Gophish further!

Sep 16, 2024

This is a follow-up article on the implementation of Gophish software and its alternative set-up.

Hence, an introduction about how Gophish works. Then, how I managed to launch a campaign to phish my teammates(!) as a friendly joke. In the end, we, the teammates from Georgia Tech Institute, conducting the campaign to finish our assignments.

1. What is Gophish?

Gophish is an Open Source Software(source code here). And its user guide is comprehensive.

Q: First of all, what was the motivation of Gophish?

A: To make industry-grade phishing training available to everyone. For example, I myself have received phishing emails from my own institute, and the reason behind, a rehearsal of malicious phishing let’s say, is because my institute wants everyone to have a clear idea about not to click suspicious emails in order not to expose the institute’s data. Think about if you click on the click, not even typing login credentials— — — what might the real malicious person get? Your IP address, your name, the fact that this email exists, and a certain pattern of how this intitute’s allocate email address to an employee’s name matching their email address…etc. Devil lies in the details.

Q: How does it work?

A: In a nutshell, we download the gophish from their github releases and unzip the folder. In my case, I had to type extra code : sudo chmox + x gophish, then run with sudo ./gophish at the folder where the unzipped gophish file locates.

Afterwards, go to the terminal messages and find the login information. There is your first-time login username and password(which you’ll need to change later) : “Please login with the username admin and the password 1178f855283d03d3″

And go to https://127.0.0.1:3333, type in the username and password given, indicated also by the message on terminal. There you’ll see the Gophish page all set-up for you :

At this point, we can start to configure our gophish project!

So, in order to organize a simple project(a “campaign”, so they called), we need to add “Users & Groups”, “Email Templates”, “Landing Pages” in HTML format, “Sending Profiles” — — — this is where SMTP service has to be configured elsewhere by ourselves. gophish doens’t provide SMTP service.

So I used Gmail’s SMTP service, configured as follows:

  1. First, go to “manage your Google Account,”
First, go to “manage your Google Account”

2. Click on “Security”

Click on “Security

3. Click on “2-Step-Verification”

2-Step-Verification

4. Scroll down to the bottom, and click on the bottom right corner’s arrow:

Scroll down to the bottom, and click on the bottom right corner’s arrow

5. Create a new app name, press “Create”, and Google will give you a 16-alphabet password in a format like so: “abcd efgh wzyx”. (So remember to remove the space in between when you copy this password!)

At “Sending Profile”, this is where you will need to paste your password Google just gave you(Again, remember to remove the 3 blank space in between alphabets):

ps. Unfortunately, Gophish doesn’t provide the obfuscated functionality for landing pages in Javascript. It only has HTML format.

With this, I sent out y capricious phishing compaign to my teammates! 🙂

3. Our phishing compaign for the Assignment to phish the TA is way more advanced — — — A mate asks his colleague in Cisco US department if Georgia Tech happens to use Cisco’s technology. And yes, they do. Georgia Institute of Technology’s login portals, and their duo 2FA verification app, are all from Cisco’s ironport, which has the ingreadients of SFP, DKIM and DMARC. Plus, some keywords that should never appear in a phishing email if you don’t want to fail — — — like “click”.

Then we found an annual IT academic event from GaTech, CDAIT, and clone the webpage by using “Ctrl+S”, and added two elements: “_headers” and “_workers.js” plus the ofbuscated Javascript code.

Reason behind is,

“_header” is not completely for safe-browsing evasion.

_worker.js, _header, and your encrypted HTML are all techniques for safe-browsing evasion.

_header prevents crawlers from browsing our webpage, reducing the chance of being discovered by crawlers. Once a crawler finds the page, Google’s mechanism can take action.

_worker.js also reduces the chance of being discovered. Crawlers generally only browse the main page, so if it encounters a 404 error, they usually give up.

When we browse a webpage, sometimes Google sends a second request. The v={code} should have originally been a “one-time code,” so when Google sends the second request, it will also encounter a 404 error.

Therefore, the key is _worker.js. The index.js has been replaced by _worker.js.

Finally, your encrypted HTML is enough to prevent the client-side safe browsing mechanism.

For clarity, here are the codes:

  1. _headers
https://ga.tech-cdait.uk/*
X-Robots-Tag: noindex, nofollow
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0

https://fish-testing.pages.dev/*
X-Robots-Tag: noindex, nofollow
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0

2. _worker.js

export default {
async fetch(request, env) {
const url = new URL(request.url);

const pathname = url.pathname;

// Allow access to the /cdait directory
if (pathname.startsWith('/cdait')) {
return env.ASSETS.fetch(request);
}

// Check if the pathname starts with '/login'
if (url.pathname.startsWith('/login')) {
// Check if the query parameter 'v' exists and has exactly 8 alphanumeric characters
const vParam = url.searchParams.get('v');
const isValid = /^[a-zA-Z0-9]{8}$/.test(vParam);

if (isValid) {
// If valid, serve the static page
return env.ASSETS.fetch(request);
} else {
// If the 'v' parameter is invalid, return 400 Bad Request
return new Response('Bad Request', {
headers: { 'content-type': 'text/html' },
status: 400
});
}
}

// Otherwise, return 404 for all other paths
return new Response('Page not found', {
headers: { 'content-type': 'text/html' },
status: 404
});
}
}

3. index.html

Published by StasyHsieh

A physicist by training, I’ve traversed seven countries, shaping my path through Cybersecurity, AI, and Astrophysics, while nurturing a deep passion for art, writing, and societal change. I advocate for inclusivity in STEM and explore the intersections of equality, economics, and the evolving digital world. My work—whether in technology or the arts—seeks to provoke thought and inspire change. Let’s connect and explore the dance between innovation and humanity.

Leave a comment