Prepare emails, SMS, landing pages and sending profiles

The elements of a scenario

Start from a Bexxo template

• A Bexxo template can be chosen as is in a campaign. It cannot be edited: the eye icon opens it read-only. For emails, a clickable thumbnail shows the message.
• To adapt it, click the copy icon: the form opens already filled in. Once saved, the copy joins your own elements.
• Your own elements can be edited (pencil icon), copied or deleted (bin icon).

Create a phishing email

1. Click Add a new Email, or copy an existing template.
2. In the Settings block, fill in:

   • Descriptive name (required): internal name, not visible to the target;
   • Brand (optional): the brand the message imitates;
   • Language (required): French, English, German, Italian, Spanish or Portuguese;
   • Tags (optional): free keywords to find the template again.
3. Enter the Email subject (required) and, if you wish, the From (displayed instead of email).
4. In the Email content block, write the message in the HTML Email tab, then its unformatted version in the Plain text email tab. Mail clients that do not display HTML show this text version. Place the {{phish.urlPhishing}} variable where the target should click.
5. Click Preview to open the HTML in a new tab, then click Save Phishing Email.

The editor

The displayed sender

Personalization variables

Create a phishing SMS

1. Open PhishTrainer › Phishing SMS, then click Add a new SMS, or copy an existing template.
2. In the Settings block, fill in Descriptive name and Language (required), then if needed Brand, Tags and From (if possible).
3. In the SMS content block, write the text (no formatting). Load SMS loads a .txt file and Add tag inserts a variable, such as {{phish.urlPhishing}} for the link. Then click Save Phishing SMS.

Create a landing page

1. Open PhishTrainer › Landing pages, then click Add a new page, or copy an existing template.
2. In the Settings block, fill in Descriptive name and Language (required), then if needed Brand and Tags. The page language also sets the language of the awareness page shown after a form is submitted.
3. Build the page in the HTML Editor. It offers the same tools as the email editor, variables included.
4. Click Preview to check the rendering, then click Save landing page.

What happens during a campaign

• The page opens when the target clicks the {{phish.urlPhishing}} link. This click is recorded in the results.
• Every form on the page is sent back to PhishTrainer, whatever its original address. A text, email or password field without a name attribute takes its id as its name.
• When the target submits a form, the submission is recorded, then an awareness page is shown. Its button leads to the destination address chosen in the campaign, or to the PhishTrainer website if none is chosen.
• A page without a form is enough to measure clicks. A form, for example a fake login screen, also measures what is entered.

Set up a sending profile

1. Click New Profile, or copy an existing profile.
2. In the SMTP Configuration block, fill in Name (required) and Email (required: the sending address), then if needed Sender name. The Interface type is set to SMTP.
3. Enter Server, Port (from 1 to 65535), Username and Password: these four fields are required. Choose the connection security in SSL / STARTTLS: No security, STARTTLS or SSL. To edit a profile without changing its password, leave the field empty.
4. Optional: for a specific technical need, add headers in the Custom headers block (name, value, then Add).
5. Click Save profile.

Test the profile

1. In the profile form, click Send a test. The test uses the form values, even if they are not saved yet.
2. In the Test sending window, check the recipient’s Email (required). First name and Last name are pre-filled with yours; Position is optional.
3. Click Send a test, then check that the message arrives in the mailbox entered.

The simulation allowlisting header

Not to be confused with: sending service emails

Put a scenario together