Gophish: The Open-Source Free Enterprise Phishing...

Gophish Core Features & Advantages

Gophish is a free, open-source phishing simulation framework that allows security teams to create, send, and track phishing email campaigns. Its intuitive web management interface enables users to:

• Create phishing email templates: Supports an HTML editor for highly customizable email content, using variables like {{.FirstName}} and {{.URL}} to make emails more convincing
• Design landing pages: Create fake login pages to test whether employees submit credentials or perform specific actions; supports the Import Site feature to copy the appearance of existing websites directly
• Manage target groups: Batch import employee lists via CSV, and segment groups for different phishing campaign tests
• Send & track in real-time: Schedule phishing email delivery, monitor open rates, click rates, and credential submission rates in real time, and generate detailed reports
• Highly secure & flexible: Can be deployed on internal enterprise servers, ensuring employee data and test results are not exposed externally

Gophish Installation Guide

Gophish provides pre-compiled executables requiring no complex environment setup. Visit the Gophish GitHub Releases page to download the latest ZIP archive.

Linux Installation Steps

# Extract (replace with your downloaded version number)
unzip -d gophish gophish-v0.12.1-linux-64bit.zip
cd gophish

# Grant execute permissions
chmod +x gophish

# Start Gophish
sudo ./gophish

⚠️ Important: config.json Configuration (Required Before Production Deployment)

Gophish's root directory contains config.json. Before production deployment, adjust these key settings:

{
  "admin_server": {
    "listen_url": "127.0.0.1:3333",  // Admin panel: recommended to keep localhost-only
    "use_tls": true,                  // Recommended to enable TLS (requires certificate)
    "cert_path": "gophish_admin.crt",
    "key_path": "gophish_admin.key"
  },
  "phish_server": {
    "listen_url": "0.0.0.0:80",      // Phishing server: listen externally on 80 or 443
    "use_tls": false,
    "cert_path": "example.crt",
    "key_path": "example.key"
  }
}

Important security note: The admin panel (port 3333) is bound to 127.0.0.1 by default. If deploying Gophish on a remote VPS, do NOT change admin_server.listen_url to 0.0.0.0:3333 (direct public exposure). The correct approach is to access the admin panel via SSH tunnel:

# Create SSH tunnel forwarding local port 3333 to remote VPS 127.0.0.1:3333
ssh -L 3333:127.0.0.1:3333 your_user@your_vps_ip

# After creating the tunnel, open admin panel in local browser
# Note: defaults to HTTP (not HTTPS) unless TLS is enabled in config.json
http://127.0.0.1:3333

Logging Into the Admin Interface

1. After the program starts, immediately check the terminal output. The system displays a one-time random admin password in the logs:

   time="..." level=info msg="Please login with the username admin and the password 4r7Xk2mP9qLw"

   This password is only shown once — copy it immediately. If you miss it, restart Gophish to regenerate it, or pre-set the environment variable GOPHISH_INITIAL_ADMIN_PASSWORD (useful for automated deployments).
2. Open a browser and go to http://127.0.0.1:3333 (or via SSH tunnel)
3. Log in with username admin and the random password shown in the terminal
4. On first login, you will be forced to set a new password

Version note: The random password generation mechanism applies to v0.10.1 and later. For v0.10.1 and earlier, the default credentials are admin / gophish — change them immediately after deployment.

Gophish Hands-On Usage Guide

To run a complete phishing simulation exercise (Campaign), complete the following five setup steps in order from the left menu:

1. Sending Profiles (Configure Mail Server)

Set up the SMTP server information for sending phishing emails. You can integrate with an internal test mail server or a third-party email service. After setup, click "Send Test Email" to verify the connection.

2. Users & Groups (Create Target Groups)

Click "New Group" and upload a CSV file to batch import test employee lists. CSV fields typically include First Name, Last Name, and Email.

3. Landing Pages (Design Landing Page)

Design the fake webpage that victims see after clicking the email link:

• Use the Import Site feature to paste an existing website URL (e.g., Microsoft login page); the system will automatically copy the page's appearance
• Check Capture Submitted Data to record form submissions; Capture Passwords records plaintext passwords (in practice, most enterprises only track clicks and submissions for privacy reasons — recording plaintext passwords is not recommended)

4. Email Templates (Write Email Template)

Use the HTML editor to write phishing emails. Gophish supports these important variables:

• {{.FirstName}}, {{.LastName}}: Automatically fills in recipient names for added authenticity
• {{.URL}}: Required — the system automatically replaces this with the Landing Page's tracking URL (including a unique identification token)
• {{.Tracker}}: Embeds a hidden 1x1 tracking pixel to detect email opens (even if the user doesn't click any link)

5. Campaigns (Launch Exercise)

Combine all previously configured elements:

• Name: Name this exercise (e.g., 2026 Q1 Phishing Test)
• Email Template & Landing Page: Select the created template and page
• URL: Enter the Gophish phishing server's external IP or domain (the base URL that {{.URL}} expands to), pointing to the phishing server (port 80/443), not the admin panel (port 3333)
• Select the corresponding Sending Profile and Groups
• Click Launch to send immediately, or use the scheduling feature to specify a send time

After the campaign launches, monitor all employees' open rates, click rates, and credential submission rates in real time on the dashboard, and generate reports to arrange corresponding security awareness training.