<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-phishing-simulation
description: >-
  Design and execute phishing simulation campaigns with GoPhish. Covers email
  templates, landing pages, credential harvesting, and campaign analytics.
domain: cybersecurity
subdomain: red-team
tags:
  - phishing
  - social-engineering
  - gophish
  - credential-harvesting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001", "T1566.002"]
  tools: ["gophish", "evilginx2", "modlishka"]
---

# Performing Phishing Simulation

## Overview

Phishing simulation tests organizational resilience using GoPhish for campaign
management, email delivery, credential capture, and analytics.

## Prerequisites

- GoPhish server deployed
- Domain with SPF/DKIM/DMARC
- SMTP credentials
- Written authorization

```bash
wget https://github.com/gophish/gophish/releases/latest/download/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip && ./gophish
```

## Key Concepts

### Template Variables

| Variable | Description |
|----------|------------|
| `{{.FirstName}}` | First name |
| `{{.URL}}` | Tracking URL |
| `{{.TrackingURL}}` | Pixel URL |

## Workflow

### Step 1: Configure SMTP Profile

Set up sending profile with verified SMTP server.

### Step 2: Create Landing Page

Import target login page, enable credential capture.

### Step 3: Design Template

```html
Subject: Password Expiration Notice
Dear {{.FirstName}},
Your password expires in 24 hours.
<a href="{{.URL}}">Update Now</a>
<img src="{{.TrackingURL}}" width="1" height="1" />
```

### Step 4: Launch Campaign

Configure campaign with template, landing page, SMTP profile, and target group.

### Step 5: Monitor

```bash
curl -k -H "Authorization: Bearer KEY" https://gophish:3333/api/campaigns/1/results
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| SPF/DKIM failure | Mail gateway | Spoofed domain |
| New domain | Proxy | Recently registered link domain |

```yaml
title: Phishing Landing Page
id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
status: experimental
logsource:
  category: proxy
detection:
  selection:
    cs-uri-stem|contains: '/login.php'
  condition: selection
level: informational
tags:
  - attack.t1566.001
```

## Verification

- [ ] Email delivered to inbox
- [ ] Tracking pixel fires
- [ ] Credentials captured
- [ ] Metrics collected

## References

- [GoPhish](https://getgophish.com/)
- [Evilginx2](https://github.com/kgretzky/evilginx2)
- [MITRE T1566.001](https://attack.mitre.org/techniques/T1566/001/)
