Omniprey Workspace Guide

Everything you need to run an authorised penetration testing engagement from your workspace — campaigns, AiTM relay, training, and reporting.

Access your workspace

Your workspace is available at https://{your-slug}.omniprey.site/ or https://www.omniprey.site/tenant-admin/. Log in with the email and password you set during setup.

Workspace Setup

Subdomain slug rules

• Lowercase letters, numbers, and hyphens only
• 3–32 characters total
• Must start and end with a letter or number
• Example: acme-corp, redteam01

Your workspace will be accessible at https://{slug}.omniprey.site/ (if subdomain routing is configured) or always at https://www.omniprey.site/tenant-admin/.

Workspace tabs overview

• CAPTURES — Real-time view of all form submissions for your tenant
• CONFIG — Stage 2 alert template, payload mode, C2 URL, per-site redirect URLs
• ACCESS — Generate time-limited viewer tokens for sharing capture data with clients
• SITES — Upload custom HTML assessment pages or ZIP archives
• DOMAIN — Connect and verify a custom domain via CNAME
• CAMPAIGNS — Full email campaign engine with targets, templates, and scheduling
• BRANDING — Set OG tags, page title, meta description, favicon, robots.txt per site
• ACCOUNT — Change password, view plan details and workspace info
• TRAINING — uSecure: assign and track security awareness modules
• RISK — uSecure: view and manage per-target risk scores
• REPORTS — uSecure: org-wide stats, risk distribution, training summary
• BREACH — uSecure: bulk email check against HaveIBeenPwned

Email Campaigns

SMTP Profiles (Resend)

Omniprey uses Resend for email delivery. Create an API key in your Resend dashboard, then add it under CAMPAIGNS → SETTINGS → Add SMTP Profile. Each profile stores the API key, from-name, and from-email.

Template Variables

Use these variables in your campaign subject or HTML body — they are replaced per-recipient at send time:

Scheduling

Set a future Send At date/time in the campaign builder. The hourly cron processor picks up scheduled campaigns and sends them automatically. Requires CRON_SECRET to be set.

Event Timeline

Every campaign tracks these events per target in order:

sent → opened (pixel) → clicked (link) → submitted (form) → valid_creds or invalid_creds (relay)

AiTM Credential Relay

When relay mode is active, submitted credentials are forwarded server-side to the real login endpoint. The platform harvests CSRF tokens, follows redirect chains, and accumulates session cookies at every hop.

How it works

1. Target submits credentials on sim page
2. Browser sends JSON POST to /capture?site={site}&relay=1
3. Server GETs real login page, extracts CSRF token and session cookies
4. Server POSTs credentials with browser headers (UA, Referer, Origin)
5. Server follows redirect chain (≤6 hops), accumulating Set-Cookie
6. Final URL tested against success regex per preset
7. Valid: live cookies captured and stored, target redirected to real dashboard
8. Invalid: inline error shown on sim page, target stays engaged

Built-in presets (18+)

Amazon, Microsoft, Google, Facebook, Instagram, LinkedIn, Twitter/X, Snapchat, TikTok, Discord, GitHub, Netflix, Spotify, Steam, Twitch, PayPal, Dropbox, Adobe, Apple

Custom relay config

Override or add relay config per-site in the CONFIG tab. Set relay:SiteName with JSON: {"url":"...","username_field":"email","password_field":"password","success_pattern":"...","success_redirect":"..."}

Simulation Sites

The platform ships with 67+ pre-built simulation pages: Microsoft, Google, Apple, Amazon, Facebook, Instagram, LinkedIn, and many more including banking, crypto, and payment apps.

Custom sites

Upload your own assessment pages under SITES → Upload. Supported formats:

• Single HTML file — self-contained page
• ZIP archive — must contain an index.html at the root

Uploaded sites get the same auth guard and relay interceptor injected automatically. Access them at /{slug}/.

uSecure — Security Awareness Training

After a penetration test engagement, assign training modules to targets directly from the TRAINING tab. Each module includes HTML content and a configurable quiz.

Training modules

Four default modules ship with every workspace:

• Security Awareness Basics
• Password Security
• Social Engineering Defence
• Safe Browsing & Link Inspection

Add custom modules via the Add Module button. Supply a title, description, HTML content, quiz JSON, duration, and category.

Training delivery

Each module generates a unique delivery URL: /training?module_id=X&email=TARGET_EMAIL. Include this link in follow-up emails sent to targets after an engagement. The target completes the module in a branded browser experience.

Quiz JSON format

[{"q":"Question text?","options":["A","B","C","D"],"answer":1}]

answer is the zero-based index of the correct option.

Risk Scoring

Every engagement event automatically updates a target's risk score. View the full picture per target in the RISK tab.

Risk levels

You can also apply manual risk events from the RISK tab — useful for recording out-of-band submissions or social engineering calls.

Dark Web Breach Monitor

The BREACH tab checks target email addresses against HaveIBeenPwned. Results are cached for 24 hours to avoid repeated API calls.

Enter up to 50 email addresses per check (one per line). Results are cached for 24 hours. Contact your operator to enable breach checking if the tab shows a configuration error.

Custom Domains

Point any domain at your Omniprey workspace — participants will only ever see your domain.

Setup steps

1. In your workspace, go to DOMAIN tab
2. Enter your domain (e.g. phish.acmecorp.com)
3. Add this DNS record at your registrar:

Type:  CNAME
Name:  phish (or @ for root)
Value: cname.vercel-dns.com

4. Click Verify — propagation typically takes 5–30 minutes
5. Once verified, Vercel provisions a TLS certificate automatically

Domain verification is handled server-side. Contact your operator if the Verify step fails after DNS propagation.