Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

mip22

Phishing Framework

Resource Development

Initial Access

Credentials & User Impersonation

mip22 v3.3 is a Bash phishing framework for GNU/Linux and Android Termux. Its upstream README describes prebuilt and custom cloned login pages, public tunnels, URL shortening, external email services, and notifications when users submit login data. These capabilities can expose and capture real credentials; use an approved simulation system that discards entered values for awareness exercises. Before its menu appears, the startup script recursively sets mode 777 on bundled files and directories, truncates tunnel logs, runs package and tunnel setup when either tunnel binary is missing, and kills running PHP, ngrok, and cloudflared processes; it requires root on GNU/Linux. The setup installs missing packages, downloads tunnel clients, and includes a localhost.run SSH reverse-tunnel path. Do not run the entrypoint merely to inspect it.

Source

https://github.com/makdosx/mip22

Language

Bash

References

github.com github.com raw.githubusercontent.com raw.githubusercontent.com raw.githubusercontent.com

+6 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER