gophish

Name: gophish
Availability: InStock
Author: Dave

Create and manage phishing campaigns with credential harvesting pages and email templates.

15|1|Updated Feb 12, 2026

Search Tags:#security testing #penetration testing #campaign management #social engineering #phishing #credential harvesting

Ready to run

npx skills add https://github.com/AeonDave/malskill --skill gophish

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gophish
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/social-engineering/gophish
Command: npx skills add https://github.com/AeonDave/malskill --skill gophish

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a framework for setting up and managing sophisticated phishing campaigns, enabling users to test an organization's security awareness and identify vulnerabilities.

Core Features & Use Cases

Phishing Campaign Management: Create and manage complete phishing campaigns, including target lists, email templates, and landing pages.
Credential Harvesting: Design and deploy landing pages to capture user credentials.
Tracking & Reporting: Monitor campaign performance, including click-through rates and captured data.
Use Case: Use this Skill to simulate a spear-phishing attack by sending customized emails to a list of employees, directing them to a fake login page to test their susceptibility.

Quick Start

Use the gophish skill to start the gophish server with default settings.

Frequently Asked Questions about gophish

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up a phishing campaign for security testing?▼

Setting up a phishing campaign involves creating target lists, designing email templates, and deploying credential harvesting landing pages to simulate social engineering attacks and test organizational security awareness.

Can I use this framework to harvest credentials with fake login pages?▼

Yes, credential harvesting is supported by designing and deploying custom landing pages that capture user credentials entered during simulated spear-phishing attacks.

Do I need an SMTP relay to run phishing simulations?▼

Yes, an active SMTP relay is required to send spear-phishing emails, and inbound TCP ports 443 and 80 must be open to host the phishing infrastructure successfully.

How does phishing campaign tracking and reporting work?▼

Phishing campaign tracking monitors performance metrics like click-through rates and captured credential data, generating reports to identify employee susceptibility and security vulnerabilities.

What is the best way to test employee susceptibility to spear-phishing emails?▼

Testing employee susceptibility involves sending customized spear-phishing emails to a target list, directing users to a fake login page, and tracking who enters credentials.

Are there limitations when generating phishing infrastructure on internal networks?▼

Generating phishing infrastructure requires open inbound TCP ports 80 and 443 along with a configured SMTP relay, which may be restricted by internal network firewalls.