TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Gophish: An open source phishing toolkit

235 点作者 braxxox超过 6 年前

12 条评论

jwcrux超过 6 年前
Hi everyone!<p>What a happy surprise to see my project on HN :)<p>My name is Jordan, I&#x27;ve been developing Gophish [0] for a few years now. The goal of the project is to let companies of all sizes perform high-quality phishing simulation regardless of their security budget.<p>Happy to answer any and all questions!<p>[0] <a href="https:&#x2F;&#x2F;getgophish.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;getgophish.com&#x2F;</a>
评论 #18307579 未加载
评论 #18306098 未加载
评论 #18305905 未加载
评论 #18306862 未加载
sethammons超过 6 年前
Feedback: I have no clue what this is or what I&#x27;m looking at even after starting to dig into docs. I have not yet Googled &quot;phishing toolkit,&quot; but I would expect a blurb on the readme about what this does or a link to get me started on what the concept of a phishing toolkit is. All the comments are glowing, so I&#x27;m really missing something here.<p>To me, phishing is email (or phone calls, links, websites, or other comms) that attempt to get someone to give something away that is a secret. I don&#x27;t see the relationship between that and your tool yet.<p>[Edit &#x2F; Update] Ok. After going 14 pages deep into the project, down through a user guide, it is clear what this project does. But 14 pages!? I recommend updating the readme to have, near the top, a section on selling&#x2F;introducing the tool. &quot;Gofish allows you to easily create a fake landing page that mimics your real landing page and send phishing email to get people in your organization to come to the phishing site. A UI shows stats collected on emails opened, links clicked, and data submitted to the phishing site. Set up multiple campaigns and much more. See our list of features.&quot; Add some relevant pics like the dashboard and your readme will really be helpful to folks like me.
评论 #18308444 未加载
评论 #18308627 未加载
daenz超过 6 年前
&gt;just download and extract the zip containing the release for your system, and run the binary<p>This is meta right? You&#x27;re phishing us with a meta toolkit.
评论 #18309140 未加载
chrissnell超过 6 年前
I wrote a tool in Perl, ages ago, that would generate random (but real-looking) information for phishing site forms and submit it as fast as the server would take them. You would tag fields with a type like &quot;firstname&quot; or &quot;creditcardnumber&quot;, &quot;ssn&quot;, etc., and it would do the rest. The credit cards even passed the CRC check.<p>The idea was that you would flood their valid data with bullshit data making it worth less to them. It was quite effective. Most skript kiddiez didn&#x27;t know enough to stop me.
评论 #18306739 未加载
评论 #18306711 未加载
PenguinCoder超过 6 年前
I have used GoPhish (and still currently do) to great effect. I really love the ease of use, templated and personalized aspect, and of course pretty graphical reports for management. I had no idea it was mainly a one man band type of product. Tools like SET are more powerful, but geared towards pen testing&#x2F;red teaming, not phishing focused.<p>Thank you very much for a quality open source toolkit.
matt4077超过 6 年前
So, how does this &quot;educational tool to secure organisations against phishing&quot; differ from a tool to make phishing easier?<p>Don&#x27;t get me wrong: I&#x27;m all for people having the tools to protect themselves, and the ability to write&#x2F;publish&#x2F;use whatever software you want.<p>So this question isn&#x27;t provocation, but a real interest if there are any decisions that may make such software&#x27;s use easier for white hats vs. black.<p>Because as a first approximation, it strikes me as plausible that being free-as-in-beer is unfortunately more useful to the perpetrators of phishing (usually small groups or individuals) than the victims (large organisations, usually with significant resources or they wouldn&#x27;t be interesting). It&#x27;s a really interesting dynamic actually, one where the weapon and the protection just happen to be the same.
评论 #18306463 未加载
评论 #18306856 未加载
vijaybritto超过 6 年前
Why is every project written in golang have go in their names?! This is present even in some rust libraries.
评论 #18308430 未加载
评论 #18307999 未加载
评论 #18307827 未加载
评论 #18307736 未加载
评论 #18308345 未加载
bdibs超过 6 年前
Very interesting, and your site looks great!<p>I&#x27;m interested in how you plan on monetizing, enterprise support?
评论 #18305800 未加载
casca超过 6 年前
This is a great project and really easy to use if you&#x27;re even slightly technical. If you&#x27;re looking for something that someone else manages at the cost of giving away sensitive organizational data, Duo Insight is free from a well respected vendor (Cisco acquisition notwithstanding) - <a href="https:&#x2F;&#x2F;duo.com&#x2F;resources&#x2F;duo-insight" rel="nofollow">https:&#x2F;&#x2F;duo.com&#x2F;resources&#x2F;duo-insight</a>
评论 #18308725 未加载
sunsetMurk超过 6 年前
similar software to the testing part of this startup&#x27;s saas offering. <a href="https:&#x2F;&#x2F;www.knowbe4.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.knowbe4.com&#x2F;</a><p>they&#x27;ve been growing like crazy; aggressive sales, and nearly giving it away for free. Most of their value comes from the educational content they provide though, and not the actual testing infrastructure which Gophish is focused on.
nabeards超过 6 年前
Does this toolkit actually send emails out, or connect to a mail server? If it connects to a mail server, does it handle any stats with regard to if the email was successfully sent?
KiDD超过 6 年前
Cool!