Phishing Simulation
I Deployed a controlled phishing simulation using the Gophish framework. To keep the testing entirely isolated I routed the traffic using a locally configured Mail Transfer Agent prefix.
Overview
This campaign was conducted in three main steps to demonstrate the mechanics of email communication and social engineering simulations. Below is the detailed breakdown of the first phase.
Step 1: Setting Email Spoofing Environment
The primary objective of this phase was to establish a controlled environment capable of simulating email spoofing. To achieve this, Postfix was utilized. Postfix is a widely used, open-source Mail Transfer Agent (MTA) that effectively functions as a private mail server running locally on a laptop. By hosting an independent mail server, it grants complete control over the outgoing mail headers, allowing us to manipulate how the sender’s identity appears to the recipient.
Technical Protocol Background
Postfix relies primarily on the Simple Mail Transfer Protocol (SMTP) to manage, route, and deliver email messages.
By default, SMTP operates over port 25 for server-to-server communication.
For secure or authenticated message submission, it can also utilize port 587 (STARTTLS) or port 465 (SMTPS).
Within a local loopback environment (localhost), Postfix handles internal routing via local system accounts before attempting external relaying.
Social Engineering Rationale
To fully deploy and verify the local environment, the following procedural steps were executed: Installation and Mode Selection: During the package installation phase, the server configuration type was set to “Internet Site”. This setting configures Postfix to handle mail delivery using SMTP directly.
Domain Customization,the system mail name was explicitly set using a lookalike domain:
Social Engineering Mechanics: Instead of using the legitimate spelling with an “m”, a double “n” (nn) was substituted. This approach mimics a real-world typosquatting technique used in social engineering assessments. It tests user awareness by exploiting cognitive biases; employees working under a rush often skim over the complete domain name and visually misinterpret the double “n” as an “m”, assuming the communication is legitimate.
Service Verification: Once the domain setup was finalized, standard diagnostic checks were performed on the system to verify that the Postfix service was active, running, and properly configured to route messages under the specified domain rules.
Service Verification:
Once the domain setup was finalized, standard diagnostic checks were performed on the system to verify that the Postfix service was active, running, and properly configured to route messages under the specified domain rules.
Step 2: Using Gophish to Make Social Phishing Account:
To launch the phishing simulation
framework, we first start the GoPhish application via the terminal. Once the binary is running, it initializes a local web server and generates a random default administrator password directly within the terminal console output. To access the management interface, open the Firefox web browser and manually type the specific URL
Get Fizzah Ahsan’s stories in your inbox
Join Medium for free to get updates from this writer.
https://localhost: 3333 into the address bar. After bypassing the local self-signed certificate warning screen, the GoPhish login portal will appear. Finally, enter “admin” as the username along with the default password captured from the terminal to successfully log into the dashboard.
Keep the terminal window where you ran GoPhish open; closing it will shut down the server.Make sure you use https:// and not http:// when typing the address.
Landing page:
First we will make a landing page and for that you can pick an html code from github that look alike instagram login page or can make one of your own and can do changing accoding to your liking like i did chane the year at bottom to current year
Paste the code in html section you will have to option either import the site url directly or write an html code
after that click on source and you can see how your landing page look like and after that click on capture data
After that add orignal login page url so that when victm enter credentials and press loging it will redirected to real login page and victm will though it is some kind of glitch and save it
Email Template:
Write the email and subject of email you can write directly the body of email in text form or you can generate the email through html that can match the real email
Sending Profiles
Add Users and group
You can add people in bulk by adding csv file or you can indivualy add them and can define positions as well add name email
Step 3: Configuartion
Now we need to configure our landing page email template sending profiles and groups and people
We added our syatem ip adress it will connect the gophish with postfix and after all configuration we will launch our campaign
Dashboard
