Hello. I'm Matt Glass, and welcome to this course on Initial Access with Gophish.
In this course,
I'll show you how to use Gophish to create phishing emails
designed to convince users to click on malicious links or
attachments and give you access to their machine.
But first, let's look at what Gophish is and how it's used.
Gophish was created by Jordan Wright.
According to his documentation,
it's an open‑source phishing toolkit that businesses and penetration testers
can use to quickly set up and execute phishing campaigns.
It was designed to work with minimal system configuration
and includes an easy‑to‑use web interface.
Gophish was specifically designed for legitimate users to
test an organization's security awareness.
It can be downloaded from either their website,
getgophish.com, or their GitHub page.
What makes Gophish such a useful tool for phishing is its
simplicity in both installation and operation.
On the kill chain, Gophish falls under the exploit phase only.
It is primarily used to either obtain user credentials or
trick users into executing and exploit that enables your
initial access to the system.
All of these actions are done through phishing
campaigns you design within the tool.
The ATT&CK knowledge base, developed by MITRE,
categorizes adversary tactics and techniques into multiple
categories to describe the adversary's behavior.
The tactics are categories that cover different phases of an
attack and allow defensive teams to model an adversary's actions
and improve the defense of their networks.
We will cover one primary tactic with two sub‑tactics in this course.
The primary tactic is phishing,
which has two sub‑topics we'll cover, spearphishing
attachment and spearphishing link.
Gophish can accomplish this by enabling adversaries to create
phishing campaigns to trick users into granting access.
We'll look at two possible phishing scenarios in this
course. If an attacker wanted to take control of devices on
Globomantics' network depicted here,
one option they have is to use Gophish to generate a phishing email containing a
link to a website they host from the attacking workstation.
The attacker then sends the malicious link to the target victim,
which, when accessed, directs the target back to the attacker's page.
The page either contains a payload that is executed when the page
loads or captures entered credentials and allows the attacker to
obtain access to the victim's machine.
In this case,
the attacker has taken control of HR's machine and from there can escalate
permissions or laterally move throughout the rest of the network.
Another scenario involves an attacker sending a phishing
email with a malicious attachment.
The attacker sends the malicious attachment, which when opened
exploits a vulnerability in the target application and enables
access to the victim's machine.
As with the previous scenario, from here the
attacker can run additional attacks,
escalate permissions, or latterly moved to other
devices within the same network.