GNSAC Phishing - Technical Documentation

01

Platform Overview

Enterprise-grade security awareness platform with multi-channel phishing simulation capabilities.

Document Contents

01Platform Overview

02System Architecture

03Technology Stack

04Core Modules

05API Reference

06Security & Compliance

07Deployment Options

📧

Email Campaigns

Create and manage sophisticated email phishing simulations with dynamic templates, pixel tracking, and real-time analytics.

📱

SMS/Smishing

Multi-provider SMS campaign support with Twilio, AWS SNS, and MessageBird integration for mobile security testing.

🎯

Landing Pages

Credential capture pages with website cloning, form automation, and post-submission redirect capabilities.

📊

Real-time Analytics

Comprehensive reporting with per-target tracking, geo-location, event timeline, and PDF export functionality.

🔐

Enterprise Security

Role-based access control, AES-256 encryption, audit logging, and CSRF protection built into every layer.

🔗

Integrations

Webhook support with HMAC-SHA256 signing for seamless SIEM/SOAR integration and automated workflows.

02

System Architecture

Layered architecture designed for scalability, maintainability, and security.

Presentation Layer

Admin Dashboard (SPA) REST API Gateway WebSocket Server Static File Server

Application Layer

Campaign Engine Template Processor Analytics Engine License Manager Webhook Dispatcher IMAP Monitor

Service Layer

SMTP Service SMS Gateway GeoIP Service Encryption Service Auth Service

Data Layer

SQLite / PostgreSQL GORM ORM Migration Manager Query Builder

Architectural Principles

The platform follows separation of concerns with clear boundaries between layers. Dependency injection enables loosely coupled components. Event-driven design with asynchronous processing ensures scalability. Security is built into every layer from the ground up.

03

Technology Stack

Modern, battle-tested technologies chosen for performance and security.

Go 1.21+

Backend Runtime

GORM

ORM Framework

SQLite

Database

AES-256

Encryption

🔷

Why Go (Golang)?

Native goroutines for concurrent campaign processing. Compiled binary with minimal memory footprint (<50MB). Single binary deployment without external dependencies. Strong typing with compile-time error catching.

🔌

External Integrations

SMS providers: Twilio, AWS SNS, MessageBird, SMPP protocol. Email: Any SMTP server with TLS support. Webhooks: Custom HTTP endpoints with HMAC signing. SIEM: Event forwarding for security monitoring.

Sample Worker Implementation

func StartCampaign(campaign *Campaign) {
    // Create worker pool for concurrent sending
    workerPool := NewWorkerPool(10)

    for _, target := range campaign.Targets {
        workerPool.Submit(func() {
            SendEmail(target, campaign.Template)
            TrackEvent(target, "sent")
        })
    }

    workerPool.Wait()
}
                

04

Core Modules

21 specialized modules working together to deliver comprehensive functionality.

Module	Description	Key Features
`campaign`	Email campaign management	Scheduling, tracking, results aggregation
`sms_campaign`	SMS/Smishing campaigns	Multi-provider, delivery tracking, replies
`template`	Email template engine	Variables, HTML/text, attachments
`sms_template`	SMS template system	GSM-7/Unicode, segment calculation
`page`	Landing page builder	Credential capture, website cloning
`group`	Target management	CSV import, segmentation, profiles
`smtp`	SMTP profile management	TLS, authentication, connection testing
`webhook`	Event notifications	HMAC-SHA256, custom endpoints
`user`	User & role management	RBAC, API keys, sessions
`license`	License management	Activation, validation, limits

05

API Reference

RESTful API with consistent patterns and comprehensive documentation.

GET /api/campaigns/

Retrieve all campaigns for the authenticated user with pagination support

POST /api/campaigns/

Create a new phishing campaign with template, landing page, and target assignments

GET /api/campaigns/{id}/results

Get detailed campaign results including per-target statistics and event timeline

POST /api/sms_campaigns/{id}/launch

Launch an SMS campaign immediately or schedule for future delivery

DELETE /api/templates/{id}

Delete an email template (requires ownership or admin role)

Authentication

// API Key Authentication (Header)
Authorization: Bearer <api_key>

// Session-based Authentication (Cookie)
Cookie: session=<session_token>
                

06

Security & Compliance

Enterprise-grade security measures implemented at every layer.

🔐

Authentication

Session-based auth with secure cookies. API key authentication for programmatic access. bcrypt password hashing.

🛡️

Authorization

Role-Based Access Control (RBAC) with granular permissions. Three levels: View, Modify, System.

🔒

Encryption

AES-256-GCM for data at rest. TLS 1.2+ enforced for data in transit. PBKDF2 key derivation.

🚫

CSRF Protection

Token-based CSRF protection on all state-changing operations. SameSite cookie attributes.

📝

Input Validation

Server-side validation. SQL injection prevention via parameterized queries. XSS protection.

📊

Audit Trail

Comprehensive logging of all user actions. IP tracking. Tamper-evident storage. Compliance reports.

Security Headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'
Referrer-Policy: strict-origin-when-cross-origin
                

07

Deployment Options

Flexible deployment models for various enterprise requirements.

💻

Single Binary

Self-contained executable with embedded assets. No external dependencies. Simply download and run on any platform.

🐳

Docker Container

Official Docker image available. Docker Compose for multi-service deployments. Kubernetes-ready with Helm charts.

☁️

Cloud Deployment

AWS, Azure, GCP compatible. Terraform modules available. Auto-scaling and load balancing support.

Requirement	Minimum	Recommended
CPU	1 vCPU	2+ vCPUs
Memory	512 MB RAM	2 GB RAM
Storage	1 GB	10 GB SSD
OS	Linux, macOS, Windows	Ubuntu 22.04 LTS

Performance Metrics

Memory footprint: <50MB | API response time: <100ms | Concurrent users: 1000+ | Email capacity: 10K/hour