retour aux outils back to tools Ducklings

GoPhish

Framework de phishing open-source. Gère des campagnes de phishing avec templates d'emails, landing pages, listes de cibles et tableaux de bord de suivi en temps réel. Open-source phishing framework. Manages phishing campaigns with email templates, landing pages, target lists, and real-time tracking dashboards.

↗ https://getgophish.com

Overview

GoPhish is an open-source phishing toolkit that provides a full campaign management platform: email templates with variable substitution, cloned landing pages, target list management, SMTP configuration, and a real-time dashboard tracking opens, clicks, and credential submissions.

Setup

# Download binary from GitHub releases
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-*.zip && cd gophish/

Run (generates admin credentials on first launch)

./gophish

# Admin panel: https://127.0.0.1:3333 (default)
# Phishing listener: http://0.0.0.0:80

# Default credentials displayed at startup

Configuration (config.json)

{
  "admin_server": {
    "listen_url": "127.0.0.1:3333",
    "use_tls": true,
    "cert_path": "gophish_admin.crt",
    "key_path": "gophish_admin.key"
  },
  "phish_server": {
    "listen_url": "0.0.0.0:80",
    "use_tls": false
  },
  "db_name": "sqlite3",
  "db_path": "gophish.db",
  "logging": {
    "filename": ""
  }
}

Campaign Workflow

1. Sending Profile (SMTP)

Name: Corporate SMTP
Host: smtp.attacker-domain.com:587
Username: noreply@attacker-domain.com
Password: password
From: IT Security <security@attacker-domain.com>

2. Email Template

Subject: Important Security Update Required

<p>Dear {{.FirstName}},</p>
<p>Please <a href="{{.URL}}">click here</a> to verify your account.</p>
<p>Regards,<br>IT Security Team</p>

Available variables:

{{.FirstName}} / {{.LastName}}
{{.Email}}
{{.Position}}
{{.From}} — sender email
{{.URL}} — unique tracking URL

3. Landing Page

Clone any website via Import Site:

Enter target URL → GoPhish clones the HTML
Check Capture Submitted Data to log credentials
Check Redirect to for post-submission redirect

4. Users & Groups

CSV import format:

First Name,Last Name,Email,Position
John,Doe,jdoe@target.com,Manager
Jane,Smith,jsmith@target.com,Developer

5. Campaign Launch

Select all components (SMTP, template, landing page, group)
Set launch date/time
Launch and monitor dashboard

Tracking Metrics

Event	Tracked
Email Opened	Unique pixel per recipient
Link Clicked	Unique URL per recipient
Data Submitted	Form fields captured
Email Reported	If reporting button added

API Usage

# GoPhish REST API
API_KEY="your_api_key_from_settings"
BASE="https://127.0.0.1:3333/api"

List campaigns

curl -k -H "Authorization: Bearer $API_KEY" $BASE/campaigns/

Get campaign results

curl -k -H "Authorization: Bearer $API_KEY" $BASE/campaigns/1/results

Tips

Use a fresh domain aged ≥30 days for better email deliverability
Set SPF, DKIM, and DMARC records on your phishing domain
Test email delivery to major providers (Gmail, Outlook) before launch
Combine with Evilginx2: use GoPhish for delivery, Evilginx2 as the landing page (MFA bypass)

Infrastructure checklist

Domain:
  ✓ Registered domain (ideally aged, typosquat of target)
  ✓ SPF record: v=spf1 ip4:ATTACKER_IP -all
  ✓ DKIM record (generate via mail provider)
  ✓ DMARC record: v=DMARC1; p=none; rua=mailto:dmarc@domain.com

Server:
  ✓ Reverse DNS (PTR record) matches domain
  ✓ Port 25/587 open for SMTP sending
  ✓ Port 80/443 for landing pages
  ✓ Valid SSL cert (Let's Encrypt)
  
GoPhish:
  ✓ Admin UI behind VPN or firewall
  ✓ Changed default admin credentials
  ✓ Verified SMTP delivery before launch

Vue d’ensemble

GoPhish est une boîte à outils de phishing open-source qui fournit une plateforme complète de gestion de campagnes : templates d’emails avec substitution de variables, landing pages clonées, gestion de listes de cibles, configuration SMTP, et un tableau de bord en temps réel suivant les ouvertures, clics et soumissions d’identifiants.

Installation

# Télécharger le binaire depuis les releases GitHub
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-*.zip && cd gophish/

Lancer (génère les identifiants admin au premier démarrage)

./gophish

# Panneau admin : https://127.0.0.1:3333 (par défaut)
# Listener de phishing : http://0.0.0.0:80

# Les identifiants par défaut sont affichés au démarrage

Configuration (config.json)

{
  "admin_server": {
    "listen_url": "127.0.0.1:3333",
    "use_tls": true,
    "cert_path": "gophish_admin.crt",
    "key_path": "gophish_admin.key"
  },
  "phish_server": {
    "listen_url": "0.0.0.0:80",
    "use_tls": false
  },
  "db_name": "sqlite3",
  "db_path": "gophish.db",
  "logging": {
    "filename": ""
  }
}

Workflow de campagne

1. Profil d’envoi (SMTP)

Name: Corporate SMTP
Host: smtp.attacker-domain.com:587
Username: noreply@attacker-domain.com
Password: password
From: IT Security <security@attacker-domain.com>

2. Template d’email

Subject: Important Security Update Required

<p>Dear {{.FirstName}},</p>
<p>Please <a href="{{.URL}}">click here</a> to verify your account.</p>
<p>Regards,<br>IT Security Team</p>

Variables disponibles :

{{.FirstName}} / {{.LastName}}
{{.Email}}
{{.Position}}
{{.From}} : email de l’expéditeur
{{.URL}} : URL de tracking unique

3. Landing page

Cloner n’importe quel site via Import Site :

Saisir l’URL cible → GoPhish clone le HTML
Cocher Capture Submitted Data pour journaliser les identifiants
Cocher Redirect to pour une redirection après soumission

4. Utilisateurs et groupes

Format d’import CSV :

First Name,Last Name,Email,Position
John,Doe,jdoe@target.com,Manager
Jane,Smith,jsmith@target.com,Developer

5. Lancement de la campagne

Sélectionner tous les composants (SMTP, template, landing page, groupe)
Régler la date/heure de lancement
Lancer et surveiller le tableau de bord

Métriques de suivi

Événement	Suivi
Email ouvert	Pixel unique par destinataire
Lien cliqué	URL unique par destinataire
Données soumises	Champs de formulaire capturés
Email signalé	Si le bouton de signalement a été ajouté

Utilisation de l’API

# API REST GoPhish
API_KEY="your_api_key_from_settings"
BASE="https://127.0.0.1:3333/api"

Lister les campagnes

curl -k -H "Authorization: Bearer $API_KEY" $BASE/campaigns/

Obtenir les résultats d’une campagne

curl -k -H "Authorization: Bearer $API_KEY" $BASE/campaigns/1/results

Conseils

Utiliser un domaine récent âgé d’au moins 30 jours pour une meilleure délivrabilité des emails
Configurer les enregistrements SPF, DKIM et DMARC sur le domaine de phishing
Tester la délivrabilité vers les principaux fournisseurs (Gmail, Outlook) avant le lancement
Combiner avec Evilginx2 : utiliser GoPhish pour la livraison, Evilginx2 comme landing page (contournement MFA)

Infrastructure checklist

Domain:
  ✓ Registered domain (ideally aged, typosquat of target)
  ✓ SPF record: v=spf1 ip4:ATTACKER_IP -all
  ✓ DKIM record (generate via mail provider)
  ✓ DMARC record: v=DMARC1; p=none; rua=mailto:dmarc@domain.com

Server:
  ✓ Reverse DNS (PTR record) matches domain
  ✓ Port 25/587 open for SMTP sending
  ✓ Port 80/443 for landing pages
  ✓ Valid SSL cert (Let's Encrypt)
  
GoPhish:
  ✓ Admin UI behind VPN or firewall
  ✓ Changed default admin credentials
  ✓ Verified SMTP delivery before launch