🎯 Sneaky GoPhish - Automated Deployment & SSL Management

⚠️ DISCLAIMER: This tool is for authorized penetration testing and security research only. Use responsibly and only on systems you own or have explicit permission to test.

• Fully Automated Deployment: One-command installation with Docker
• SSL Certificate Management: Automatic Let's Encrypt SSL certificate generation and renewal
• Stealth Modifications: Removes GoPhish fingerprints for better evasion
• Easy Management: Simple scripts for start, stop, restart, and monitoring
• Production Ready: Docker-based deployment with persistence
• Monitoring: Built-in status monitoring and health checks
• File upload: /upload on the phishing host is reverse-proxied to a small Flask service; files land in ./uploads on the host (see upload_server.py, Dockerfile.upload)
• QR in email templates: Patched template context exposes {{.QRCode}} (inline image) for VPN / re-auth style mails — apply patch from files/gophish-patches/ when building the image

• Sneaky GoPhish: Modified version with removed fingerprints
• SSL Automation: Let's Encrypt certificate management
• Docker Setup: Containerized deployment
• Management Scripts: Easy-to-use administration tools

• ✅ Removed X-Gophish-* headers
• ✅ Changed default server name
• ✅ Modified recipient parameter (rid → id)
• ✅ Custom 404 error pages
• ✅ Enhanced evasion capabilities
• ✅ Phishing server proxies /upload → internal upload service (multipart uploads)
• ✅ Email templates can embed {{.QRCode}} after applying files/gophish-patches/models/template_context.go

• OS: Ubuntu 20.04+ / Debian 10+
• Access: Root privileges required
• Network: Ports 80, 443, 3333 available
• DNS: Valid domain names pointing to your server
• Dependencies: Docker, Docker Compose, Certbot

# Download and run the deployment script
wget https://raw.githubusercontent.com/sweetpotatohack/sneaky-gophish-ssl-automation/main/deploy_gophish.sh
chmod +x deploy_gophish.sh
./deploy_gophish.sh

# Clone the repository
git clone https://github.com/sweetpotatohack/sneaky-gophish-ssl-automation.git
cd sneaky-gophish-ssl-automation

# Make scripts executable
chmod +x *.sh

# Run deployment
./deploy_gophish.sh

sneaky-gophish-ssl-automation/
├── deploy_gophish.sh      # Main deployment script
├── manage_gophish.sh      # System management script
├── get_password.sh        # Password retrieval script
├── status.sh             # System status script
├── renew_ssl.sh          # SSL renewal helper (used by deploy / cron)
├── docker-compose.yml    # GoPhish + upload_server
├── Dockerfile            # Custom GoPhish image
├── Dockerfile.upload     # Flask upload service image
├── upload_server.py      # POST /upload handler → ./uploads
├── config.json           # GoPhish configuration
├── nginx-redirect.conf   # Optional nginx snippets / reference
├── ssl/                  # SSL certificates directory (Let's Encrypt / copies)
├── uploads/              # Received files (ignored by git except .gitkeep)
├── files/                # Landing pages, emails, phish.go patch, gophish-patches/
└── data/                 # Persistent DB mount (use .gitkeep; never commit *.db)

Before running the deployment script, ensure you have:

1. Two domains pointing to your server:

   • Admin domain (e.g., admin.example.com)
   • Phishing domain (e.g., phish.example.com)

2. DNS A Records configured:

   admin.example.com    → Your-Server-IP
   phish.example.com    → Your-Server-IP
   

The deployment script will prompt for:

• Admin domain name
• Phishing domain name
• Email for Let's Encrypt registration

# Show system status
./manage_gophish.sh status

# Get admin password
./manage_gophish.sh password

# Restart services
./manage_gophish.sh restart

# Stop services
./manage_gophish.sh stop

# Start services
./manage_gophish.sh start

# View logs
./manage_gophish.sh logs

# Follow logs in real-time
./manage_gophish.sh logs -f

# Renew SSL certificates
./manage_gophish.sh renew-ssl

# Check certificate status
./manage_gophish.sh ssl-status

# View certificate expiry
./manage_gophish.sh ssl-check

# Create backup
./manage_gophish.sh backup

# Restore from backup
./manage_gophish.sh restore /path/to/backup

# List available backups
./manage_gophish.sh list-backups

./status.sh

Sample Output:

🔥 Sneaky GoPhish Status 🔥
============================

✅ Docker Status: Running
✅ Container Status: sneaky_gophish_ssl (Up 2 hours)
✅ SSL Certificate: Valid (expires: 2024-10-15)
✅ Admin Panel: https://admin.example.com:3333
✅ Phish Server: https://phish.example.com

🔑 Admin Credentials:
   Username: admin
   Password: [Use ./get_password.sh to retrieve]

📊 Resource Usage:
   CPU: 5.2%
   Memory: 234MB
   Disk: 1.2GB

After successful deployment:

• Admin Panel: https://your-admin-domain:3333
• Phishing Server: https://your-phish-domain
• Upload endpoint: https://your-phish-domain/upload (multipart form) → files on host ./uploads
• Default Username: admin
• Password: Retrieved via ./get_password.sh

Example HTML emails under files/ (e.g. mail_tech_reauth.html, india_mail.html) use GoPhish-style placeholders including {{.QRCode}} after the template patch is applied in your Docker build.

# View running containers
docker-compose ps

# View logs
docker-compose logs -f sneaky_gophish
docker-compose logs -f upload_server

# Restart container
docker-compose restart

# Stop all services
docker-compose down

# Start all services
docker-compose up -d

# Rebuild image
docker-compose build --no-cache

# Access container shell
docker exec -it sneaky_gophish_ssl /bin/bash

# View GoPhish logs from container
docker exec sneaky_gophish_ssl tail -f /opt/gophish/gophish.log

• Certificates: Automatically generated via Let's Encrypt
• Renewal: Automated via cron job (runs daily)
• Protocols: TLS 1.2+ only
• Cipher Suites: Modern, secure configurations

# Allow required ports
ufw allow 80/tcp
ufw allow 443/tcp  
ufw allow 3333/tcp

# Enable firewall
ufw enable

• Change default passwords immediately
• Use strong, unique passwords
• Enable fail2ban for SSH protection
• Regularly update the system
• Monitor logs for suspicious activity
• Use VPN for admin access when possible

# Check what's using ports
netstat -tlnp | grep -E ":80|:443|:3333"

# Stop conflicting services
systemctl stop apache2 nginx

# Restart GoPhish
./manage_gophish.sh restart

# Check certificate status
certbot certificates

# Manual certificate renewal
certbot renew --dry-run

# Force certificate regeneration
certbot delete --cert-name your-domain.com
./manage_gophish.sh renew-ssl

# Check container logs
docker logs sneaky_gophish_ssl

# Restart container
docker-compose restart

# Rebuild container
docker-compose down
docker-compose build --no-cache
docker-compose up -d

# Access container and check database
docker exec -it sneaky_gophish_ssl /bin/bash
ls -la /opt/gophish/gophish.db

# Reset database (⚠️ This will delete all data!)
docker-compose down
docker volume rm sneaky_gophish_gophish_data
docker-compose up -d

The deployment script automatically sets up:

# SSL certificate renewal (daily at 2 AM)
0 2 * * * /root/sneaky_gophish/renew_ssl.sh

# System backup (weekly on Sunday at 3 AM)
0 3 * * 0 /root/sneaky_gophish/manage_gophish.sh backup

# Log rotation (daily at 1 AM)
0 1 * * * /usr/sbin/logrotate /etc/logrotate.d/gophish

# Set up monitoring (optional)
./manage_gophish.sh setup-monitoring

# Check system health
./manage_gophish.sh health-check

# Optimize Docker resources
docker system prune -a

# Monitor resource usage
docker stats sneaky_gophish_ssl

# Adjust container limits in docker-compose.yml
resources:
  limits:
    cpus: '1.0'
    memory: 512M

# Vacuum SQLite database
docker exec sneaky_gophish_ssl sqlite3 /opt/gophish/gophish.db "VACUUM;"

# Backup and optimize database
./manage_gophish.sh optimize-db

Edit config.json to customize:

• Database settings
• Logging levels
• Server binding addresses
• TLS configuration

# Set custom environment variables
export GOPHISH_ADMIN_URL="https://admin.example.com:3333"
export GOPHISH_PHISH_URL="https://phish.example.com"
export GOPHISH_DB_PATH="/opt/gophish/gophish.db"

• GoPhish Logs: /opt/gophish/gophish.log (inside container)
• Docker Logs: docker-compose logs
• System Logs: /var/log/syslog
• SSL Logs: /var/log/letsencrypt/letsencrypt.log

# View recent logs
./manage_gophish.sh logs --tail 100

# Search logs
./manage_gophish.sh logs | grep "error"

# Export logs
./manage_gophish.sh export-logs /path/to/export/

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test thoroughly
5. Submit a pull request

This project is licensed under the MIT License - see the LICENSE file for details.

This tool is intended for authorized security testing and educational purposes only. Users are responsible for ensuring compliance with applicable laws and regulations. The authors assume no liability for misuse of this software.

• Issues: GitHub Issues
• Wiki: Project Wiki
• Discussions: GitHub Discussions

• File upload path /upload via Flask sidecar and reverse proxy in patched phish server
• QR code variable {{.QRCode}} for email templates (patch under files/gophish-patches/)
• README URLs corrected to sneaky-gophish-ssl-automation

• Initial release
• Automated deployment script
• SSL certificate management
• Docker containerization
• Management scripts
• Comprehensive documentation

Made with ❤️ for ethical security testing

"The best defense is a good offense - but only with permission!"