gophish / gophish Goto Github PK

View Code? Open in Web Editor NEW

10.7K 352.0 2.0K 53.81 MB

Open-Source Phishing Toolkit

Home Page: https://getgophish.com

License: Other

Go 61.53% JavaScript 25.46% HTML 11.93% Dockerfile 0.18% Shell 0.51% Jinja 0.40%

gophish phishing golang security

gophish's Introduction

Gophish

Gophish: Open-Source Phishing Toolkit

Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.

Install

Installation of Gophish is dead-simple - just download and extract the zip containing the release for your system, and run the binary. Gophish has binary releases for Windows, Mac, and Linux platforms.

Building From Source

If you are building from source, please note that Gophish requires Go v1.10 or above!

To build Gophish from source, simply run git clone https://github.com/gophish/gophish.git and cd into the project source directory. Then, run go build. After this, you should have a binary called gophish in the current directory.

Docker

You can also use Gophish via the official Docker container here.

Setup

After running the Gophish binary, open an Internet browser to https://localhost:3333 and login with the default username and password listed in the log output. e.g.

time="2020-07-29T01:24:08Z" level=info msg="Please login with the username admin and the password 4304d5255378177d"

Releases of Gophish prior to v0.10.1 have a default username of admin and password of gophish.

Documentation

Documentation can be found on our site. Find something missing? Let us know by filing an issue!

Issues

Find a bug? Want more features? Find something missing in the documentation? Let us know! Please don't hesitate to file an issue and we'll get right on it.

License

Gophish - Open-Source Phishing Framework

The MIT License (MIT)

Copyright (c) 2013 - 2020 Jordan Wright

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software ("Gophish Community Edition") and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

gophish's People

Contributors

Stargazers

Watchers

Forkers

lombardoja armuk toannn armeo ksmaheshkumar vaginessa leochencipher technotronicoz minidora bilicc wanyisunflower freeak-tux dipsec harrifeng zubux guardianrg diegslva caoimhinp 666jfox777 dot-sean gitter-badger chubbymaggie scharsey snowytoxa huangyan9188 n0x00 mubix jacknm shinsec intfrr nothrowforwardit clebeer mausvargas zhuyue1314 notrust troyxmccall team-firebugs lucabongiorni akamajoris sounil tamiral 0x90n jmartiuk5 arschlochnop duyet 4n6strider luxame jdpenuliar kakkartushar1 peteritvina phulc ana2s007 kevinmel2000 solidstorm cotspheer jonathanmcc rehacktive votrongdao ardha2008 rohythakur joyhuang-ctftool miauwuffmiau wnp cloudxtreme openube kondors1995 ligadous notnightwing sir-njure dugdathug x86labs rewtd alihalabyah samyoyo karzsghr amanaksu xtech9 pluckljn seif-allaya mickelsonm djgrasss hgrantham m3mojax emadshanab qardeneden jgohil07 blowfishj m7013 quangpham fatihccoskun captheflag yeyintminthuhtut thearchiver caoyu0 lfleal amlwwalker go-spider jameskumar surjit pitoukhmer

gophish's Issues

Consider Switching from Highcharts to D3.js

To avoid possible licensing issues in the case of a "pro" or "hosted" version in the future.

Better Go+AngularJS Separation

Currently, templates are rendered on the Golang side, with no AngularJS routing/templating. It might be cleaner to further separate the architecture into a strict AngularJS frontend and a Golang backend (API). This would minimize the Golang handlers needed for basic frontend work.

Will need to work around authentication!

Clean up Angular Resource/Validation Architecture

Currently, the code architecture for $resource handling and validation is pretty messy and scattered around, with some logic in modals, and some login in the root scope.

I'd like to clean this up to have all the logic in the modals (since that's where changes are staged and validated), with the returned result being the already validated object.

Example (as it is now)

// In main controller
$scope.saveTemplate = function(template) {
        var newTemplate = new TemplateService(template);
        if ($scope.newTemplate) {
            newTemplate.$save({}, function() {
                $scope.templates.push(newTemplate);
                $scope.mainTableParams.reload()
                return ""
            }, function(error){
              console.log(error.data)
              return error.data.message
            });
        } else {
            newTemplate.$update({
                id: newTemplate.id
            })
        }
        $scope.template = {
            name: '',
            html: '',
            text: '',
        };
    }

// In modal controller
$scope.ok = function(template) {
        message = $scope.saveTemplate(template)
        if (message == "") {
          $modalInstance.close();
        } else {
          $scope.errorFlash(message)
        }
    };

This is messy, unreadable, and unreliable.

Add "Position" Attribute to Target

The ability to use a target's employment position would be pretty standard practice in phishing campaigns.

This should be added as a standard attribute for the Target model.

Make Flashes Consistent

To make the UX consistent, the app should have meaningful error flashes (in the modal!) when invalid input is submitted, as well as success flashes (on the main page) when input is valid.

Missing flashes for:

templates
users & groups
etc.

Add Map for Successful Phish Results

For each IP that opens the email or clicks the link, we should add a bubble on a geomap.

Add Tracking Images to Email Templates

Knowing when a user opens a phishing email would be a huge addition to test metrics. This can be done a couple of ways:

Adding an image in the email with a source of phishing_server/track.png?id={{.Id}}
Adding an image in the email with a source of {{.Url}}/full/url/event/track?id={{.Id}}

Move <base> tag right after <head>, not before </head>

As it stands, since we are inserting the <base> tag immediately before the </head> closing tag, we lose the base on any previous relative resource links.

By placing this right after the opening <head> tag, we can fix this.

Refactor API Docs

The API docs suck. That's not ok.

I have some ideas to update the docs to be cleaner and more comprehensive. It'll involve getting rid of Swagger, which has positives and downsides. I'll keep this issue open to keep track of progress.

Add IP Address Field to ```models.Result```

When a user clicks a phishing link, it would be ideal to have the IP address stored in models.Result record for geoip lookups later.

Clean up controllers.js

Currently, controllers.js is approx. 1k lines long. I'd like to break this up into manageable chunks, perhaps making a controllers/ directory with a file for each resource type/page.

Add SSL Support

Would be nice to add automatic SSL cert generation (self-signed) and make a config option to run the webserver via HTTPS.

API Returns 400 When Hitting a URL That Ends Without a Slash

The API returns a 400 when hitting POST /api/campaigns

Add Tracking Button on Email Template Modal

It would be nice to have a "Add Tracker" button on the email template modal that adds the {{.Tracker}} to the template.

Allow Template Values in Email Subject

Currently, we can use template values in the HTML and email Text fields, but are not able to put template values in the subject.

Can't Save Edited Pages

Currently, editing a page doesn't work with the following message:

Uncaught TypeError: Cannot read property 'id' of undefined

I believe this is due to not setting the save(idx) onclick event correctly.

Can't Add Files to Existing Template

If a template is created without files, a NullPointerException error is thrown in JS when trying to edit the template and add new files to it.

Integrate CKEditor Template Functionality

CKEditor has plugins that allow us to make custom buttons that insert templates into the HTML. It would be handy to have buttons that easily insert integration into things like beef, metasploit, etc. as well as automatically inserting login forms, or links to the phishing url.

Import Email From IMAP

It would be a neat feature to be able to connect to a users email (given credentials) to automatically import a template from their mailbox.

That would make it easier then "View Source" from the email.

Implement "Email Opened" status

Currently, we fire an event when an email is opened (using a {{.Tracker}}), but we don't actually set the status of the campaign.Result object to Email Opened.

Provide Raw SMTP Log

This might not be possible due to the lack of visibility from TLS, but it would be a nice addition if the client could view the full SMTP transaction performed to send the mail to the target.

Import Email From Source

The ability to copy/paste original email "source" into a modal which is then parsed into a template would make creating templates much easier.

Additional features, such as tracking removal, automatically changing links, etc. could be added in the future.

Repeating attachments when opening template modal

There are conditions that cause attachments to be repeated when opening/closing the template edit modal. Need to track down and fix.

Site Clone

When creating a landing page, I'd like the ability to clone a site automatically. This would be an endpoint that takes in a URL and returns the HTML for the page. This would be put in the scope.page model to be easily saved.

Maybe also consider resolving external CSS, JS, etc.?

Implement API Paging

With a test use case of approx. 15,000 targets, the frontend is a bit sluggish.

I believe this can be fixed by implementing API pagination, making all requests asynchronous, etc.

Change dot color on campaign results timeline according to event

The timeline is currently just a bunch of blue dots. I recommend having the following colors:

Grey - Error
Yellow/Orange - Email Opened
Red - Email Clicked

Error where CKEditor strips inline css styles on link edit

Currently, it looks like CKEditor will strip inline css styles on an <a> tag when the link is edited.

I have opened a ticket with the CKEditor team to get this resolved.

Add Zooming Capability in Timelines

To mimic the functionality had in Highcharts, it would be nice to implement zooming in timelines (line charts) in Chartist.js.

This will likely be an upstream patch to the original project.

Add gzip support

Would be nice to add gzip support as a middleware HTTP handler.

Integrate "Team" Functionality

Some companies (specifically pentesting companies) would like to group gophish users by teams.

This might be a "pro" or paid feature. We'll see 😄

Add Dependency Handling

Right now, the golang dependencies aren't maintained. This may cause issues if users go get the package and the dependencies have been updated.

Recommended to use the 1.5 vendor experiment or godeps.

Ability to Schedule Campaigns

The ability to setup and schedule campaign in advance would add some pretty solid benefits automated campaign generation.

This might require a db schema update, so I'll probably put this at 0.2.

Default Payloads

It would be beneficial to have some default payloads for phishing emails. Things like basic word docs with macros enabled, etc.

Phishing server use 80 port may need root

I tried go run gophish.go, and it's always closing immediately.

I found it might because the 80 port need root, however root may have different GOPATH.

Add Default Templates & Landing Pages

It would be nice to have a nice set of default (non-copyright infringing!) templates and landing pages.

Autocomplete on Template Variables

When filling out a template, we shouldn't assume the user knows all the template variables that are possible.

It would be user friendly to have an "autocomplete" feature that can show what variables are available.

GUI Doesn't Support First/Last Name Import of Targets

The /api/import/group endpoint allows for importing a CSV containing First Name, Last Name, etc.

Unfortunately, when the targets are sent back by the API endpoint after parsing the CSV, the names are ignored.

Fix Autocomplete on Modal Typeahead

Need to fix the issue where when the user pressed "tab" to autocomplete a typeahead selection, the input is filled with the JSON representation of the entire object.

Looks like the root cause is that we need to bind our autocomplete function to the typeahead:autocomplete event for each typeahead object.

Remove AngularJS in favor of straight JQuery

I'm starting to lean towards the idea that I don't need AngularJS. I'm not using the data-binding as much as I thought I would, and the entire thing is a fairly hacky implementation right now.

Angular is nice, but I think it might be cleaner if I migrate everything to vanilla JQuery.

Allow Users to Specify Landing Page to Use in Campaign

This is related to #37, but involves the front-end work of actually setting the Landing page on the campaign modal.

Custom Template Values

Right now, only a few template values are supported. This issue is to implement the ability for users to create their own template values on the fly.

Implement {{.From}} Template Value

This value should be the "Name" part of the SMTP From line, with a fallback to the email if the name is blank.

Error Updating Target Information

Right now, editing groups (PUT /api/groups/:id) is implemented by iterating through the given targets to see if they exist in the group. If not, they are created. If there are targets in the group that are not given, they are created.

This does not allow us to actually edit the target details, which is a bug.

There are two implementations I can see happening:

Using jinzhu/gorm to handle the many-2-many relationship (new feature added recently)
Do a naive delete all / insert all operation. Might be a bit more IO, but would make it simple.