing, don't change it after using it with mercure. After changing the secret key, you can run the container with this command:

docker-compose up -d

Next, you can create a super user to log into web interface:

# create super user
docker-compose exec front python manage.py createsuperuser

How to use mercure

We can consider mercure is divided into 5 steps :

Targets, Email Templates and Campaign are the minimum required to run a basic phishing campaign.

  1. First, add your targets

    Targets

    You need to fill mercure name, the target email.Target first and last name are optional, but can be usefull to the landing page

  2. Then, fill the email template.

    Landing page

    You need to fill the mercure name, the subject, the send and the email content. To improve the email quality, you have to fill the email content HTML and the text content. To get information about opened email, check "Add open email tracker" You can be helped with "Variables" category.

    Attachments and landing page are optionnal, we will see it after.

  3. Finally, launch the campaign

    Campaign

    You need to fill the mercure name, select the email template and the target group. You can select the SMTP credentials, SSL using or URL minimazing

  4. Optional, add landing page

    Landing page

    You need to fill the mercure name, the domain to use You can use "Import from URL" to copy an existing website.

    You have to fill the page content with text and HTML content by clicking to "Source"

  5. Optional, add Attachment

    Attachments

    You need to fill the mercure name, the file name which appears in the email and the file You also have to check if the the file is buildable or not, if you need to compute a file for example.

    To execute the build , you need to create a zip archive which contain a build script (named 'generator.sh' and a buildable file

Developers

To participate to the project :

  1. Fork the project

  2. Create new branch

  3. Make comments and clean commits to the repository

  4. Run unnittests

    python manage.py test --exclude-tag selenium
    
  5. Perform a pull request

Responsible Disclosure of Security Vulnerabilities

We want to keep Mercure safe for everyone. If you've discovered a security vulnerability in Mercure, we appreciate your help in disclosing it to us in a responsible manner.

Send an email to 'security@atexio.fr'. If you want, you can use with PGP Key

Vulnerability summary

Reporter informations

Technical details