skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

gophish

Create and manage phishing campaigns with credential harvesting pages and email templates.

15|1|Updated Feb 12, 2026
Search Tags:#security testing#penetration testing#campaign management#social engineering#phishing#credential harvesting
One-click install
npx skills add https://github.com/AeonDave/malskill --skill gophish
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gophish
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/social-engineering/gophish
Command: npx skills add https://github.com/AeonDave/malskill --skill gophish

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a framework for setting up and managing sophisticated phishing campaigns, enabling users to test an organization's security awareness and identify vulnerabilities.

Core Features & Use Cases

  • Phishing Campaign Management: Create and manage complete phishing campaigns, including target lists, email templates, and landing pages.
  • Credential Harvesting: Design and deploy landing pages to capture user credentials.
  • Tracking & Reporting: Monitor campaign performance, including click-through rates and captured data.
  • Use Case: Use this Skill to simulate a spear-phishing attack by sending customized emails to a list of employees, directing them to a fake login page to test their susceptibility.

Quick Start

Use the gophish skill to start the gophish server with default settings.

Frequently Asked Questions about gophish

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a phishing campaign for security testing?▼

Setting up a phishing campaign involves creating target lists, designing email templates, and deploying credential harvesting landing pages to simulate social engineering attacks and test organizational security awareness.

Can I use this framework to harvest credentials with fake login pages?▼

Yes, credential harvesting is supported by designing and deploying custom landing pages that capture user credentials entered during simulated spear-phishing attacks.

Do I need an SMTP relay to run phishing simulations?▼

Yes, an active SMTP relay is required to send spear-phishing emails, and inbound TCP ports 443 and 80 must be open to host the phishing infrastructure successfully.

How does phishing campaign tracking and reporting work?▼

Phishing campaign tracking monitors performance metrics like click-through rates and captured credential data, generating reports to identify employee susceptibility and security vulnerabilities.

What is the best way to test employee susceptibility to spear-phishing emails?▼

Testing employee susceptibility involves sending customized spear-phishing emails to a target list, directing users to a fake login page, and tracking who enters credentials.

Are there limitations when generating phishing infrastructure on internal networks?▼

Generating phishing infrastructure requires open inbound TCP ports 80 and 443 along with a configured SMTP relay, which may be restricted by internal network firewalls.

Related Skills

Explore More Software Engineering Skills→
wasay1200wasay1200

freight-imessage-setup

Configure and validate iMessage relays for bidirectional SMS with broker AI.

Community
Advanced
jaskaranhundaljaskaranhundal
3

security-awareness

Measure human risk posture through phishing simulation and training metrics.

Community
Advanced
enowdevenowdev
13

lead-magnet

Generate lead magnet content and landing page structures for email list growth.

Community
Intermediate
zebbernzebbern
34

Phishing Attacks

Guide phishing attack simulations using Shellphish and Wifiphisher for penetration testing.

Community
Advanced