Zphisher Tutorial: How Social Media Phishing Pages Work

Zphisher does not hack a social-media account or bypass its password. It hosts lookalike login pages and records information submitted through those forms. This tutorial runs Zphisher only on 127.0.0.1 with fake credentials, so you can see what happens when dummy credentials are submitted without sending a phishing link to anyone.

You will install Zphisher on Kali Linux, start its Facebook-style Traditional Login template on Localhost, submit a dummy username and password with curl, and inspect the files under auth/.

Quick Answer

Zphisher does not break into Facebook, Instagram, or other services. It hosts prebuilt lookalike login templates and records values submitted to those pages. On Kali, install the required packages, clone the Zphisher repository, and run bash zphisher.sh. For this lab, select the Facebook Traditional Login template and Localhost hosting.

What Is Zphisher?

Zphisher is an automated phishing toolkit by htr-tech. It is a Bash-based toolkit that includes lookalike login-page templates and starts PHP's built-in web server to host them. The current script identifies itself as version 2.3.5. Zphisher focuses on hosting phishing templates and capturing submitted form data rather than managing full campaigns.

Zphisher is not a password cracker. A lookalike page collects form fields and stores the submitted values locally. That is credential phishing in the social-engineering sense: Zphisher receives only the values submitted to its lookalike form; it does not obtain credentials from the real service.

Its main components are:

• 30+ prebuilt site templates under .sites/ (Facebook, Instagram, and other popular services appear in the menu)
• Localhost hosting on 127.0.0.1:8080 by default
• Optional Cloudflared or LocalXpose tunnels (not used in this guide)
• Capture files under auth/ for submitted usernames, passwords, and client IP details

Localhost makes the page available only on the same machine. Tunnel modes can publish a public URL for the same local PHP server. Localhost is enough to understand how the login template works and where submitted data is stored.

How Zphisher Works

For the Facebook Traditional Login template, data moves through Zphisher like this:

Prebuilt template under .sites/
            │
            ▼
Copied to .server/www/
            │
            ▼
PHP serves the page on localhost
            │
            ▼
Dummy form submits email/password
            │
            ▼
Template writes temporary result
            │
            ▼
zphisher.sh reads the result
            │
            ├──► auth/usernames.dat
            └──► auth/ip.txt

The form collects only the values submitted to the lookalike page. It does not interact with or bypass Facebook's authentication system.

In Localhost mode the script sets HOST=127.0.0.1 and PORT=8080, copies .sites/<template>/* into .server/www/, and starts PHP's built-in web server on 127.0.0.1:8080. The template's PHP handlers write temporary files such as usernames.txt and ip.txt under .server/www/. zphisher.sh watches for those files, appends their contents to auth/usernames.dat and auth/ip.txt, and then removes the temporary files.

How to Install Zphisher on Kali Linux

Zphisher is not installed from Kali's package repositories. Instead, clone its GitHub repository and run zphisher.sh from that directory.

Install git, php, curl, and unzip with apt before cloning Zphisher:

sudo apt install git php curl unzip

Confirm that all four commands are available:

command -v git php curl unzip

/usr/bin/git
/usr/bin/php
/usr/bin/curl
/usr/bin/unzip

Each command should return a path such as /usr/bin/git. No output means that command is not available in your current shell.

Create a working directory for Zphisher:

mkdir -p ~/zphisher-lab && cd ~/zphisher-lab

Clone only the latest repository revision. --depth=1 avoids downloading the complete Git history, which is not needed for this tutorial:

git clone --depth=1 https://github.com/htr-tech/zphisher.git

Cloning into 'zphisher'...

Enter the clone directory:

cd zphisher

git was needed only to clone the repository. Zphisher itself checks for tools such as php, curl, and unzip when it starts.

Launch Zphisher:

bash zphisher.sh

When the dependencies are available, you should see:

[+] Installing required packages...
[+] Packages already installed.

The banner shows version 2.3.5, then the main template menu.

Understand Zphisher Login Templates

Zphisher includes prebuilt templates for Facebook, Instagram, and other services. This tutorial uses the Facebook Traditional Login template to demonstrate the workflow.

This is a prebuilt Zphisher template; the tool is not dynamically cloning Facebook's current website. Cloudflared and LocalXpose can make the local server reachable through an external URL, but they are not needed for this tutorial.

Run a Zphisher Facebook Template on Localhost

Start Zphisher and make the following selections:

1. 01 Facebook
2. 01 Traditional Login Page
3. 01 Localhost
4. n for the custom-port prompt (keep 8080)

This chooses the Facebook Traditional Login template, hosts it only on localhost, and keeps the default port 8080.

bash zphisher.sh

Zphisher then starts the local PHP server:

[-] Using Default Port 8080...
[-] Setting up server...
[-] Successfully Hosted at : http://127.0.0.1:8080 
[-] Waiting for Login Info, Ctrl + C to exit...

Leave that process running in its terminal. In a second shell from the same clone directory, confirm that the local web server is responding. -I sends a HEAD request so curl prints only the response headers, while -s hides its progress meter:

curl -sI http://127.0.0.1:8080/

HTTP/1.1 200 OK
Host: 127.0.0.1:8080
Date: Sun, 13 Sep 2026 14:40:59 GMT
Connection: close
X-Powered-By: PHP/8.4.24
Content-type: text/html; charset=UTF-8

200 OK confirms that the local web server is responding. A PHP version header may also appear when expose_php is enabled; it is not required for the rest of the lab.

The hosted Facebook template is now under .server/www/. Inspect the opening <form> tag to see where the login data is sent. Because the <form> tag spans multiple lines, join those lines before searching for it:

tr -d '\r\n' < .server/www/login.html | tr -s ' ' | grep -oE '<form[^>]*>' | head -1

<form class="_9vtf" data-testid="royal_login_form" action="login.php" method="post" onsubmit="" id="u_0_a_OZ" >

Ignore the CSS classes and other attributes here. The two important parts are method="post" and action="login.php". They tell us that the form sends its data to login.php using HTTP POST. Next, check which fields the form submits:

curl -s http://127.0.0.1:8080/login.html | grep -oE 'name="(email|pass)"' | sort -u

name="email"
name="pass"

The login form names the two credential fields email and pass. The next command therefore sends values using the field names email and pass.

Submit Dummy Login Data with curl

Use curl to submit known dummy values directly to the local form. This lets you test the capture process without entering any real credentials.

When --data-urlencode is used, curl sends the form data with a POST request automatically, so -X POST is unnecessary. Submit dummy values only. These are not real credentials:

curl -s -D - -o /dev/null \
  --data-urlencode 'email=lab-user@example.invalid' \
  --data-urlencode 'pass=NotARealPassword123' \
  http://127.0.0.1:8080/login.php

HTTP/1.1 302 Found
Host: 127.0.0.1:8080
Date: Sun, 13 Sep 2026 15:08:32 GMT
Connection: close
X-Powered-By: PHP/8.4.24
Location: https://facebook.com/recover/initiate/
Content-type: text/html; charset=UTF-8

In this template, login.php processes the submitted values before returning a 302 redirect to Facebook's recovery page. The browser would therefore leave the lookalike page after the values had already been captured locally.

Zphisher prints the submitted dummy values and appends them to auth/usernames.dat:

[-] Login info Found !!
[-] Account : lab-user@example.invalid
[-] Password : NotARealPassword123
[-] Saved in : auth/usernames.dat

Keep zphisher.sh running while submitting the dummy form so it can process the temporary files. Stop it with Ctrl+C after the submission is complete.

Where Zphisher Stores Captured Login Data

After the dummy submission, check the file where Zphisher saved the login data:

cat auth/usernames.dat

Facebook Username: lab-user@example.invalid Pass: NotARealPassword123

The template also records the IP address and User-Agent of the client making the request. Because the request came from the same machine, auth/ip.txt contains the localhost address:

cat auth/ip.txt

IP: 127.0.0.1
User-Agent: curl/8.21.0

127.0.0.1 is expected here because the request never left the local machine.

The results confirm four things:

• The Facebook template accepts ordinary HTTP form fields named email and pass
• Submitted values can be captured without interacting with Facebook's real authentication service
• Zphisher stores those values in local files under auth/
• This template redirects to the real site after submission

How to Detect a Zphisher-Style Phishing Page

The Facebook-style form is served from 127.0.0.1, but after submission its response redirects to Facebook. That mismatch illustrates an important phishing clue: the page collecting the credentials does not belong to the service it imitates.

Check the full hostname in the address bar before entering credentials. A padlock or HTTPS connection only means the connection is encrypted; a phishing site can also use HTTPS. Attackers can also paint fake browser chrome on the page itself—see Browser-in-the-Browser phishing for how that differs from a wrong hostname in the real address bar.

Common Zphisher Errors

Zphisher vs Gophish

For managed simulations with SMTP profiles and click tracking, start with install Gophish on Kali and create a phishing campaign with Gophish. For another menu-driven localhost harvester on Kali, compare SET phishing.

Defending Against Credential Phishing

A phishing page can closely copy familiar branding, so visual appearance alone is not enough to decide whether a login page is legitimate:

• Prefer passkeys or phishing-resistant MFA
• Verify the full hostname before entering credentials
• Treat login forms reached through unexpected links or domains as suspicious even when the page visually matches the real service
• Forward suspicious lure messages into your mail-analysis workflow—analyze phishing emails with ThePhish automates observable extraction when you already run TheHive and Cortex in a lab

Summary

Zphisher 2.3.5 is a Bash-based phishing toolkit distributed through its GitHub repository. On Kali Linux, run it with bash zphisher.sh. In Localhost mode it copies a prebuilt template such as Facebook Traditional Login into .server/www/, serves it with PHP on 127.0.0.1:8080, and moves captured form values into files under auth/.

Zphisher captures credentials through a lookalike form; it does not bypass the real service's authentication.

References

• htr-tech/zphisher - upstream repository and README
• PHP built-in web server - php -S used under the hood for Localhost mode
• Gophish - maintained open-source phishing campaign framework