In this demo, we're going to get started with Gophish.
We'll start with a quick overview of the lab I'm using in
this course and different options you can use to create a
suitable environment to test Gophish.
Once we cover the lab environment,
we'll obtain Gophish and started on our hacking workstation.
We'll then access the Web interface and explore the
different menus and options that we'll use in this course
to create our phishing campaigns.
If you're ready to get started, let's head over to the lab for the overview.
Instead of setting up a full Windows lab with a domain
and email services for this course,
I opted instead to keep it simple and use the Morning Catch virtual machine.
The Morning Catch virtual machine is a full environment
already set up with two accounts configured to receive emails
sent to the morningcatch.ph domain.
We'll be able to use Thunderbird to check our emails sent to this domain.
We'll be attacking from a Kali Linux machine where
we'll install Gophish shortly.
You can download the Morning Catch virtual machine from a
link I'll include in the demo files.
It requires no real additional setup.
You just have to import it into VMware Workstation or
VMware Player in order to use it.
Now that we covered the lab setup, we're ready to download and install Gophish.
I'm going to run Gophish on this Kali Linux VM,
which will also host the malicious page used in the first scenario.
Gophish has two prerequisites we need to install,
the Go programming language and GCC.
We'll start with GCC.
As you can see here, I already installed it,
and it's running the newest version.
But if you haven't, this is the command that you'll need.
Next, we need to install the Go programming language.
For our first step, we're going to go ahead and download it from the website.
You can find the Go programming language at this address,
golang.org/dl, and we're going to need the Linux version.
And once that downloads, we just need to extract the file.
And to do that,
we're just going to use this command and extract it to the user/local directory.
Once it's extracted,
we need to set up a Go workspace and change a few GOPATH
environment variables within bashrc.
For my Go workspace,
I'm just going to create a directory in my home
directory called to go‑workspace.
And then once we've created that workspace, we'll go ahead and edit bashrc.
So to do that, we're just going to add a few commands to the end of this file.
The first,
we're going to set the GOPATH to that Go workspace using
export GOPATH=/home/kali/go‑workspace.
For the next variable,
we're going to set the GOROOT to our user/local/go folder
where we extracted the files we downloaded.
Now we just need to set the path, and then we save that and exit.
Now we just reload bashrc using this command.
You can test to see that your Go language was
installed correctly by just typing go.
And if it was successful,
you should come up with some information about the Go tool.
We can use this go command to download Gophish directly into our GOPATH.
To do that, wel'll type go get github.com/gophish/gophish, and
we'll come back when that finishes downloading.
And once that's finished,
we'll just navigate to that directory where it downloaded.
And once we're in that directory, we just execute the command go build.
Once that command is done,
it will create a gophish binary in the same directory. To run it, we just
need to type sudo ./gophish, and we'll see that it starts the admin server
at our localhost IP address on port 3333.
So let's use our browser to navigate to that.
You'll see in the logs it has the username admin,
and it generates a password for you.
We'll just copy this password and paste it in,
and then we'll have to reset it to a new password.
So I'm going to go ahead and do that, and then I'll come back.
Once you reset your password,
you should arrive at this dashboard. Within here, you'll see different menus
off to the left, from the campaigns that we'll set up later, landing pages if
we want to create them for users to land on from malicious links we send, a
page for creating email templates,
groups and users, different sending profiles, and account settings
if we want to change our password, change the way our results
display, and change reporting settings.
Once you reach this point, you're ready for the rest of this course.
We will be using gophish to attack our example domain.
But before we get into that,
let's do a quick overview of what we learned so far in this course.
In this demo,
we started out by going over the lab overview I'm using
that we'll be exploiting using gophish.
We also downloaded and installed the prerequisites GCC and the Go
programming language to our Kali Linux machine.
Finally,
we downloaded, installed, and ran Gophish and then accessed
our admin dashboard through the web browser.