Phishing command BETA
Describe the campaign in plain words — the model clones the login page, builds the campaign and deploys the tooling on a VPS you control. Authorized targets only.
This feature is new and may have bugs.
Ask in plain words
clone the facebook login — page on my VPS, ssh 203.0.113.9 root + key
fake O365 portal for the Q3 campaign, list staff.csv, sending through SendGrid
reverse-proxy the Okta login for replace-with-your-domain.com — sign-in and MFA go through the real site
What you must provide
- Which page to impersonate — a URL, or the provider (Facebook, O365, your own intranet).
- Required — a VPS or hosting YOU control, with SSH access (host, user, key or password), plus the domain that will point at it: the phishing tooling is installed and served there, never on the Kali pod. No host, nothing to build.
- The recipient list — the addresses you are cleared to hit (a file or an imbutus list). Skip it if you only want the page hosted.
- For email delivery: the sending domain and SMTP details, if you want mail sent rather than just the page hosted.
How the page is built
Static copy → a page in the campaign framework
Plain form login: copy the page, import it as a phishing/landing page, enable credential capture, set a redirect. Works for simple forms; breaks on Google/Microsoft (see above).
wget -p -k -E -l 1 -P /tmp/phish-clone <login-url>
That copy — the login page plus the CSS, JavaScript and images it needs — is what you upload into GoPhish as the landing page. <login-url> is the real page you want to copy.
Keep -l 1: --mirror on its own follows every link and copies the whole site.
Reverse proxy / AiTM → Phishing Club proxy or Evilginx
Nothing is copied: the framework proxies the real page and captures live credentials plus the session cookie, so an MFA login yields a usable session. Phishing Club: domain proxy. Evilginx: phishlet per provider.
Phishing Club — default, maintained: pages, campaigns and the proxy/AiTM route in one. gophish-ng — maintained GoPhish fork (monthly). GoPhish upstream — dormant since 2022.
Tools:
Phishing Clubgophish-ngEvilginx (reverse proxy)Kali machine
The Kali machine is the operator workstation: it makes the page copy and deploys to your host over SSH. GoPhish, Evilginx and any SMTP component are never installed on the Kali pod.
Reports
The reply tells you where the tooling went and hands you the page URL plus the framework admin URL — that admin UI is where you edit the phishing page, the target list and the template. Authorized targets only.