GoPhish

Social Engineering

Intermediatehigh risk

GoPhish is a powerful, open-source phishing framework designed to make it easy to conduct internal phishing simulations and security awareness training.

Installation

wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip

Basic Syntax

./gophish

Quick Facts

Full Name

GoPhish Phishing Framework

License

MIT

Language

Go

Interface

Web GUI

Category

Phishing Simulation

Requires

SMTP Server

Tool Overview

GoPhish is an open-source phishing framework designed to make it easy to conduct phishing simulations and security awareness training. It provides a web-based interface for campaign management.

The tool allows you to create email templates, build landing pages, import target lists, and track user interactions including email opens, link clicks, and credential submissions.

GoPhish is used by security teams to test employee awareness, measure phishing susceptibility, and improve organizational security posture through realistic training exercises.

Common Commands

unzip gophish-v0.12.1-linux-64bit.zip -d gophishExtract a downloaded GoPhish release into its own directory

chmod +x gophishMake the GoPhish binary executable

./gophishStart GoPhish using the default ./config.json

./gophish --config /path/to/config.jsonStart GoPhish with a configuration file at a custom path

./gophish --disable-mailerRun GoPhish without the built-in mailer for use with an external mail server

sudo ./gophishRun with privileges so the phishing server can bind port 80/443

curl -k -H "Authorization: Bearer API_KEY" https://localhost:3333/api/campaigns/List all campaigns via the REST API

curl -k -H "Authorization: Bearer API_KEY" https://localhost:3333/api/campaigns/summaryGet summary statistics for every campaign

curl -k -H "Authorization: Bearer API_KEY" https://localhost:3333/api/campaigns/1Retrieve details for a single campaign by ID

curl -k -H "Authorization: Bearer API_KEY" https://localhost:3333/api/campaigns/1/resultsFetch per-recipient results for a campaign

curl -k -X POST -H "Authorization: Bearer API_KEY" -H "Content-Type: application/json" -d @campaign.json https://localhost:3333/api/campaigns/

Create and launch a new campaign from a JSON body

curl -k -X GET -H "Authorization: Bearer API_KEY" https://localhost:3333/api/campaigns/1/completeMark a running campaign as complete

curl -k -X DELETE -H "Authorization: Bearer API_KEY" https://localhost:3333/api/campaigns/1Delete a campaign by ID

curl -k -H "Authorization: Bearer API_KEY" https://localhost:3333/api/groups/List all target groups

curl -k -X POST -H "Authorization: Bearer API_KEY" -H "Content-Type: application/json" -d @group.json https://localhost:3333/api/groups/

Create a target group of recipients

Step-by-Step Guide

1Run the main GoPhish executable to start the daemon
2Log into the administrative web dashboard
3Design your deceptive email template
4Build the fake landing page to capture data
5Configure your SMTP sending parameters
6Import the list of target email addresses into a group
7Initiate the simulation and track user interactions

Use Cases

Phishing Simulations

Conduct realistic phishing campaigns to test employees.

Security Awareness

Train employees to recognize phishing attempts.

Compliance Testing

Verify security awareness training effectiveness.

Risk Assessment

Measure organizational phishing susceptibility.

Key Features

Email Templates: Create customizable phishing email templates.
Landing Pages: Build credential capture landing pages.
Campaign Tracking: Track opens, clicks, and submissions.
Reporting: Generate campaign results reports.

Related Tools

SET

Social Engineering

Social engineering framework.

Frequently Asked Questions

What is GoPhish used for?

GoPhish is used for conducting phishing simulations and security awareness training. It allows organizations to test employee susceptibility to phishing attacks with realistic campaigns.

Is GoPhish free?

Yes, GoPhish is completely open source and free to use. It provides a full-featured phishing simulation framework without licensing costs.

How does GoPhish track phishing results?

GoPhish tracks email opens, link clicks, and credential submissions through embedded tracking pixels and landing page submissions.

Do I need my own SMTP server?

Yes, GoPhish requires an SMTP server to send phishing emails. You can use Gmail, SendGrid, or your own mail server.