Templates

King Phisher uses the Jinja2 for both email and web page templates. Jinja provides a number of powerful features to create dynamic content. For a definitive reference, please see the Jinja Template Designer Documentation.

Global Variables & Functions

These variables and filters are available in both email templates and web page templates.

Variable Name	Variable Value
time.local	Local server time
time.utc	UTC time
version	Version of King Phisher

Filters	Description
strftime	Format a datetime instance such as time.local
tomorrow	Adjust a datetime instance to reflect tomorrow's date
yesterday	Adjust a datetime instance to reflect yesterday's date

Functions	Parameters	Description
random_integer	lower, upper	Generate a pseudo-random number within the specified range

Time Format Examples

Print tomorrow's date:

Jinja Code: {{ time.local|tomorrow|strftime('%A %B %d, %Y') }}

Output: Sunday May 25, 2014

strftime.org is an excellent reference for directives of the strftime function.

Message Variables

The following variables are available for creating emails using the King Phisher client.

Variable Name	Variable Value
client.company_name	The target's company name
client.email_address	The target's email address
client.first_name	The target's first name
client.last_name	The target's last name
client.message_id	The unique tracking identifier (this is the same as uid)
url.tracking_dot	URL of an image used for message tracking
url.webserver	Phishing server URL with the uid parameter
url.webserver_raw	Phishing server URL without any parameters
tracking_dot_image_tag	The tracking image in a preformatted <img /> tag
uid	The unique tracking identifier (this is the same as client.message_id)

Web Page Variables

The following variables are available for writing web pages hosted on the King Phisher server.

Variable Name	Variable Value
client.address	The clients IP address
client.company_name*	The company name configured in the sent message
client.email_address*	The email address that was targeted
client.first_name*	The first name of the user that the message was sent to
client.last_name*	The last name of the user that the message was sent to
client.is_trained*	Whether or not the user has been trained
client.message_id*	The message_id of the visitor
client.visit_count*	The number of visits for the message_id
client.visit_id*	The unique visit_id of the current visitor
request.command	The HTTP verb of the current request
request.cookies	A dictionary containing the contents of the requests cookies
request.parameters	A dictionary containing the requests combined GET & POST parameters
server.address	The servers IP address
server.hostname	The requested VHOST name

* Most client variables require a valid identifier. To check if these variables are available, check that client.message_id is defined with {% if client.message_id is defined %}.

Pages can also determine if the client is visiting the page for the first time by checking that client.visit_count is 1.

The King Phisher server will also load all variables from the server.page_variables section of the configuration into the global name space. This allows custom templates to use variables that can be set in the server configuration file.

Autoescape Extension

King Phisher enables the Jinja autoescape extension. This will escape characters that are placed in html templates in server pages.

To disable the autoescape extension, place the desired code in a {% autoescape false %} {% endautoescape %} block.

Advanced Template Recipes

Create a random order number Print random integer as a order number:

Jinja Code: Order number: #{{ random_integer(100,999) }}-{{ random_integer(100,999) }}-{{ random_integer(100000,999999) }}

Example Output: Order number: #123-123456-123456

Change the domain in an email address

Jinja Recipe: {{ client.email | replace("gmail.com", "yahoo.com") }}

Example changes [email protected] to [email protected]

Create a formatted username

Jinja Recipe: DOMAIN\{{ client.first_name | truncate(1, True, '') | lower }}{{ client.last_name | lower }}

Example Output: DOMAIN\aliddle

Redirect a returning user to a different URL

Jinja Recipe:

{% if client.visit_count > 1 %}
    <meta http-equiv="refresh" content="0;url=http://google.com">
{% else %}
    <meta http-equiv="refresh" content="0;url=./phishing-website.html">
{% endif %}