How phishingclub/phishingclub works
Phishing Club is a web platform for phishing simulations, awareness training, and authorized red-team exercises. Administrators configure recipients, domains, pages, delivery, and campaign schedules in the frontend; the backend serves campaigns, records events, and provides dashboards and reports. The README documents major integrations and capabilities, while sampled backend excerpts show server/controller composition and webhook persistence. Some feature internals were not sampled, so the graph represents those as documented subsystems without asserting uncertain internal call paths.
Main entry points: service Domain Services · server Events & Analytics · server.go Admin Server · controller API Controllers
Components 22
Administration
- Management UI
frontend/src/routes - API Client
frontend/src/lib/api/client.js
Campaign Operations
- Recipients & Groups
backend/service/recipient.go - Campaign Management
backend/service/campaign.go - Pages & Assets
backend/service/page.go - Message Delivery
backend/service/email.go - Events & Analytics
backend/server - Training & Reports
backend/service/reportTemplate.go
Red Team
- Reverse Proxy
backend/proxy/proxy.go - Remote Browser
backend/remotebrowser/browser.go
Platform Services
- Admin Server
backend/app/server.go - API Controllers
backend/controller - Domain Services
backend/service - Repositories
backend/repository - Application Database
backend/database - Webhook Automation
backend/service/webhook.go - Access & Identity
backend/service/sso.go
Other components
- Administrator
- SMTP Provider
- Target Websites
- Webhook Receiver
- Campaign Participants
Connections 22
- Administrator → Management UI: configures campaigns
- Management UI → API Client: calls API
- API Client → Admin Server: sends requests
- Admin Server → API Controllers: dispatches routes
- API Controllers → Domain Services: invokes operations
- Domain Services → Repositories: uses persistence
- Repositories → Application Database: reads and writes
- Domain Services → Recipients & Groups: manages recipients
- Domain Services → Campaign Management: manages campaigns
- Domain Services → Pages & Assets: manages landing content
- Domain Services → Message Delivery: handles delivery
- Message Delivery → SMTP Provider: sends messages
- Campaign Participants → Pages & Assets: visits campaign pages
- Admin Server → Events & Analytics: records campaign events
- Events & Analytics → Application Database: stores event data
- Events & Analytics → Training & Reports: supports reporting
- Campaign Management → Webhook Automation: triggers automation
- Webhook Automation → Webhook Receiver: posts signed events
- Campaign Participants → Reverse Proxy: accesses proxied pages
- Reverse Proxy → Target Websites: proxies requests
- Campaign Participants → Remote Browser: uses live session
- API Controllers → Access & Identity: enforces identity controls