# phishingclub/phishingclub architecture

> Architecture diagram of the GitHub repository phishingclub/phishingclub, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/phishingclub/phishingclub
- Repository: https://github.com/phishingclub/phishingclub

## Overview

Phishing Club is a web platform for phishing simulations, awareness training, and authorized red-team exercises. Administrators configure recipients, domains, pages, delivery, and campaign schedules in the frontend; the backend serves campaigns, records events, and provides dashboards and reports. The README documents major integrations and capabilities, while sampled backend excerpts show server/controller composition and webhook persistence. Some feature internals were not sampled, so the graph represents those as documented subsystems without asserting uncertain internal call paths.

Main entry points: [`backend/service`](https://github.com/phishingclub/phishingclub/tree/develop/backend/service) (Domain Services), [`backend/server`](https://github.com/phishingclub/phishingclub/tree/develop/backend/server) (Events & Analytics), [`backend/app/server.go`](https://github.com/phishingclub/phishingclub/blob/develop/backend/app/server.go) (Admin Server), [`backend/controller`](https://github.com/phishingclub/phishingclub/tree/develop/backend/controller) (API Controllers)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_admin["Administration"]
  node_frontend["Management UI"]
  node_api_client["API Client<br/>[client.js]"]
end

subgraph group_campaign["Campaign Operations"]
  node_recipients["Recipients &amp; Groups<br/>[recipient.go]"]
  node_campaigns["Campaign Management<br/>[campaign.go]"]
  node_pages["Pages &amp; Assets<br/>[page.go]"]
  node_delivery["Message Delivery<br/>[email.go]"]
  node_tracking["Events &amp; Analytics"]
  node_training_reports["Training &amp; Reports<br/>[reportTemplate.go]"]
end

subgraph group_redteam["Red Team"]
  node_proxy["Reverse Proxy<br/>[proxy.go]"]
  node_remote_browser["Remote Browser<br/>[browser.go]"]
end

subgraph group_platform["Platform Services"]
  node_admin_server["Admin Server<br/>[server.go]"]
  node_controllers["API Controllers"]
  node_services["Domain Services"]
  node_repositories["Repositories"]
  node_database[("Application Database")]
  node_webhooks["Webhook Automation<br/>[webhook.go]"]
  node_security["Access &amp; Identity<br/>[sso.go]"]
end

node_admin_user(("Administrator"))
node_smtp(("SMTP Provider"))
node_target_sites(("Target Websites"))
node_webhook_receiver(("Webhook Receiver"))
node_participants(("Campaign Participants"))

node_admin_user -->|"configures campaigns"| node_frontend
node_frontend -->|"calls API"| node_api_client
node_api_client -->|"sends requests"| node_admin_server
node_admin_server -->|"dispatches routes"| node_controllers
node_controllers -->|"invokes operations"| node_services
node_services -->|"uses persistence"| node_repositories
node_repositories -->|"reads and writes"| node_database
node_services -->|"manages recipients"| node_recipients
node_services -->|"manages campaigns"| node_campaigns
node_services -->|"manages landing content"| node_pages
node_services -->|"handles delivery"| node_delivery
node_delivery -.->|"sends messages"| node_smtp
node_participants -->|"visits campaign pages"| node_pages
node_admin_server -->|"records campaign events"| node_tracking
node_tracking -->|"stores event data"| node_database
node_tracking -->|"supports reporting"| node_training_reports
node_campaigns -->|"triggers automation"| node_webhooks
node_webhooks -.->|"posts signed events"| node_webhook_receiver
node_participants -->|"accesses proxied pages"| node_proxy
node_proxy -->|"proxies requests"| node_target_sites
node_participants -->|"uses live session"| node_remote_browser
node_controllers -->|"enforces identity controls"| node_security

click node_frontend "https://github.com/phishingclub/phishingclub/tree/develop/frontend/src/routes"
click node_api_client "https://github.com/phishingclub/phishingclub/blob/develop/frontend/src/lib/api/client.js"
click node_admin_server "https://github.com/phishingclub/phishingclub/blob/develop/backend/app/server.go"
click node_controllers "https://github.com/phishingclub/phishingclub/tree/develop/backend/controller"
click node_services "https://github.com/phishingclub/phishingclub/tree/develop/backend/service"
click node_repositories "https://github.com/phishingclub/phishingclub/tree/develop/backend/repository"
click node_database "https://github.com/phishingclub/phishingclub/tree/develop/backend/database"
click node_recipients "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/recipient.go"
click node_campaigns "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/campaign.go"
click node_pages "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/page.go"
click node_delivery "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/email.go"
click node_tracking "https://github.com/phishingclub/phishingclub/tree/develop/backend/server"
click node_training_reports "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/reportTemplate.go"
click node_webhooks "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/webhook.go"
click node_proxy "https://github.com/phishingclub/phishingclub/blob/develop/backend/proxy/proxy.go"
click node_remote_browser "https://github.com/phishingclub/phishingclub/blob/develop/backend/remotebrowser/browser.go"
click node_security "https://github.com/phishingclub/phishingclub/blob/develop/backend/service/sso.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_frontend,node_api_client toneBlue
class node_recipients,node_campaigns,node_pages,node_delivery,node_tracking,node_training_reports toneAmber
class node_proxy,node_remote_browser,node_webhook_receiver toneMint
class node_admin_server,node_controllers,node_services,node_repositories,node_database,node_webhooks,node_security toneRose
class node_admin_user,node_smtp,node_target_sites,node_participants toneIndigo
```

## Components

### Administration

- [Management UI](https://github.com/phishingclub/phishingclub/tree/develop/frontend/src/routes): `frontend/src/routes`
- [API Client](https://github.com/phishingclub/phishingclub/blob/develop/frontend/src/lib/api/client.js): `frontend/src/lib/api/client.js`

### Campaign Operations

- [Recipients & Groups](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/recipient.go): `backend/service/recipient.go`
- [Campaign Management](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/campaign.go): `backend/service/campaign.go`
- [Pages & Assets](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/page.go): `backend/service/page.go`
- [Message Delivery](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/email.go): `backend/service/email.go`
- [Events & Analytics](https://github.com/phishingclub/phishingclub/tree/develop/backend/server): `backend/server`
- [Training & Reports](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/reportTemplate.go): `backend/service/reportTemplate.go`

### Red Team

- [Reverse Proxy](https://github.com/phishingclub/phishingclub/blob/develop/backend/proxy/proxy.go): `backend/proxy/proxy.go`
- [Remote Browser](https://github.com/phishingclub/phishingclub/blob/develop/backend/remotebrowser/browser.go): `backend/remotebrowser/browser.go`

### Platform Services

- [Admin Server](https://github.com/phishingclub/phishingclub/blob/develop/backend/app/server.go): `backend/app/server.go`
- [API Controllers](https://github.com/phishingclub/phishingclub/tree/develop/backend/controller): `backend/controller`
- [Domain Services](https://github.com/phishingclub/phishingclub/tree/develop/backend/service): `backend/service`
- [Repositories](https://github.com/phishingclub/phishingclub/tree/develop/backend/repository): `backend/repository`
- [Application Database](https://github.com/phishingclub/phishingclub/tree/develop/backend/database): `backend/database`
- [Webhook Automation](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/webhook.go): `backend/service/webhook.go`
- [Access & Identity](https://github.com/phishingclub/phishingclub/blob/develop/backend/service/sso.go): `backend/service/sso.go`

### Other components

- **Administrator**
- **SMTP Provider**
- **Target Websites**
- **Webhook Receiver**
- **Campaign Participants**

## Connections

- Administrator → Management UI: configures campaigns
- Management UI → API Client: calls API
- API Client → Admin Server: sends requests
- Admin Server → API Controllers: dispatches routes
- API Controllers → Domain Services: invokes operations
- Domain Services → Repositories: uses persistence
- Repositories → Application Database: reads and writes
- Domain Services → Recipients & Groups: manages recipients
- Domain Services → Campaign Management: manages campaigns
- Domain Services → Pages & Assets: manages landing content
- Domain Services → Message Delivery: handles delivery
- Message Delivery → SMTP Provider: sends messages
- Campaign Participants → Pages & Assets: visits campaign pages
- Admin Server → Events & Analytics: records campaign events
- Events & Analytics → Application Database: stores event data
- Events & Analytics → Training & Reports: supports reporting
- Campaign Management → Webhook Automation: triggers automation
- Webhook Automation → Webhook Receiver: posts signed events
- Campaign Participants → Reverse Proxy: accesses proxied pages
- Reverse Proxy → Target Websites: proxies requests
- Campaign Participants → Remote Browser: uses live session
- API Controllers → Access & Identity: enforces identity controls