In this lesson,
we're going to talk about Gophish,
a popular open-source phishing simulation tool.
As pen testers, one of the tasks we often perform
is social engineering,
and phishing is one of the most common techniques.
Gophish makes it easy to set up
and launch phishing campaigns
so you can test an organization's security awareness
and see how well they respond to email-based attacks.
Now, let's start with what Gophish actually does.
Gophish allows us to create and manage phishing campaigns
that simulate real-world phishing attacks.
It helps you design phishing emails, track user responses,
and report on the effectiveness
of your phishing simulations.
This is incredibly useful for assessing
how vulnerable an organization's employees are
to phishing attempts
and for educating them about the risk.
To use Gophish, the first step is setting up a campaign.
You'll create a phishing email that looks convincing enough
to trick users into clicking on a link,
downloading an attachment,
or entering their credentials into a fake login page.
Gophish provides a simple interface
where you can customize the email content,
the sender's address,
and even the landing page
where users will be directed after clicking the link.
For example, let's say you want
to create a phishing campaign
that mimics a company's internal email system.
You could design an email
that looks like it's coming from the IT department,
asking employees to log in and verify their credentials.
Using Gophish, you can easily craft the email
and include the company's branding, realistic-looking links,
and even forged senders address
such as "it-support@whateverthecompanyis.com."
Once the email is sent out, Gophish tracks the results.
It records which users opened the email,
clicked on the link,
and submitted their credentials on the fake login page.
This information is incredibly valuable for understanding
how susceptible an organization is to phishing attacks.
You can use these insights to identify employees
who may need additional training
or to evaluate the effectiveness
of the current security awareness program.
Let's examine a more specific example.
Let's say we're assimilating an internal phishing campaign
and we name the campaign "Morning Catch."
We'll be sending emails that appear to be from Boyd Jenius,
the system administrator of Morning Catch.
This can help test whether the employees are careful
about verifying the sender before interacting with email.
To start, we need to create a sending profile.
In Gophish, you can create one by navigating
to the "Sending Profiles" page and clicking "New Profile."
Let's say we have a virtual machine set up
to listen for inbound email on the IP address,
192.168.56.101
using port 25 for SMTP traffic.
This is where Gophish will send its emails from.
You'll configure the "Host" field as
192.168.56.101:25.
Notice that the port number is essential,
so always remember to include that
after the IP address like this.
For the "From" field, we're using the name Boyd Jenius
with the email address bjenius@morningcatch.ph.
This makes the phishing email look like it's coming
from an internal and trusted source.
By doing this, we can test how many employees trust emails
based solely on the sender's address
without further scrutiny.
So, the final report might look something like this:
so, we have the Name,
it's going to be Morning Catch,
Interface Type: SMTP,
From: Boyd Jenius,
then we have the email address, the Host,
and they're going to have the IP address
that we listed earlier.
After filling in these details, you have the option
to test the sending profile by clicking "Send Test Email."
This feature allows you to ensure the configuration works
before launching the campaign.
Once the test is successful, just save the profile.
It's that easy.
In a real phishing campaign,
using a well-crafted sending profile
is critical for success.
Attackers often spoof email addresses
or set up legitimate-looking domains
to fool users into thinking the email is trustworthy.
As pen testers, replicating these tactics can help reveal
how employees handle suspicious looking emails
even when they seem to come from a trusted source.
So, in this example,
we're using Gophish to simulate an email
that seems like a routine internal message
from the system administrator, Boyd Jenius.
The email could ask users
to verify their logging credentials
or provide a link to a fake internal portal,
testing whether employees are cautious
about interacting with these kind of requests.
Remember, the goal is to evaluate
the organization's security awareness
and identify users who might need more training
on recognizing phishing attempts.
Gophish makes it easy to track who opens the email,
clicks the links,
and submits any credentials on the fake login page.
In terms of reporting, Gophish provides detailed dashboards
and reports that show the overall success of your campaign.
You can see how many emails were delivered, opened, clicked,
and how many users fell for the phishing attempt.
This data is essential
when delivering findings to your client,
as it gives a clear picture
of the organization's security posture
regarding phishing attacks.
One of the great things about Gophish is its flexibility.
You can integrate it with other tools like BeEF,
or the Browser Exploitation Framework,
to further exploit any vulnerabilities you find
during a phishing campaign.
For example, if a user clicks on a link,
you can use BeEF to inject malicious code
into their browser,
demonstrating just how dangerous phishing attacks
can be if successful.
So remember, Gophish is a tool
for running phishing simulations that tests
an organization security awareness.
It's easy to set up, customize and deploy,
and it gives you valuable data
about how users respond to phishing attacks.
By using Gophish in your penetration test,
you can help organizations strengthen their defenses
against one of the most common attack vectors: phishing.