UltraPhish is a powerful tool designed for ethical hacking and cybersecurity research.
It provides a user-friendly interface to deploy phishing pages securely using multiple tunneling services.
Do not use it for illegal activities.
✅ Multi-Tunneling Support: Use Cloudflared, LocalXpose, Serveo, and Ngrok for secure phishing.
✅ Auto Installation: Automatically installs missing dependencies.
✅ OTP Support: Capture one-time passwords (OTP) if required.
✅ URL Masking: Generate a phishing link with a custom mask.
✅ Credential Capture: Stores login credentials and IP addresses of victims.
✅ Custom Templates: Includes multiple phishing page templates.
✅ Automated Ngrok Setup: Installs, authenticates, and fetches Ngrok tunnels seamlessly.
✅ Cross-Platform: Works on Linux, Termux, and Windows (via WSL).
- Multi platform (Supports most linux)
- Easy to use
- Possible error diagnoser
- 70+ Website templates
- Upto 6 links for phishing
- Argument support
- Credentials mailing
- Custom masking of URL
- URL Shadowing
- Redirection URL settings
- Portable file (Can be run from any directory)
- Get IP Address and many other details along with login credentials
Step 1: Update & upgrade your system
sudo apt update
sudo apt upgrade
Step 2: Clone the repository
git clone https://github.com/The-Real-Virus/UltraPhish.git
Step 3: Go to UltraPhish Directory
cd UltraPhish
Step 4: Run The Shell To Install Requirements
chmod +x run.sh
sudo ./run.sh
Step 5: After Completing the process now u can run script
python3 ultraphish.py
- Some secured browsers like Firefox can warn for '@' prefixed links. You should use pure links or custom link to avoid it.
- Termux from play store in not supported. Download termux from fdroid or github
- VPN or proxy prevents tunneling and even proper internet access. Turn them off you have issues.
- Some android requires hotspot to start Cloudflared and Loclx. If you face 'tunneling failed' in android,
most probably your hotspot is turned off. Turn it on and keep it on untill you close PyPhisher. - If you want mailing credentials then you need to use app password.
Visit here and generate an app password, put that infiles/email.json
. You may need to enable 2FA before it. - Ensure Cloudflared/LocalXpose/Serveo is installed.
- Restart your terminal and re-run the script.
- Run the script as root (sudo ./ultraphish.py).
-
Always test Ngrok manually before using it in the script.
-
Use a VPN for extra security when testing phishing pages.
-
Use in a legal environment (e.g., testing your own systems).
-
Disable unwanted tunnelers in the script if not needed.
-
Use cloudflared and Serveo Links.
-
Use grabify ip logger or other url shortner to Manually Mask the url.
-
must test link on ur device before sending.
-
if cloudflared down then use serveo.
OS | Support Level -----------|-------------- Linux | Excellent (100% Working & Recommended) Android | Not Tested iPhone | Alpha (Recommended docker) MacOS | Alpha (Recommended docker) Windows | Unsupported (Use docker/virtual-box/vmware) BSD | Never tested
- Run the script
- Choose a Website
- Wait sometimes for setting up all
- Send the generated link to victim
- Wait for victim login. As soon as he/she logs in, credentials will be captured
Python(3)
requests
rich
PHP
SSH
- 900MB storage
If not found, php and python modoules will be installed on first run
[•] Initializing PHP server at localhost:8080....
[+] PHP Server has started successfully!
[•] Initializing tunnelers at the same address.....
[+] Starting Ngrok Tunnel...
[DEBUG] Extracted Ngrok URL: https://abc123.ngrok.io
[+] Your URLs are given below:
╭─ CloudFlared ─────────────────────────────────────────────╮
│ URL : https://test-cloudflare.trycloudflare.com │
╰──────────────────────────────────────────────────────────╯
╭─ Ngrok ───────────────────────────────────────────────╮
│ URL : https://abc123.ngrok.io │
╰──────────────────────────────────────────────────────╯
[+] Waiting for login info....Press Ctrl+C to exit
This tool is intended for ethical and educational use only.
Do not use it for illegal activities. The author is not responsible for any misuse.
This script is intended for educational purposes and authorized testing only.
Unauthorized use of this script is illegal and unethical.
Ensure you have explicit permission before testing any system.
- Obtain explicit permission before testing any system.
- Adhere to all applicable laws and regulations.
- Respect user privacy and data.
- By using this script, you agree to take full responsibility for your actions.