Back to Projects

Introduction

Important

Before starting, for advanced MFA (Multi-Factor Authentication) bypass scenarios, it is highly recommended to investigate Evilginx2 as a superior alternative to Nginx for reverse proxy handling.

The human factor is the weakest link in cybersecurity; we can have the best tools or analysts, but we are only two clicks away from infecting an entire organization.

This is why it is highly recommended to create phishing campaigns to train teams in detecting and preventing incidents. In this blog, the goal is to understand the architecture of Gophish, a tool to perform phishing in a simple way within your organization.

What is Gophish?

GoPhish is an open-source tool used to perform phishing simulations on organizations. Key features include:

  • Create Fake Emails and Landing Pages: Allows you to create realistic emails and landing pages that mimic legitimate sites.
  • Target Segmentation: Define groups of targets and customize campaigns for each department or team.
  • Action Tracking: Tracks whether recipients open emails, download attachments, or enter information into forms.
  • Detailed Reporting: Generates reports on campaign success to evaluate awareness effectiveness.
  • Integrations: Can be integrated with other incident management tools.
    • Important

    The use of GoPhish must comply with local laws and regulations and be authorized by the organization's management.

    Stack Features

  • Docker & Nginx
  • Let’s Encrypt (Automatic SSL)
  • MySQL Database
  • phpMyAdmin for visual DB management
  • Tested on Ubuntu 20.04 LTS servers

    • 🏗️ Architecture and Requirements

    Hardware Requirements

  • Recommended RAM: 4 GB (especially for Docker deployments).
  • Domain: A registered domain name.

    • File Structure

    The general architecture we will use is as follows:

    text
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 14, Col 1UTF-8

    ⚙️ Step-by-Step Configuration

    1. GoPhish (`/etc/gophish`)

    Dockerfile:

    dockerfile
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 3, Col 1UTF-8

    config.json:

    json
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 22, Col 1UTF-8
    Warning

    Remember to change the "password" to the one defined in your .env file.

    2. Database (`/etc/mysql`)

    init.sql:

    sql
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 2, Col 1UTF-8

    3. Nginx Proxy (`/etc/nginx`)

    We will configure 3 blocks: the main domain, the phishing domain (port 8080), and the dashboard (port 3333).

    nginx
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 11, Col 1UTF-8

    🚀 Deployment

    Local Setup

  • 1.Prepare the environment: cp .env.example .env
  • 2.Build: make build
  • 3.Launch: make up

    • Production Setup

    For real servers, we include an init.sh that automates Docker installation and opens the firewall:

    bash
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 5, Col 1UTF-8

    Getting Credentials

    GoPhish generates a temporary password on startup. Check it with:

    bash
    Cargando sintaxis...
    🔒 BitSentry_Terminal
    Ln 1, Col 1UTF-8

    🎯 Campaign Configuration

    To launch your first simulation, follow this workflow inside the dashboard:

  • 1.Sending Profiles: Configure SMTP data. If using Gmail, create an "App Password" in your Google account.
  • 2.Landing Pages: Import an existing web page via its URL. Gophish will capture and process the data.
  • Tip: Use the "Redirect" option to send the victim to the real site after capturing their data, minimizing suspicion.
  • 3.Email Templates: Import a real email from a known service for maximum fidelity.

    • 🛡️ Security Tips and Bypass

    To prevent your training emails from ending up in the Spam folder:

  • Whitelisting: If the campaign is internal, add the domain to the whitelist in the Google Workspace Admin Console (Apps > G Suite > Gmail > Spam Settings).
  • SSL: Generate certificates with Certbot inside the Nginx container:

    • certbot --nginx

  • DNS: Correcty configure DMARC and DKIM records.