Tutorial Demonstrates Gophish Phishing Simulation and Credential Capture

Summary

The tutorial configures Gophish to send a phishing simulation, use a cloned Gmail login page, and record link clicks and credentials entered by a test recipient.

Key points

The walkthrough configures Gophish with an email sending profile using Gmail SMTP.
It creates a landing page by copying a Gmail login template from the Social-Engineer Toolkit and enables capture of submitted data and passwords.
The email template is configured to direct links to the landing page and track email opens.
A target recipient is added, and a campaign is launched to demonstrate email delivery, link clicks, and submitted credentials.
The demonstration presents credential capture in a phishing simulation; it does not report a real-world incident.

Article Details

Topics: [00:13] Gophish setup and administrative login
[01:46] Configuring the email sending profile
[04:28] Creating a cloned login landing page
[05:53] Building and tracking the phishing email
[07:23] Adding targets and launching the campaign
[09:00] Reviewing clicks and captured credentials

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe cloned web login page is configured to capture credentials submitted by the simulated recipient.

Summary

Key points

Article Details

MITRE ATT&CK

Related Articles