In this demo,
we're going to use Gophish to prepare for a phishing
campaign using a malicious link that navigates to our own
page and captures entered credentials.
We'll start by using Gophish to create the phishing email and then
configure a landing page for your malicious link.
These steps are needed to successfully execute a
malicious link campaign using Gophish.
If you're ready to get started, let's head over to the Gophish admin page.
We will start by configuring a sending profile for our emails.
We can access this page clicking the Sending Profiles link.
Then, we'll go to New Profile.
The sending profile determines how the email looks to the recipient,
with the sending address being in the From field of the email. The
Morning Catch VM has two accounts, Boyd Jenius,
the system administrator, and Richard Bourne, the CEO.
Normally,
you would use information gathering and open‑source intelligence,
or OSINT techniques, to find this information.
Since we already have the email addresses,
we'll just enter them from here. For this campaign, we'll be targeting
the CEO and send the email impersonating the IT staff.
So our sending address will be Boyd Jenius. Before
we enter any more information, we'll start with the sending profile name.
We'll call this one Morning Catch IT Staff. Our sending address,
what'll show up in the From field, will be Boyd Jenius with an
email address of bjenius@morningcatch.ph.
We also need to configure the server address that we'll send email
to. An easy way to find this in your environment without logging into
the server is to use nmap and scan for an open port 25 for SMTP. And
there's our Morning Catch VM.
In my case, the IP address is 192.168.178.64.
So, we need to put that address in the Host field, followed by port 25.
We won't need a username and password for this profile.
We can leave Ignore Certificate Errors checked, and we
won't require any custom headers. So we can safely say
this profile, and it's all set.
The next step we have to take is to add some users and groups.
We can do this by navigating to this page and selecting New Group.
We'll call this group Morning Catch Executives.
We have two options for adding the users.
One is to add them individually.
The other is to do a bulk import using a CSV file.
Now since we only have one user,
it's actually more work for us to create a CSV file and then bulk import it.
But I want to go through this exercise just to show you how it's done.
So, we'll start by creating that CSV file.
I've called this file executives.csv. We first need the appropriate headings,
which are First Name, Last Name,
Position, and Email. And this information is Richard, Bourne, CEO,
and his email is rbourne@morningcatch.ph.
Now we just save that file and exit, and we're ready to import it. So we'll
go to Bulk Import Users, scroll down and select the executives.csv file and
click Open, and we have our user imported, Richard Bourne,
rbourne@morningcatch.ph, and a position of CEO.
So now we can save those changes, and our Morning Catch Executives group is set.
Now we have to configure a landing page.
The landing page is what we're going to have our link direct the user to.
This is where we'll try to capture credentials.
In this scenario,
we're going to try to capture Richard Bourne's credentials
in a false website that we're hosting.
We need to make it look close to what he's used to seeing.
Luckily for us, under the landing pages and New Page button,
you'll see this option to import a site from an already existing one.
Now,
companies often support the use of webmail services to enable their
remote workers to log in from their personal computers and read
company emails while they're outside of work. We can check for
potential webmail services in a few ways.
In this case,
we're going to use nmap to run a scan of the email server
and see if ports 80 or 443 are open.
I'm going to add a script to this to enumerate HTTP directories if those
ports are found open. And that scan has returned an open port 80, and we
can see the HTTP directories were enumerated,
including this mail directory,
which probably contains our webmail login page. To confirm that,
let's go ahead and open that website using our web browser. And we have a
webmail login page for Morning Catch's corporate email.
Let's go ahead and import that site into Gophish as it seems ideal to
capture Richard Bourne's credentials. So go to Import Site and type
that same address. And we have our login,
but we're missing a few images.
Let's see if we can't at least copy that image of the fish over.
Great, although it doesn't support the same styling,
it does look a little bit more legitimate,
at least using their same logo.
You'll see in a minute when we create our email that we're
going to try to explain to Richard Bourne why it might
look a little bit different.
But for now,
we'll go ahead and call this page Webmail, and then we
have a few last buttons to click.
One is to capture submitted data,
and we're going to go ahead and capture passwords.
Now take a look at this warning before you select
this in a real‑world environment, passwords are stored not encrypted by Gophish.
So if you're not authorized to capture unencrypted passwords,
do not select this option. Now, a hacker is not going to care about that.
So for our purposes,
we're going to see how this works and show you how you can capture
clear text usernames and passwords using these methods.
Now we have another option here to redirect the user to
a particular page. And in this case,
we're going to redirect them back to that webmail page.
Now once the user fills out the information that we
want and we capture their credentials,
they'll be redirected back to the same login page.
Okay, our landing page is set up.
So now we have our sending profile, target addresses, and
landing page ready for that campaign.
The last step we need to take is to create the email template,
and we'll continue on from that point in the next demo.