# Phishing Test Pages - CDR Testing Suite

**FOR SECURITY TESTING PURPOSES ONLY**

## Overview

This collection contains realistic phishing/clone pages of **12 popular websites** designed to test Content Disarmament and Reconstruction (CDR) solutions' ability to detect and neutralize:

- **Brand impersonation**
- **Credential harvesting attempts**
- **Fake login pages**
- **Phishing techniques**
- **Social engineering attacks**

All pages include a `triggerWarning()` JavaScript function that:
✅ Displays a prominent warning banner  
✅ Shows an alert on page load  
✅ Blocks form submissions  
✅ Logs attempts to console  

---

## 📁 Sites Included

| Site | Directory | Filename | Type |
|------|-----------|----------|------|
| **Google** | `Google/` | `google_login_single.html` | Single file, inline CSS |
| **Microsoft** | `Microsoft/` | `microsoft_login.html` | Single file, inline CSS |
| **GitHub** | `GitHub/` | `github_login.html` | Single file, dark theme |
| **PayPal** | `PayPal/` | `paypal_login.html` | Single file, gradient |
| **Facebook** | `Facebook/` | `facebook_login.html` | Single file, responsive |
| **LinkedIn** | `LinkedIn/` | `linkedin_login.html` | Single file, Google SSO |
| **Apple ID** | `Apple/` | `apple_id_login.html` | Single file, dark theme |
| **Amazon** | `Amazon/` | `amazon_login.html` | Single file, gradient |
| **Dropbox** | `Dropbox/` | `dropbox_login.html` | Single file, blue gradient |
| **Instagram** | `Instagram/` | `instagram_login.html` | Single file, Facebook SSO |
| **Twitter/X** | `Twitter/` | `twitter_x_login.html` | Single file, dark theme |
| **Outlook** | `Outlook/` | `outlook_login.html` | Single file, O365 style |

---

## 🎯 What CDR Should Detect

### 1. Brand Impersonation
- Logos of legitimate companies (Google, Microsoft, etc.)
- Brand colors and design patterns
- Domain names different from official sites

### 2. Credential Harvesting
- Form fields collecting:
  - Email addresses
  - Passwords
  - Phone numbers
  - Usernames
- Form submission attempts

### 3. Suspicious JavaScript
- `triggerWarning()` function (legitimate testing, but suspicious pattern)
- Form interceptors
- Event listeners on forms
- `preventDefault()` and form manipulation

### 4. Social Engineering Indicators
- "Forgot password?" links
- "Sign in with Google/Facebook" buttons
- Trust indicators (lock icons, "secure" claims)
- Urgency language

---

## 🔍 CDR Detection Techniques

### Content-Based Detection
```
✓ Logo analysis (image recognition)
✓ Brand name detection (Google, Microsoft, PayPal, etc.)
✓ Form field analysis (password, email inputs)
✓ Suspicious keywords ("sign in", "login", "password")
```

### Structural Detection
```
✓ Single-page design (common in phishing)
✓ Minimal external resources
✓ Inline CSS (to avoid blocking)
✓ Self-contained HTML files
```

### Behavioral Detection
```
✓ JavaScript form intercept codes
✓ preventDefault() on submit
✓ Console logging of credentials
✓ Alert/warning mechanisms
```

### Domain Mismatch
```
✓ File served from non-official domain
✓ Missing HTTPS indicators
✓ Suspicious file names (e.g., "google_login.html" not from google.com)
```

---

## 🛡️ CDR Response Actions

A properly functioning CDR solution should:

### 1. **Block/Quarantine**
- Prevent file from being delivered
- Alert user/administrator
- Log attempt for analysis

### 2. **Sanitize**
- Remove `<form>` elements
- Strip JavaScript
- Remove suspicious links
- Neutralize submit buttons

### 3. **Alert/Warn**
- Display warning to end-user
- Mark file as "Phishing Attempt"
- Provide option to view in sandbox

### 4. **Report**
- Log brand detected (Google, Microsoft, etc.)
- Record credential fields found
- Track JavaScript patterns
- Generate incident report

---

## 📊 Test Matrix

| Feature | Google | Microsoft | GitHub | PayPal | Facebook | LinkedIn | Apple | Amazon | Dropbox | Instagram | Twitter | Outlook |
|---------|:------:|:---------:|:------:|:------:|:--------:|:--------:|:-----:|:------:|:-------:|:---------:|:-------:|:-------:|
| Brand Logo | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Email Field | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Password Field | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | ✓ |
| "Forgot Password" | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Social SSO | - | - | - | - | - | ✓ | - | - | ✓ | ✓ | - | - |
| Dark Theme | - | - | ✓ | - | - | - | ✓ | - | - | - | ✓ | - |
| Inline CSS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Warning Script | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |

---

## 🚀 Usage

### 1. Deploy to Test Environment
```bash
# Copy to web server or local testing directory
cp -r Phishing_Test_Pages/ /var/www/cdr_test/
```

### 2. Test CDR Solution
- Send files through email gateway with CDR
- Upload to file sharing with CDR scanning
- Process through document sanitization pipeline

### 3. Validate Results
Check that CDR:
- [ ] Detected phishing attempt
- [ ] Blocked or quarantined file
- [ ] Identified correct brand (Google, PayPal, etc.)
- [ ] Logged credential harvesting forms
- [ ] Removed or neutralized JavaScript

### 4. Review Logs
```
Expected CDR log entries:
- Brand: Google / Microsoft / GitHub / etc.
- Threat: Phishing / Credential Harvesting
- Fields: email, password
- Action: Blocked / Sanitized / Alerted
```

---

## ⚙️ Technical Details

### Warning Script (Injected in All Pages)

```javascript
function triggerWarning() { return 0;
    // Create warning banner
    var warningDiv = document.createElement('div');
    // ... banner HTML ...
    document.body.insertBefore(warningDiv, document.body.firstChild);

    // Show alert
    alert('⚠️ CDR TEST FILE - PHISHING SIMULATION');

    // Console warning
    console.warn('CDR TEST FILE - PHISHING SIMULATION');
}

// Block form submissions
document.addEventListener('DOMContentLoaded', function() {
    var forms = document.getElementsByTagName('form');
    for (var i = 0; i < forms.length; i++) {
        forms[i].addEventListener('submit', function(e) {
            e.preventDefault();
            alert('Form submission blocked.');
            console.warn('Phishing attempt intercepted');
            return false;
        });
    }
});
```

### Design Patterns

**Single-File HTML:**
- All CSS inline in `<style>` tags
- No external resources (reduces footprint)
- SVG logos inline (no external images)
- Self-contained (works offline)

**Realistic Branding:**
- Accurate color schemes
- Official font stacks
- Proper layout/spacing
- Recognizable UI patterns

**Form Fields:**
- Standard input types (email, password, text)
- Placeholder text matching real sites
- "Remember me" checkboxes
- "Forgot password" links

---

## 🔬 Advanced Testing

### Multi-File Variations (Future)
Create variations with:
- External CSS files
- Separate JavaScript files
- Loaded images (PNG/JPG)
- Multiple HTML pages
- AJAX submission attempts

### Evasion Techniques (Future)
- Obfuscated JavaScript
- Base64-encoded logos
- JavaScript-generated forms
- Dynamic DOM manipulation
- Time-delayed form display

### Targeted Attacks (Future)
- Spear-phishing (personalized content)
- Clone with real session tokens
- MitM attack simulation
- OAuth flow phishing

---

## 📋 Validation Checklist

### Per-Site Testing
For each site, verify CDR:

**Detection:**
- [ ] Identifies as phishing page
- [ ] Correctly identifies brand
- [ ] Detects credential fields

**Action:**
- [ ] Blocks or quarantines file
- [ ] Removes form elements
- [ ] Strips JavaScript
- [ ] Logs incident

**Reporting:**
- [ ] Brand name in report
- [ ] Threat type (phishing)
- [ ] Fields detected (email, password)
- [ ] Timestamp and source

### Aggregate Testing
- [ ] All 12 sites detected
- [ ] 100% detection rate
- [ ] No false negatives
- [ ] Appropriate severity levels

---

## 🛠️ Generation Scripts

### Included Scripts
1. `generate_phishing_pages.py` - Part 1 (Google, Microsoft, GitHub, PayPal)
2. `generate_phishing_pages_part2.py` - Part 2 (Facebook, LinkedIn, Apple, Amazon)
3. `generate_phishing_pages_part3.py` - Part 3 (Dropbox, Instagram, Twitter, Outlook)

### Regenerate All Pages
```bash
python generate_phishing_pages.py
python generate_phishing_pages_part2.py
python generate_phishing_pages_part3.py
```

---

## ⚠️ Security Warning

### Ethical Usage Only
These files are designed for **legitimate security testing** of CDR solutions.

**DO NOT:**
- ❌ Use for actual phishing attacks
- ❌ Distribute to end-users
- ❌ Deploy on public internet
- ❌ Use to harvest real credentials

**LEGAL NOTICE:**
Unauthorized use of these files for malicious purposes is illegal and unethical.  
Only use in controlled testing environments with proper authorization.

### Handling Guidelines
1. **Store securely** - Restricted access only
2. **Label clearly** - Mark as "TEST FILES"
3. **Controlled environment** - Isolated test networks
4. **Audit logging** - Track all usage
5. **Secure deletion** - When testing complete

---

## 📈 Expected Results

### Detection Rate Target
- **100%** - All phishing pages should be detected
- **0** false negatives acceptable
- **High confidence** scoring for obvious clones

### Response Time
- **< 1 second** - Real-time scanning
- **< 5 seconds** - Deep analysis mode

### Accuracy
- **Brand identification**: 100% accuracy
- **Field detection**: All email/password fields found
- **Link analysis**: All suspicious links flagged

---

## 🆕 Future Additions

### Additional Sites
- Yahoo Mail
- iCloud
- Salesforce
- Slack
- Discord
- WhatsApp Web
- Zoom
- Teams

### Additional Techniques
- Multi-step login flows
- CAPTCHA simulation
- Two-factor authentication pages
- Mobile-responsive versions
- Internationalized versions (non-English)

### Advanced Threats
- Homograph attacks (look-alike domains)
- Typosquatting simulations
- Subdomain phishing
- URL shortener redirects

---

## 📞 Support

For questions about CDR testing with these files:
1. Review this README
2. Check detection logs
3. Verify CDR configuration
4. Test with known-good files first

---

**Generated:** 2026-09-01  
**Purpose:** CDR Solution Testing  
**Files:** 12 phishing pages across 12 brands  
**Format:** Single-file HTML with inline CSS  

---

**End of Documentation**