Welcome to the first of a series of posts diving into the functionality and usage of the tool – Gophish. This tool allows users to quickly deploy phishing engagements or user awareness training exercises. Recently, we performed a user awareness exercise in which the client was looking to track the number of employees who clicked on a phishing website link within an email. To gather this metric, we turned to Gophish. In this post, I’ll be walking through a quick and easy configuration of Gophish.
The Gophish starter guide defines it as,
‘a phishing framework that makes the simulation of real-world phishing attacks dead-simple. The idea behind Gophish is simple – make industry-grade phishing training available to everyone. “Available” in this case means two things:
There are a couple different ways that Gophish can be setup or installed. Gophish does a wonderful job with its documentation. There are two options for installation, 1. Build from source or 2. Utilizing pre-built binaries.
In this post, we will walk through the pre-built binaries. In my case, I will be downloading the Linux 64bit version. There is a list of releases here where you can specify your operating system version to download the correct version, here is the latest version (at the time of this blog). Be sure to periodically check for newer versions.
wget https://github.com/gophish/gophish/releases/download/v0.11.0/gophish-v0.11.0-linux-64bit.zipOnce the Gophish release file has been downloaded to the system, unzip the file to retrieve the contents.
unzip gophish-v0.11.0-linux-64bit.zipWithin the directory you will be presented with a “gophish” file. Be sure to apply the execute permissions to the file.
chmod +x gophishRunning the Gophish file with sudo rights will start the application.
sudo ./gophishSomething to note – when starting the Gophish application the terminal screen will display some necessary information to be able to access the application. The first item will be the login information:
level=info msg="Please login with the username admin and the password <PASSWORD>"The second item will be the URL to the administrative portal:
level=info msg="Starting admin server at https://127.0.0.1:3333"With this information you can get logged into the Gophish interface.
In further blog posts, we will work on configuring Gophish to work with a specific domain and interact with an external mail server… stay tuned for part two!
Cyber Advisors specializes in providing fully customizable cyber security solutions & services. Our knowledgeable, highly skilled, talented security experts are here to help design, deliver, implement, manage, monitor, put your defenses to the test, & strengthen your systems - so you don’t have to.
Read more from our technical experts...