look, in my last winter break, i searched around on the internet for like a week. and from that learnt enough javascript, perl and CGI to do everything. i would send the attack and wait. when the victim gave the password, i received an email. it was so cool to see that email ( it was customized to show: you have a new victim!) and the text said something like: my password is "this". please use it however you like it. haha. as to answer the phishing question, just do some work. to begin with, haven't you ever received a phishing email.? like from ebay or paypal? look at the page's source code. look at how the "real" spammer does it.