GoPhish
Full phishing campaign framework — manage targets, templates, landing pages, and capture credentials via web UI.
Quick Start
# Start GoPhish (default: admin UI on :3333, phishing on :80)
./gophish
# Custom config
./gophish --config config.json
# Access admin UI
# https://127.0.0.1:3333 (default admin:gophish, change on first login)
Configuration (config.json)
{
"admin_server": {
"listen_url": "127.0.0.1:3333",
"use_tls": true,
"cert_path": "gophish_admin.crt",
"key_path": "gophish_admin.key"
},
"phish_server": {
"listen_url": "0.0.0.0:443",
"use_tls": true,
"cert_path": "/etc/letsencrypt/live/phish.example.com/fullchain.pem",
"key_path": "/etc/letsencrypt/live/phish.example.com/privkey.pem"
},
"db_name": "sqlite3",
"db_path": "gophish.db"
}
Campaign Workflow
- Sending Profile — configure SMTP relay (host, port, from, username, password)
- Email Template — HTML/text body with
{{.FirstName}}, {{.URL}}, {{.Tracker}}
- Landing Page — clone target login page; enable Capture Credentials + Redirect to
- User & Group — import CSV:
First Name, Last Name, Email, Position
- Campaign — link all above, set send schedule, launch
Email Template Variables
| Variable |
Description |
{{.FirstName}} |
Target first name |
{{.LastName}} |
Target last name |
{{.Email}} |
Target email |
{{.Position}} |
Target job title |
{{.From}} |
Sending address |
{{.URL}} |
Unique phishing link (auto-generated) |
{{.Tracker}} |
Open-tracking pixel |
{{.RId}} |
Unique recipient ID |
Common Workflows
# Import targets from CSV
# CSV format: First Name,Last Name,Email,Position
cat > targets.csv << 'EOF'
First Name,Last Name,Email,Position
John,Doe,jdoe@target.com,Developer
EOF
# API: list campaigns
curl -k -H "Authorization: Bearer API_KEY" https://127.0.0.1:3333/api/campaigns/
# API: get campaign results
curl -k -H "Authorization: Bearer API_KEY" https://127.0.0.1:3333/api/campaigns/1/results
SMTP Relay Options
- Sendgrid / Mailgun — free tier available
- Self-hosted Postfix — configure SPF/DKIM/DMARC for deliverability
- SMTP2GO — good deliverability, free tier
Infrastructure Tips
- Register lookalike domain (e.g.,
target-helpdesk.com)
- Set up Let's Encrypt TLS on phishing server
- Add SPF, DKIM, DMARC records for sending domain
- Use email warmup for better inbox placement
Resources
| File |
When to load |
references/campaign-setup.md |
Full setup guide: SMTP config, DNS records, landing page cloning, API usage |
1---2name: gophish3description: Open-source phishing campaign framework with web UI for creating credential harvesting campaigns, tracking click-through rates, and managing targets. Use when asked to set up a phishing campaign, create credential harvesting pages, send spear-phishing emails, or generate phishing infrastructure.4license: MIT5---67# GoPhish89Full phishing campaign framework — manage targets, templates, landing pages, and capture credentials via web UI.1011## Quick Start1213```bash14# Start GoPhish (default: admin UI on :3333, phishing on :80)15./gophish1617# Custom config18./gophish --config config.json1920# Access admin UI21# https://127.0.0.1:3333 (default admin:gophish, change on first login)22```2324## Configuration (config.json)2526```json27{28 "admin_server": {29 "listen_url": "127.0.0.1:3333",30 "use_tls": true,31 "cert_path": "gophish_admin.crt",32 "key_path": "gophish_admin.key"33 },34 "phish_server": {35 "listen_url": "0.0.0.0:443",36 "use_tls": true,37 "cert_path": "/etc/letsencrypt/live/phish.example.com/fullchain.pem",38 "key_path": "/etc/letsencrypt/live/phish.example.com/privkey.pem"39 },40 "db_name": "sqlite3",41 "db_path": "gophish.db"42}43```4445## Campaign Workflow46471. **Sending Profile** — configure SMTP relay (host, port, from, username, password)482. **Email Template** — HTML/text body with `{{.FirstName}}`, `{{.URL}}`, `{{.Tracker}}`493. **Landing Page** — clone target login page; enable Capture Credentials + Redirect to504. **User & Group** — import CSV: `First Name, Last Name, Email, Position`515. **Campaign** — link all above, set send schedule, launch5253## Email Template Variables5455| Variable | Description |56|----------|-------------|57| `{{.FirstName}}` | Target first name |58| `{{.LastName}}` | Target last name |59| `{{.Email}}` | Target email |60| `{{.Position}}` | Target job title |61| `{{.From}}` | Sending address |62| `{{.URL}}` | Unique phishing link (auto-generated) |63| `{{.Tracker}}` | Open-tracking pixel |64| `{{.RId}}` | Unique recipient ID |6566## Common Workflows6768```bash69# Import targets from CSV70# CSV format: First Name,Last Name,Email,Position71cat > targets.csv << 'EOF'72First Name,Last Name,Email,Position73John,Doe,jdoe@target.com,Developer74EOF7576# API: list campaigns77curl -k -H "Authorization: Bearer API_KEY" https://127.0.0.1:3333/api/campaigns/7879# API: get campaign results80curl -k -H "Authorization: Bearer API_KEY" https://127.0.0.1:3333/api/campaigns/1/results81```8283## SMTP Relay Options8485- **Sendgrid / Mailgun** — free tier available86- **Self-hosted Postfix** — configure SPF/DKIM/DMARC for deliverability87- **SMTP2GO** — good deliverability, free tier8889## Infrastructure Tips9091- Register lookalike domain (e.g., `target-helpdesk.com`)92- Set up Let's Encrypt TLS on phishing server93- Add SPF, DKIM, DMARC records for sending domain94- Use email warmup for better inbox placement9596## Resources9798| File | When to load |99|------|--------------|100| `references/campaign-setup.md` | Full setup guide: SMTP config, DNS records, landing page cloning, API usage |
antgroup