Gophish
Open-source phishing simulation framework with a web UI and JSON API for building, sending, and tracking campaigns with detailed analytics.
Technical Architecture & Overview
Gophish is an open-source phishing simulation framework written in Go. It provides a web interface and a JSON API for building, sending, and tracking simulated phishing campaigns, with reporting on user opens, clicks, and credential submissions. The project was created by Jordan Wright; its most recent release, v0.12.1, was published in September 2022.
Targeted Technical Use Cases
Organizations that want a self-hosted phishing simulation and security awareness measurement platform with API automation and detailed campaign analytics.
Evaluation & Trade-offs
Core Strengths
- +Pre-built binaries are available for Windows, macOS, and Linux with a straightforward setup process.
- +The JSON API supports automation of campaign creation, reporting, and integration with other tools.
- +Established open-source project with official documentation and a Docker image.
Trade-Offs & Limitations
- -Outgoing messages carry transparency headers (X-Mailer, and X-Gophish-Contact when a contact address is set) that email security controls can match.
- -User management offers two roles, user and admin.
Defensive Security Application
Measure employee susceptibility to phishing and generate metrics that inform awareness training priorities.
Frequently Asked Questions
What is Gophish?→
Gophish is an open-source phishing simulation framework written in Go. It provides a web interface and a JSON API for building, sending, and tracking simulated phishing campaigns, with reporting on user opens, clicks, and credential submissions. The project was created by Jordan Wright; its most recent release, v0.12.1, was published in September 2022.
What is Gophish used for?→
Organizations that want a self-hosted phishing simulation and security awareness measurement platform with API automation and detailed campaign analytics.
What are the strengths of Gophish?→
- +Pre-built binaries are available for Windows, macOS, and Linux with a straightforward setup process.
- +The JSON API supports automation of campaign creation, reporting, and integration with other tools.
- +Established open-source project with official documentation and a Docker image.
What are the limitations of Gophish?→
- +Outgoing messages carry transparency headers (X-Mailer, and X-Gophish-Contact when a contact address is set) that email security controls can match.
- +User management offers two roles, user and admin.
How is Gophish used defensively?→
Measure employee susceptibility to phishing and generate metrics that inform awareness training priorities.