Skip to content
BitSentry

Command Palette

Search for a command to run...

Back to Projects

Introduction

Important

Before starting, for advanced MFA (Multi-Factor Authentication) bypass scenarios, it is highly recommended to investigate Evilginx2 as a superior alternative to Nginx for reverse proxy handling.

The human factor is the weakest link in cybersecurity; we can have the best tools or analysts, but we are only two clicks away from infecting an entire organization.

This is why it is highly recommended to create phishing campaigns to train teams in detecting and preventing incidents. In this blog, the goal is to understand the architecture of Gophish, a tool to perform phishing in a simple way within your organization.

What is Gophish?

GoPhish is an open-source tool used to perform phishing simulations on organizations. Key features include:

  • Create Fake Emails and Landing Pages: Allows you to create realistic emails and landing pages that mimic legitimate sites.
  • Target Segmentation: Define groups of targets and customize campaigns for each department or team.
  • Action Tracking: Tracks whether recipients open emails, download attachments, or enter information into forms.
  • Detailed Reporting: Generates reports on campaign success to evaluate awareness effectiveness.
  • Integrations: Can be integrated with other incident management tools.
    • Important

    The use of GoPhish must comply with local laws and regulations and be authorized by the organization's management.

    Stack Features

  • Docker & Nginx
  • Let’s Encrypt (Automatic SSL)
  • MySQL Database
  • phpMyAdmin for visual DB management
  • Tested on Ubuntu 20.04 LTS servers

    • 🏗️ Architecture and Requirements

    Hardware Requirements

  • Recommended RAM: 4 GB (especially for Docker deployments).
  • Domain: A registered domain name.

    • File Structure

    The general architecture we will use is as follows:

    textCODE / BLOCK
    Loading syntax...
    14 LINES / PLAIN TEXT UTF-8

    ⚙️ Step-by-Step Configuration

    1. GoPhish (`/etc/gophish`)

    Dockerfile:

    dockerfileCODE / BLOCK
    Loading syntax...
    3 LINES / PLAIN TEXT UTF-8

    config.json:

    jsonCODE / BLOCK
    Loading syntax...
    22 LINES / PLAIN TEXT UTF-8
    Warning

    Remember to change the "password" to the one defined in your .env file.

    2. Database (`/etc/mysql`)

    init.sql:

    sqlCODE / BLOCK
    Loading syntax...
    2 LINES / PLAIN TEXT UTF-8

    3. Nginx Proxy (`/etc/nginx`)

    We will configure 3 blocks: the main domain, the phishing domain (port 8080), and the dashboard (port 3333).

    nginxCODE / BLOCK
    Loading syntax...
    11 LINES / PLAIN TEXT UTF-8

    🚀 Deployment

    Local Setup

  • 1.Prepare the environment: cp .env.example .env
  • 2.Build: make build
  • 3.Launch: make up

    • Production Setup

    For real servers, we include an init.sh that automates Docker installation and opens the firewall:

    bashCODE / BLOCK
    Loading syntax...
    5 LINES / PLAIN TEXT UTF-8

    Getting Credentials

    GoPhish generates a temporary password on startup. Check it with:

    bashCODE / BLOCK
    Loading syntax...
    1 LINES / PLAIN TEXT UTF-8

    Campaign Configuration

    To launch your first simulation, follow this workflow inside the dashboard:

  • 1.Sending Profiles: Configure SMTP data. If using Gmail, create an "App Password" in your Google account.
  • 2.Landing Pages: Import an existing web page via its URL. Gophish will capture and process the data.
  • Tip: Use the "Redirect" option to send the victim to the real site after capturing their data, minimizing suspicion.
  • 3.Email Templates: Import a real email from a known service for maximum fidelity.

    • 🛡️ Security Tips and Bypass

    To prevent your training emails from ending up in the Spam folder:

  • Whitelisting: If the campaign is internal, add the domain to the whitelist in the Google Workspace Admin Console (Apps > G Suite > Gmail > Spam Settings).
  • SSL: Generate certificates with Certbot inside the Nginx container:

    • certbot --nginx

  • DNS: Correcty configure DMARC and DKIM records.