OppressionBreedsResistance/gophish-ng

Image: gophish-ng logo

Gophish-NG

Gophish-NG is a fork of the open-source Gophish phishing toolkit, extended with additional capabilities for red team engagements.

📖 Documentation

Full documentation is published at <https://oppressionbreedsresistance.github.io/gophish-ng/>

| | | |---|---| | Getting started | Installation · VPS Quick Setup · Configuration | | User guide | Campaigns · Email Templates · Attachments · Campaign Results | | Features | Attachment Tracking · Hosted Attachments · IOC Removal · Password-Protected ZIP · QR Code Placeholder · SMS Campaigns (Smishing) · Turnstile Protection |

The sections below are a summary; the documentation site covers each feature in more depth.

Quick Setup (VPS)

For a full production deployment on a fresh Ubuntu/Debian VPS — including nginx reverse proxy, Let's Encrypt TLS certificates, and a systemd service — use the included setup script:

sudo bash setup_vps.sh

The script is interactive and will ask for:

• Number of phishing domains and their names
• Email address for Let's Encrypt notifications

What it does automatically:

1. Installs Go, nginx, and acme.sh
2. Issues ECC TLS certificates via Let's Encrypt (HTTP-01 challenge)
3. Configures nginx as a reverse proxy for each domain → Gophish phish server
4. Clones and builds Gophish-NG from the master branch
5. Writes config.json (admin on 127.0.0.1:3333, phish on 127.0.0.1:5555)
6. Creates a dedicated gophish system user and a systemd service
7. Sets up a daily certificate renewal cron

After setup, access the admin panel via an SSH tunnel:

ssh -L 3333:127.0.0.1:3333 user@<VPS_IP>
# then open https://localhost:3333 in your browser

Default credentials are printed in the service log:

journalctl -u gophish | grep "Please login"

---

Building From Source

Requires Go v1.10 or above.

git clone https://github.com/OppressionBreedsResistance/gophish-ng.git
cd gophish-ng
go build

Setup

Run the binary and open a browser at https://localhost:3333. Login credentials are printed on first run:

time="2020-07-29T01:24:08Z" level=info msg="Please login with the username admin and the password 4304d5255378177d"

Modifications

This fork includes the following changes on top of the upstream Gophish codebase:

Attachment Template Support

Full page: Attachment Template Support

• `.ps1` and `.bat` files — PowerShell and batch script attachments support placeholder substitution ({{.URL}}, {{.FirstName}}, etc.), the same way .txt and .html files do.
• `.pdf` files — PDF attachments also support placeholder substitution. Note: this works only if the placeholder text is stored as plain text in the PDF content stream. PDFs using compressed streams (zlib/deflate) will not be processed correctly and may become corrupted. For best results, export PDFs from tools that do not compress text streams (e.g. Word → Export to PDF with default settings).
• `.zip` files containing text-based payloads — When a .zip archive is used as an attachment, Gophish-NG unpacks it in memory, applies template substitution to every text-based file inside, and repacks it before sending. The same extension list is used for standalone attachments and for files inside an archive, so a payload behaves identically whether or not it is zipped:

| Templated (case-insensitive) | | --- | | .txt .html .htm .ics .ps1 .bat .pdf .js .vbs .hta .xml .rels |

Anything else inside the archive (images, binaries, nested Office documents) is repacked byte-for-byte. Note that substitution is unconditional for the extensions above — a .js payload that legitimately contains {{ will be rejected by the template parser, so escape it or rename the file to an untemplated extension.

• Password-protected `.zip` attachments — ZIP archives encrypted with ZipCrypto are fully supported. Gophish-NG decrypts the archive, applies placeholder substitution, and re-encrypts before sending. The password is stored per-attachment in the database and can be set in the template UI.

How to use password-protected ZIP attachments

1. Create your payload script, e.g. payload.ps1, with any placeholders:

   $url = "{{.URL}}"
   $name = "{{.FirstName}}"

1. Compress it into a password-protected ZIP using ZipCrypto encryption (default in most tools, including 7-Zip without -mem=AES256).
2. In Gophish-NG, go to Email Templates → New/Edit Template and attach the .zip file.
3. A Password field appears in the attachment row — enter the ZIP password there.
4. Save the template. Each recipient will receive a .zip with a personalized .ps1 inside, protected by the same password.

---

QR Code Placeholder

Full page: QR Code Placeholder

Use {{.QR}} in any email template to embed a per-recipient QR code that links to the phishing URL.

• Generated server-side and embedded as an inline image (CID) — no external requests needed.
• Each recipient gets a unique QR code pointing to their personalized phishing URL (with keyname parameter).
• Available in the CKEditor autocomplete dropdown.

Example:

<p>Scan the QR code below to access the document:</p>
{{.QR}}

---

Attachment Click Tracking

Full page: Attachment Click Tracking

A new event type "Clicked Attachment" tracks when a recipient executes the delivered payload.

• The payload should beacon back to `{{.Attachment}}` on execution. The placeholder expands to a per-recipient URL in the form <base URL>/attachment?keyname=<RId>, e.g. http://example.com/attachment?keyname=1234567.
• Gophish-NG records a Clicked Attachment event, visible in the campaign results table and donut chart (purple).
• If the email had not been marked as opened yet, the open event is automatically inferred.
• {{.Attachment}} is available in every templated context — email bodies, landing pages and attachments — and appears in the CKEditor autocomplete dropdown.

Example beacon in PowerShell:

Invoke-WebRequest -Uri "{{.Attachment}}" -UseBasicParsing | Out-Null

Correction: earlier revisions of this README documented the beacon URL as {{.URL}}/attachment?keyname={{.RId}}. That does not work. {{.URL}} is the full phishing URL and already carries the path and the `keyname` query string, so the expression expands to something like http://example.com?keyname=1234567/attachment?keyname=1234567 — the /attachment segment ends up inside the query string, the request is routed to the landing page handler instead of the attachment handler, and the recipient ID no longer resolves. The result is a 404 and no Clicked Attachment event.

Use {{.Attachment}}. If you need to build the URL by hand, the correct form is {{.BaseURL}}/attachment?keyname={{.RId}} — {{.BaseURL}} has the path and query stripped.

---

Hosted Attachments

Full page: Hosted Attachments

When Host Attachment is enabled on a campaign, the attachment is served directly from the phishing server rather than embedded in the email.

• At send time, a personalised copy of the first email template attachment (with all placeholders substituted) is written to static/endpoint/attachments/<campaignId>/<RId>/
• When the recipient clicks the phishing link they are automatically redirected to their unique download URL
• Bypasses email attachment scanners — the file never travels through the mail server
• Works with all supported attachment types including .ps1, .bat, .pdf, and password-protected .zip

---

Cloudflare Turnstile Bot Protection

Full page: Cloudflare Turnstile Bot Protection

Optional bot protection layer that silently verifies every visitor is a real browser before they can access any landing page or hosted attachment.

To enable, add your Cloudflare Turnstile keys to config.json:

"turnstile": {
  "site_key": "YOUR_SITE_KEY",
  "secret_key": "YOUR_SECRET_KEY"
}

Leave both fields empty to disable (default). See the Turnstile docs for full setup instructions.

---

SMS Campaigns (Smishing)

Full page: SMS Campaigns (Smishing)

Run SMS phishing campaigns alongside email. Gophish-NG does not send the texts — it generates a unique tracking link per recipient and exports them to CSV so you can send from your own SMS gateway, while clicks and submitted form data are tracked exactly as in an email campaign.

• Set Campaign Type to SMS (Smishing) when creating a campaign. Only a Landing Page and a URL are required — the email template and sending profile are ignored, and no email is ever sent.
• Add phone numbers to group targets (with country code, e.g. +48500000000); a Phone column is supported in CSV import. An email address is still required per recipient (used for de-duplication).
• On the campaign Results page, use Export → Smishing CSV to download first_name, last_name, email, phone, tracking_url for every recipient.

See the Smishing docs for the full workflow.

---

IOC Removal

Full page: IOC Removal

The following Gophish-specific indicators of compromise have been removed or replaced:

| What | Original value | New value | |------|----------------|-----------| | Email header | X-Gophish-Contact | X-Contact | | Webhook header | X-Gophish-Signature | X-Signature | | Server name / X-Mailer | gophish | (omitted) | | Recipient URL parameter | rid | keyname | | 404 response | Go default | Custom page |

Note: Tracking links use ?keyname=... instead of ?rid=.... Update landing pages and any external tooling accordingly.

---

Campaign Results Enhancements

Full page: Campaign Results Enhancements

• Email Reported — displayed as a status label in the results table when a recipient reports the email, without affecting the sequential event progression.
• Clicked Attachment — displayed as a 5th status level (purple) in both the re