gophish / user-guide

A guide explaining how to use Gophish

Gophish

Gophish: Open-Source Phishing Toolkit

Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.

Install

Installation of Gophish is dead-simple - just download and extract the zip containing the release for your system, and run the binary. Gophish has binary releases for Windows, Mac, and Linux platforms.

Building From Source

If you are building from source, please note that Gophish requires Go v1.10 or above!

To build Gophish from source, simply run git clone https://github.com/gophish/gophish.git and cd into the project source directory. Then, run go build. After this, you should have a binary called gophish in the current directory.

Docker

You can also use Gophish via the official Docker container here.

Setup

After running the Gophish binary, open an Internet browser to https://localhost:3333 and login with the default username and password listed in the log output. e.g.

time="2020-07-29T01:24:08Z" level=info msg="Please login with the username admin and the password 4304d5255378177d"

Releases of Gophish prior to v0.10.1 have a default username of admin and password of gophish.

Documentation

Documentation can be found on our site. Find something missing? Let us know by filing an issue!

Issues

Find a bug? Want more features? Find something missing in the documentation? Let us know! Please don't hesitate to file an issue and we'll get right on it.

License

Gophish - Open-Source Phishing Framework

The MIT License (MIT)

Copyright (c) 2013 - 2020 Jordan Wright

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software ("Gophish Community Edition") and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

user-guide's Issues

Morning Catch URL needs updated

The URL for the Morning Catch resource at /building-your-first-campaign/introducing-the-morning-catch-corporation needs to be updated to https://www.cobaltstrike.com/blog/introducing-morning-catch-a-phishing-paradise

add in doc for mysql 8.x

I have installed gophish on a ubuntu 18.04 lts server and have noticed that it differs in the way of installing with mysql 8.x in the gophish documentation. It would be quite useful to add in the documentation the correct way of configuring gophish with that version of mysql as it is the current stable version.

running gophish as a service, it doesnt show credentials

I don't know what I am doing wrong.Gophish wont show phished credentials, only shows email opened and link clicked

Please help

Hello:
when i run ./gophish start system, show below:

time="2019-04-17T14:23:44+08:00" level=info msg="Background Worker Started Successfully - Waiting for Campaigns"
time="2019-04-17T14:23:44+08:00" level=warning msg="No contact address has been configured."
time="2019-04-17T14:23:44+08:00" level=warning msg="Please consider adding a contact_address entry in your config.json"
time="2019-04-17T14:23:44+08:00" level=error msg="no valid version found"
time="2019-04-17T14:23:44+08:00" level=fatal msg="no valid version found"

Attachment Tracking

Hi,
everytime I try to use Attachment tracking it works until I edit the file.

For example, if I download the excel or word file and I upload it on the email template I get a response from it.
If I try to open the file and try to save it without modifying it, the file no longer gives any response.

Look like saving the files broke the attachment tracking.

Example 1: File is originially downloaded by this repository without even opening it:

Example 2: File is originially downloaded by this repository but I opened it and I just pressed "Save" without any new modification.

Clearly in the 2nd example the image tracker is broken and can't even load the picture.
Anyone had the same problem? I would like to track attachement but I can't share this kind of excel file. IT's just too easy to understand is phishing. I would like to have a personalized attachement file.

Thanks :)

Static landing site does not working.

I have problem with this. I download template of microsoft login page. And I go documentations and I do not understand. I do everything correct. But nothing changed. I just want everything will look like when I just open it in the folder in my computer. Php, css, images and all that stuff...

I copy login.html into landing source and nothing happend just plain html and no images or css. I think problem is in that template has too mutch files.
I use this template from this program

Go to .sites

Open microsoft

And these files I use.

Please someone help. I am lost in this. If you have time to solve this problem and show me tutorial how to do it, it would be wonderful. Thanks a lot.

Thanks for feedback

Webhook not returning the campaign id

**Webhook data issue **
I have upgraded the gophish 0.7 to 0.9. I have setup the webhook, getting the events data but campaign_id is missing in the alert data. Can anyone help me for this.

I am getting the below data in alert:
{"email":"[email protected]","time":"2020-04-06T06:32:46.929643003Z","message":"Email Sent","details":""}