Phishing Simulations with GoPhish

Phishing remains the single most common entry point for breaches, and no amount of firewall tuning fixes a user who clicks the wrong link. That is why phishing simulation programs have become a core part of any mature security awareness strategy. GoPhish, an open source phishing framework written in Go, has become one of the most widely used tools for building these simulations because it is fast, scriptable, and flexible enough to mimic real attacker behavior.

This guide walks through setting up GoPhish, designing believable campaigns, tracking results, and using the data to actually improve your organization's resilience, not just generate a report nobody reads.

What Is GoPhish and Why Security Teams Use It

GoPhish is a self-hosted phishing toolkit that lets you build sending profiles, landing pages, email templates, and target groups, then launch trackable campaigns against your own users. Unlike commercial platforms with rigid templates, GoPhish exposes a REST API and a straightforward web UI, which makes it a favorite for internal security teams and consultancies running authorized social engineering assessments.

At SageFox Cybersecurity, phishing simulations are one of the most requested engagements we run for clients who want to measure human risk alongside their technical attack surface. If you are building this capability internally, www.sagefoxusa.com has additional resources on structuring a full security awareness program around these tests.

Core Components of a GoPhish Campaign

Every campaign in GoPhish is built from four pieces:

• Sending Profiles: the SMTP configuration used to deliver mail
• Landing Pages: the page a user sees after clicking a link
• Email Templates: the actual phishing lure
• Groups: the list of target users and their metadata

Understanding how these pieces interact is critical before you launch anything against real employees.

Setting Up GoPhish in a Lab or Production Environment

Installing GoPhish on Linux

GoPhish ships as a compiled binary, which keeps the install process minimal. On a hardened Ubuntu server:

bash

sudo apt update && sudo apt install -y unzip golang-go
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip -d /opt/gophish
cd /opt/gophish
chmod +x gophish

By default, GoPhish binds its admin interface to 127.0.0.1:3333. For remote administration, edit config.json to bind to your management interface, but always place the admin panel behind a VPN or SSH tunnel rather than exposing it publicly.

json

{
 "admin_server": {
   "listen_url": "0.0.0.0:3333",
   "use_tls": true,
   "cert_path": "gophish_admin.crt",
   "key_path": "gophish_admin.key"
 },
 "phish_server": {
   "listen_url": "0.0.0.0:80",
   "use_tls": false
 }
}

Hardening the Admin Panel

Never leave the default self-signed certificate or default admin credentials in place. Generate a proper certificate for internal use and rotate the auto-generated admin password immediately after first login. If you are running this on infrastructure exposed to the internet at all, restrict access with firewall rules:

bash

sudo ufw allow from 10.10.10.0/24 to any port 3333
sudo ufw deny 3333

Configuring a Sending Domain

Realistic simulations require a domain that will not immediately trip spam filters or reveal the exercise. Register a lookalike domain (with legal and HR sign-off), configure SPF, DKIM, and DMARC records properly so mail actually lands in inboxes, and warm up the domain's reputation before a large send.

bash

dig txt sagefoxtest-corp.com
# Example SPF record
v=spf1 include:_spf.google.com ~all

Teams that skip domain reputation work often see their simulation emails blocked outright, which produces false confidence in click rates. If you need help evaluating your organization's email security posture before running a simulation, www.sagefoxusa.com offers assessments that pair well with this kind of exercise.

Designing Realistic Phishing Campaigns

Building Believable Email Templates

The value of a simulation is directly tied to how closely it mirrors real attacker tradecraft. Generic "click here to win a prize" templates train users to spot obviously fake emails, not the sophisticated business email compromise attempts they will actually face.

Effective templates typically mimic:

• IT helpdesk password reset notices
• Executive requests for urgent wire transfers or gift cards
• Shared document notifications from services like SharePoint or Google Drive
• HR benefits enrollment deadlines
• Vendor invoice or DocuSign style requests

In the GoPhish template editor, use tracking variables to personalize each message:

html

<p>Hi {{.FirstName}},</p>
<p>Your access to the shared finance folder is expiring. Please
re-authenticate to maintain access:
<a href="{{.URL}}">Verify Access</a></p>
<p>IT Service Desk</p>
<img src="{{.TrackingURL}}" width="1" height="1" />

The tracking pixel and unique URL are what allow GoPhish to log opens and clicks per recipient.

Cloning a Landing Page

GoPhish includes an "Import Site" feature that clones a real login page's HTML so your landing page looks authentic. From the landing pages tab, enter a target URL, and GoPhish will fetch and store the page source, which you can then modify to capture submitted credentials for reporting purposes only.

bash

curl -s https://accounts.example-sso.com/login -o cloned_login.html

Always add a clear post-submission redirect and, in many organizations, an immediate on-screen educational notice explaining that the user just interacted with a simulated phishing test.

Configuring the Sending Profile

Set up an SMTP relay under Sending Profiles, and validate deliverability with a test send before launching to the full target list:

bash

curl -X POST https://your-gophish-host:3333/api/util/send_test_email \
 -H "Authorization: Bearer <API_KEY>" \
 -H "Content-Type: application/json" \
 -d '{
   "template": {"name": "IT Password Reset"},
   "first_name": "Test",
   "last_name": "User",
   "email": "test.user@yourdomain.com",
   "smtp": {"name": "Internal Relay"}
 }'

Launching and Monitoring a Campaign

Creating Target Groups

Groups can be imported via CSV, which is useful for segmenting by department, seniority, or previous training history:

csv

First Name,Last Name,Email,Position
Alice,Nguyen,alice.nguyen@corp.com,Finance Analyst
Marcus,Reyes,marcus.reyes@corp.com,IT Support
Priya,Shah,priya.shah@corp.com,Executive Assistant

Segmenting this way lets you compare click rates across roles, which is often more actionable than an org-wide average.

Launching via the API

For teams running recurring simulations, scripting campaign launches through the GoPhish API keeps the process consistent and auditable:

python

import requests

API_KEY = "your_api_key_here"
BASE_URL = "https://your-gophish-host:3333/api"

headers = {"Authorization": f"Bearer {API_KEY}"}

campaign = {
   "name": "Q3 Finance Phishing Test",
   "template": {"name": "IT Password Reset"},
   "url": "https://sagefoxtest-corp.com",
   "page": {"name": "Cloned SSO Login"},
   "smtp": {"name": "Internal Relay"},
   "groups": [{"name": "Finance Department"}],
   "launch_date": "2026-09-10T09:00:00Z"
}

response = requests.post(f"{BASE_URL}/campaigns/", json=campaign, headers=headers, verify=False)
print(response.json())

Tracking Results in Real Time

GoPhish's dashboard shows opens, clicks, submitted data, and reported emails as events happen. For programmatic reporting or integration into a SIEM, pull results directly:

bash

curl -s -H "Authorization: Bearer <API_KEY>" \
 https://your-gophish-host:3333/api/campaigns/1/results | jq .

Key metrics worth tracking across every campaign include click rate, credential submission rate, report rate (users who flagged it to security), and time to first click, which tells you how quickly your fastest-clicking employees respond to pressure-based lures.

Turning Simulation Data into Actual Risk Reduction

Analyzing Click and Report Rates

A single campaign's numbers mean little in isolation. What matters is trend over time and how those trends map to training interventions. If click rates drop after targeted coaching for a department but report rates stay flat, that suggests users are becoming more cautious but not necessarily more engaged in the reporting process, which matters just as much during a real incident.

Feeding Results Back into Training

The most effective programs treat a failed simulation as a teaching moment, not a punishment. Immediate, contextual training delivered right after a click, explaining exactly what red flags were present in that specific email, produces better long-term retention than generic annual training modules.

Avoiding Common Program Pitfalls

A few mistakes show up repeatedly in immature phishing simulation programs:

• Reusing the same template repeatedly, which trains users to recognize that specific email rather than phishing patterns generally
• Running simulations without HR and legal alignment, which creates trust issues if employees feel targeted or embarrassed
• Failing to segment results by role, missing the fact that finance and executive assistants often need different lures than engineering teams
• Not testing deliverability first, leading to inflated "success" simply because most emails never reached inboxes

If you want an outside perspective on structuring this cadence correctly, our team at www.sagefoxusa.com has run these programs across a range of industries and can help calibrate difficulty and frequency to your organization's maturity level.

Advanced Techniques for Realistic Simulations

Multi-Stage Campaigns

More advanced red team style engagements chain a phishing email to a secondary payload delivery step, such as a fake MFA prompt page that captures one-time codes in real time to demonstrate adversary-in-the-middle risk. This requires careful scoping and legal sign-off, since capturing live MFA tokens, even in a simulation, has real security implications if mishandled.

Combining GoPhish with DNS and Mail Analytics

Correlating GoPhish click data with DNS query logs from your target network can reveal whether users who did not click still had their systems reach out to the simulated domain, for example through link preview services or corporate email security scanners that pre-fetch URLs. Filtering these automated fetches out of your click statistics is essential for accurate reporting:

bash

grep "sagefoxtest-corp.com" /var/log/dns/queries.log | grep -v "scanner-ip-range"

Reporting to Leadership

Executives generally care about three things: trend direction, comparison to industry benchmarks, and cost of remediation versus cost of a real breach. A concise quarterly summary with click rate trendlines, department breakdowns, and specific recommended actions tends to land better than a raw data dump.

Final Thoughts

GoPhish gives security teams a genuinely capable, low-cost way to measure and improve human resilience against phishing, but the tool itself is only half the equation. The real value comes from thoughtful campaign design, careful legal and HR coordination, and a feedback loop that turns every click into a concrete training improvement rather than just a number in a spreadsheet.

If your organization is ready to build or mature a phishing simulation program, SageFox Cybersecurity can help design campaigns, tune deliverability, and translate results into measurable risk reduction. Visit www.sagefoxusa.com to learn more about our social engineering and security awareness services.