Project 11: Phishing Awareness Simulation

Module: Module 2: OSINT, Social-Engineering Awareness & Traffic Analysis  |  Level: Beginner  | 
Primary tool: A free phishing-simulation template (defensive use only)  |  Estimated time: 45–75 minutes

Objective: Learn the anatomy of a phishing email so you can teach others to spot one.

Free lab environment

OSINT Framework + theHarvester + Shodan (free tier) — https://osintframework.com/ and https://www.shodan.io/

Practice OSINT techniques against your own domain, your own social media presence, or explicitly-designed OSINT training targets (e.g. TryHackMe’s free OSINT rooms). Shodan’s free tier gives limited but real query results without payment. Never aggregate data on a real private individual without their consent as a course exercise.

Lab workflow

1. Confirm your target is a domain/account you own, or an explicitly-provided training target — never aggregate data about a real private individual without consent as a course exercise.
2. Using A free phishing-simulation template (defensive use only), run your collection step to learn the anatomy of a phishing email so you can teach others to spot one.
3. Organize every raw finding into a simple table: what was found, where, and why it matters.
4. Rank your findings by real-world sensitivity — not every piece of public information is equally risky if combined with other data.
5. Write a one-paragraph remediation note for the single most sensitive finding.
6. Capture the screenshots specified below as your evidence trail.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your annotated screenshot of a sample phishing email with each red flag labeled
• a one-paragraph ‘if you see this, do this’ guidance note you’d give a non-technical user

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.