Building a Phishing Simulation Environment with GoPhish

Disclaimer:
This guide is for authorized security testing only. Always obtain written permission before conducting phishing simulations. Unauthorized use is illegal.

Introduction

GoPhish is an open-source tool used to conduct phishing simulations and improve security awareness. It helps security teams create test emails, landing pages, and campaigns to evaluate user awareness.

This guide explains how to deploy GoPhish on a Google Cloud virtual machine, configure Nginx and HTTPS, and set up and monitor a phishing simulation campaign.

Prerequisites

Before you begin, ensure you have the following:

• Google Cloud account: With billing enabled and the required permissions to create a project and virtual machine.
• Domain name: A registered domain with access to its DNS settings.
• SSH access: A local terminal to connect to the virtual machine using SSH.
• SMTP configuration: An authorized email account or relay for sending simulation emails.
• Written authorization: Approval to conduct the phishing simulation against the intended recipients.

Step 1: Create the Google Cloud Project and VM

1.1 Select or create a project

Log in to the Google Cloud Console and select the project you want to deploy into from the project selector at the top of the page. If you don’t have one yet, create a new project dedicated to this deployment — keeping GoPhish in its own project makes it easier to control access and tear the environment down afterward.

Selecting the Google Cloud project where the GoPhish VM will be deployed.

1.2 Navigate to VM instances

Open the Navigation menu and go to Compute Engine → VM instances.

Opening the Compute Engine VM instances page to create a new virtual machine.

1.3 Create the VM instance

Click Create instance and configure the machine as follows:

Machine configuration

• Name: any identifying string (avoid anything that reveals the VM’s purpose publicly)
• Region: choose a region close to your team or recipients
• Zone: any available zone in that region
• Machine type: e2-small or e2-micro is enough for a small-scale simulation; size up if you expect heavy traffic or a large recipient list

Basic machine configuration for the GoPhish VM.

OS and storage

• Operating system: Ubuntu
• Version: Ubuntu 24.04 LTS Minimal (x86/64)

Selecting Ubuntu 24.04 LTS Minimal as the boot disk image

Data protection

• Backups: disabled (not required for a short-lived simulation environment)

Networking

• Enable Allow HTTP traffic
• Enable Allow HTTPS traffic
• Under Network interfaces, for the default NIC, set External IPv4 address to Reserve static external IP address

1.4 Confirm the VM is running

Once created, confirm the instance shows a Running state on the VM instances page. If it’s stopped, click Start.

Step 2: Connect to the VM Over SSH

Option 1: Browser-Based SSH

• On the VM Instances page, click SSH next to the running VM instance.

• This opens a browser-based SSH session directly in the Google Cloud Console.

Option 2: SSH Using a Key Pair (Local Endpoint)

1. On your local machine, generate an SSH key pair:

ssh-keygen -t ed25519 -C your_email@example.com

2. Copy the contents of the public key (the file ending in .pub).

3. In the Google Cloud Console, go to Compute Engine → Settings → Metadata → SSH Keys, click Edit, paste the public key, and click Save.

Registering the local public key with the VM’s metadata. Once saved

Stape * : Access the VM Using SSH from Local System
Run the following command:

ssh username@ip_address
If a passphrase was configured during SSH key generation, enter the passphrase when prompted:

Step 3: Basic Ubuntu Configuration

3.1 Set the system timezone

sudo timedatectl set-timezone Asia/Kolkata

Replace Asia/Kolkata with the time zone appropriate for your organization's location. This setting is optional and does not affect GoPhish functionality.

3.2 Create a dedicated service user

Run GoPhish under its own user rather than root:

sudo adduser gophish
sudo usermod -aG sudo gophish
su gophish

Any username works here — gophish is just a clear, descriptive choice.

3.3 Create the GoPhish directory

sudo mkdir /opt/gophish
cd /opt/gophish

Creating the directory that will hold the GoPhish installation.

Step 4: Download and Install GoPhish

1. Download the official Linux x64 release:

sudo wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip

Check the GoPhish releases page for the current version before downloading — v0.12.1 was current at the time .

1. Install the unzip utility if it isn't already present:

sudo apt install unzip

1. Unzip the archive into /opt/gophish:

sudo unzip gophish-v0.12.1-linux-64bit.zip

1. Remove the zip file once extraction is complete.
2. Set ownership so the gophish user can run and manage the application:

sudo chown gophish /opt/gophish/

The GoPhish release downloaded, extracted, and owned by the gophish user.

Step 5: Configure GoPhish and Create a systemd Service

5.1 Review and edit the configuration file

cd /opt/gophish/
ls
sudo nano config.json

5.2 Do a first test run

sudo chmod +x gophish
sudo ./gophish

If your Google Cloud project uses OS Login and you were temporarily added to a Google-managed sudoers group while setting up SSH access, you can remove that temporary access once key-based login is confirmed working:

sudo gpasswd -d your_username google-sudoers

This step is specific to projects with OS Login enabled — skip it if it doesn’t apply to your environment.

5.3 Install and enable the service

sudo mv gophish.service /etc/systemd/system
cd /etc/systemd/system
ls
sudo systemctl enable gophish.service

Then set final ownership and permissions and start the service:

sudo systemctl stop gophish
sudo chown -R gophish:gophish /opt/gophish
sudo chmod -R u+rwX /opt/gophish
sudo chmod 664 /opt/gophish/gophish.db
sudo chmod 775 /opt/gophish
sudo systemctl restart gophish
sudo systemctl status gophish

Verification step: run sudo systemctl status gophish and confirm the service shows active (running) with no repeated restart errors in the log output (journalctl -u gophish -f is useful if it isn't).

Step 6: Configure Nginx as a Reverse Proxy

6.1 Install Nginx and Certbot

sudo apt install nginx -y
sudo apt install certbot -y

6.2 Remove the default site and create a GoPhish site config

sudo unlink /etc/nginx/sites-enabled/default
sudo nano /etc/nginx/sites-available/gophish.conf

Add the following, replacing the placeholder domain with your own:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}

6.3 Enable the site and restart Nginx

sudo ln -s /etc/nginx/sites-available/gophish.conf /etc/nginx/sites-enabled/gophish.conf
sudo systemctl enable nginx.service
sudo systemctl start nginx.service
sudo systemctl status nginx.service

Step 7: Point Your Domain at the VM

In your domain registrar’s DNS settings, add an A record pointing your domain (and www subdomain, if used) at the VM's static external IP address.

Verification step: once propagation completes, run dig yourdomain.com (or nslookup yourdomain.com) and confirm it resolves to the VM's external IP before moving on to the HTTPS step.

Step 8: Enable HTTPS with Certbot

sudo apt update
sudo apt install python3-certbot-nginx -y
sudo certbot --nginx

Follow the interactive prompts — Certbot will validate domain ownership, issue a certificate from Let’s Encrypt, and automatically update the Nginx config to serve over HTTPS.

Verification step: load https://yourdomain.com in a browser and confirm it shows a valid certificate with no warnings.

Step 9: Securely Access the GoPhish Admin Dashboard

The admin dashboard listens only on 127.0.0.1 on the VM by default, so it isn't reachable directly from the internet. Reach it through an SSH local port forward instead:

ssh -L 5000:127.0.0.1:3333 your_username@ip_address

With the tunnel open, browse to https://localhost:5000/ on your local machine. On first login, you'll be prompted to set a new password for the auto-generated admin account — do this immediately and store the password in your team's password manager.

After signing in successfully, you will see the Gophish dashboard.

Press enter or click to view image in full size

The left navigation pane contains the following sections:

• Dashboard
• Campaigns
• Users & Groups
• Email Templates
• Landing Pages
• Sending Profiles
• Account Settings
• User Management
• Webhooks

Step 3: Configuring Sending Profile

A Sending Profile contains the SMTP settings Gophish uses to send phishing simulation emails.

To create one: Click >Sending Profiles, then click >New Profile:

Get Shubham Sakhare’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Press enter or click to view image in full size

Configure the following:

• Profile Name: Enter a profile name, such as Test Phishing Simulation.
• Interface Type: Keep the default selection.
• SMTP From: Enter the authorized email address that will appear as the er.shubhamsakhare@gmail.com
• Host: For Gmail, use smtp.gmail.com:465 (SSL/TLS) or smtp.gmail.com:587, depending on the supported configuration.
• Username: Enter your Gmail address. er.shubhamsakhare@gmail.com
• Password: Use a Google App Password if required by your account and SMTP configuration. Do not use your regular Gmail password.

Press enter or click to view image in full size

After creating your App password, paste the App Password into the Password field.

Enable >Ignore Certificate Errors, and leave everything else as default

Press enter or click to view image in full size

Testing the Sending Profile Configuration

To test your configurations so far: Click > Send Test Email:

Press enter or click to view image in full size

Input your details and, click > Send:

Press enter or click to view image in full size

Status so far: Email sent, as seen in the screenshot below.

Press enter or click to view image in full size

If the email arrives successfully in your inbox, the SMTP configuration is working correctly.

Return to the Sending Profile page and click >Save Profile:

Press enter or click to view image in full size

You have successfully configured your Sending Profile, and it is now ready for use.

Press enter or click to view image in full size

Step 4: Setting up Landing Page

A landing page is the webpage a user is redirected to when they click the phishing link contained in an email.

To create a landing page, click >Landing Pages on the left-hand pane, then click >New Page:

Press enter or click to view image in full size

Setup the following:

• Name: Enter a name for your landing page.
• Copy and paste the HTML code into the >HTML editor:

Press enter or click to view image in full size

To preview what the landing page looks like, click >Source:

Press enter or click to view image in full size

• Select >Capture Submitted Data and >Capture Passwords: (This is to ensure the login credentials entered during the simulation will be captured, which you will see at the end of this exercise).
• Redirect to: Enter the URL where you want the user to be redirected after submitting the page. eg https://Instagram.com:
• Finally, click >Save Page.

Press enter or click to view image in full size

You have successfully set up your Landing Page, and it is now ready for use.

Press enter or click to view image in full size

Step 5: Setting up Email Template

An email template is the content of the email that will be sent to the target(s). You can either import an existing email or create one from scratch.

To create an email template, click >Email Templates and then click >New Template:

Press enter or click to view image in full size

Setup the following:

• Name: Enter a name for your template. For this tutorial,
• Envelope Sender: Enter the sender’s name and email address you want recipients to see.
• Email Subject: This is where you can create a sense of urgency.
• HTML: Click the HTML tab and use the HTML sample I have prepared on my GitHub. To access the Email Template, click Here
• Copy and paste the HTML code into the >HTML editor:

Press enter or click to view image in full size

To preview what the Email Template looks like, click >Source:

Press enter or click to view image in full size

• Select >Add Tracking Image (To track when the email is opened):
• Once you are satisfied with the template, click >Save Template:

Press enter or click to view image in full size

You have successfully setup your Landing Page and it is now ready for use.

Press enter or click to view image in full size

Step 6: Setting Up Users & Groups

Users & Groups is where you create and organize the group of users you want to send the email to.

To create a new group, click >Users & Groups and then click >New Group:

Press enter or click to view image in full size

Setup the following:

• Group Name: Enter a name for your group.
• First Name: Enter the recipient’s first name
• Last Name: Enter the recipient’s last name
• Email: Enter the recipient’s email
• Position: Enter the recipient’s position

Select >Add (After inputting the required details):

Once you are satisfied, click >Save Changes:

Press enter or click to view image in full size

📌 Note: Bulk Import Users

If you have multiple users, for example, when conducting a simulation for an organization, you do not have to enter their information one person at a time. You can import a CSV file containing the users’ information.
For this tutorial, I am only sending the simulation to myself, so I added my details.
Only use your own details unless you have explicit authorization or consent from an individual or organization.

• Select >Add (If you have two or more personal email addresses, you can add them as well):
• Once you are satisfied, click >Save Changes:

You have set up Users & Groups, and it is now ready for use.

Press enter or click to view image in full size

Step 7: Launching a Phishing Campaign

A campaign combines the email template, landing page, sending profile, and user group you configured in the previous steps.

To create a new campaign, click >Campaigns and then click >New Campaign:

Press enter or click to view image in full size

Setup the following:

• Campaign Name: Enter a name for your campaign.
• Email Template: Select which is the Email Template created earlier.
• Landing Page: Select which is the Landing Page created earlier.

Press enter or click to view image in full size

Configure and Test the Campaign

Before launching a campaign, verify that all settings are configured correctly.

• URL: Enter the URL of your configured landing page.
• Launch Date: Select the date and time for the authorized simulation.
• Sending Profile: Select the sending profile configured earlier.
• Groups: Select the approved recipient group.

Test Email Delivery

Use the Send Test Email option to send a test message to your own email address. Review the message to confirm that the formatting, sender details, and links are correct.

If any issues occur, resolve them before proceeding.

Launch the Campaign

Once the configuration has been verified and authorization is confirmed, click Launch Campaign. Review the confirmation message to ensure the campaign has been scheduled successfully.

Step 8: Viewing the Phishing Campaign Result in Real-time

The Dashboard allows you to view the details and results of the campaigns you have launched.

To view the result, click >Dashboard:

Here, you will see information such as:

• Email Sent
• Email Opened
• Clicked Link
• Submitted Data
• Email Reported

Press enter or click to view image in full size

For this exercise, open the email you received in your inbox and click the phishing simulation link.

Enter random credentials into the simulated login page:

Next, return to the Gophish Dashboard and refresh the page.

Press enter or click to view image in full size

You should now see that the Dashboard has been updated, allowing you to view the results and details of the interaction with the simulated phishing campaign.

It successfully captured the hypothetical data I submitted, demonstrating how a phishing simulation can show the type of information an attacker may attempt to collect.

🎉 Congratulations!

You have completed the phishing simulation and demonstrated how to configure, launch, and analyze a realistic phishing campaign in a controlled environment.

Conclusion

This guide covers the complete deployment of GoPhish on Google Cloud, from VM setup to running an authorized phishing simulation campaign. It includes GoPhish installation, Nginx configuration, HTTPS setup, and campaign creation. It also highlights secure dashboard access, proper campaign authorization, and responsible handling of collected data.

References

• GoPhish official site: https://getgophish.com/
• GoPhish GitHub repository and releases: https://github.com/gophish/gophish
• Let’s Encrypt / Certbot documentation: https://certbot.eff.org/
• Google Cloud Compute Engine documentation: https://cloud.google.com/compute/docs