# Phishing in the Shadows
This task will take you through setting up GoPhish, sending a phishing campaign and capturing user credentials from a spoof website.
*This is the tryhackme GoPhishing Labs*
Firstly launch the virtual machine by clicking the green **Start Machine** button on the right; once loaded, click the following URL to open the GoPhish login page [https://10-10-70-44.p.thmlabs.com:8443](https://10-10-70-44.p.thmlabs.com:8443) [or if you're connected to the TryHack](https://10-10-70-44.p.thmlabs.com:8443/)Me VPN, you can to go [https://10.10.70.44](https://10.10.70.44) [(if you receive an](https://10.10.70.44/) Nginx error, wait another 30 seconds and try again).
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725730610464/36650e0a-76d5-408b-bd31-3c6214a638b3.png align="center")
You should be able to log in with the username: **admin** and password: **tryhackme**
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725730722713/62f0b31d-87d8-4441-8669-5c225dfbf10c.png align="center")
**Sending Profiles:**
Sending profiles are the connection details required to actually send your Phishing emails; this is just simply an SMTP server that you have access to. Click the Sending Profiles link on the left-hand menu and then click the "New Profile" button.
Next, add in the following information as per the screenshot below:
```bash
Name: Local Server
From: noreply@redteam.thm
Host: 127.0.0.1:25
```
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725730845853/cebf1c53-e66b-40fb-aa82-b9330567898b.png align="center")
Then click **Save Profile**.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725730915334/923cbb3e-8441-4315-a232-4593f644fcfc.png align="center")
Next, we're going to set up the landing page; this is the website that the Phishing email is going to direct the victim to; this page is usually a spoof of a website the victim is familiar with.
Click the Landing Pages link on the left-hand menu and then click the "New Page" button.
Give the Landing Page the name **ACME Login**, next in the HTML box; you'll need to press the **Source** button to allow us to enter the HTML code as shown below:
```xml
ACME IT SUPPORT - Admin Panel
ACME IT SUPPORT
Admin Panel
```
Click the **Source** button again, and you should see a login box with username and password fields as per the image below, also click the **Capture Submitted Data** box and then also the **Capture Passwords** box and then click the Save Page button.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725731400973/e614a696-e9d0-4d62-ae32-620ae2002c75.png align="center")
**Email Templates:**
This is the design and content of the email you're going to actually send to the victim; it will need to be persuasive and contain a link to your landing page to enable us to capture the victim's username and password.
Click the **Email Templates** link on the left-hand menu and then click the **New Template** button.
Give the template the name **Email 1**, the subject **New Message Received**, click the HTML tab, and then the Source button to enable HTML editor mode.
In the contents write a persuasive email that would convince the user to click the link, the link text will need to be set to [**https://admin.acmeitsupport.thm**](https://admin.acmeitsupport.thm)[, but the actual link will need to be set to **{{.**](https://admin.acmeitsupport.thm/)**URL}}** which will get changed to our spoofed landing page when the email gets sent, you can do this by highlighting the link text and then clicking the link button on the top row of icons, make sure to set the **protocol** dropdown to **<other>**.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725731926534/cbe9e70e-492a-46db-8fe6-88f86f59c40e.png align="center")
Your email should look similar to the screenshot below. Click **Save Template** once complete.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725731881096/da748a29-7200-4e12-a1e5-c85f697fe4be.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725731959372/40fbedf7-fed3-410c-8d0e-61e26d21fc8f.png align="center")
**Users & Groups**
This is where we can store the email addresses of our intended targets. Click the **Users & Groups** link on the left-hand menu and then click the **New Group** button. Give the group the name **Targets** and then add the following email addresses:
```basic
martin@acmeitsupport.thm
brian@acmeitsupport.thm
accounts@acmeitsupport.thm
```
Click the **Save Template** button; once completed, it should look like the below screenshot:
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732092647/54d589d2-cd3f-4926-b43d-e1d56d71b344.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732126648/4abb812b-85c6-4ead-b0fb-cc5422d223ca.png align="center")
**Campaigns**
Now it's time to send your first emails; click the **Campaigns** link on the left-hand menu and then click the **New Campaign** button. Set the following values for the inputs, as per the screenshot below:
Name: Campaign One
Email Template: Email 1
Landing Page: ACME Login
URL: [http://10.10.70.44](http://10.10.70.44/)
Launch Date: For this lab set it to 2 days ago just to make sure there is no complication with different timezones, in a real operation this would be set correctly.
Sending Profile: Local Server
Groups: Targets
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732249288/f293c810-94a5-419a-ba8b-54f4d2435e90.png align="center")
Once completed, click the **Launch Campaign** button, which will produce an **Are You Sure** prompt where you can just press the **Launch** button.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732322663/ade3f1de-01bb-4c5a-b903-5182fd45e1f4.png align="center")
**Results**
The results page gives us an idea of how the phishing campaign is performing by letting us know how many emails have been delivered, opened, clicked and how many users have submitted data to our spoof website.
You'll see at the bottom of the screen a breakdown for each email address; you'll notice that both Martin's and Brian's email has been sent successfully, but the account's email has resulted in an error.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732377607/3b1ad277-8d30-4f5b-b3ff-bb6b68cca99f.png align="center")
We can dig in the error more by clicking the dropdown arrow next to the account's row, and by viewing the details or the error, we can see an error message saying the user is unknown.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732491282/da7a8e24-469f-4f4f-9c4e-497db844f7c6.png align="center")
After a minute and providing you've followed the instructions correctly, you should see the status of brian change to **Submitted Data.**
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732518515/15b8012e-589d-4900-9b4f-28a3cb007683.png align="center")
Expanding Brian's details and then viewing the details for the submitted data, you should be able to see Brian's username and password, which will help you answer the question below.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1725732628260/78c54da7-83f7-4ded-8035-8c19d3c3728f.png align="center")
Summary.
This task walks through setting up a phishing campaign using **GoPhish** in TryHackMe's GoPhishing Labs. The steps include:
1. **Setting Up GoPhish**: Access the GoPhish dashboard and log in using provided credentials.
2. **Creating a Sending Profile**: Configure the SMTP server (localhost) to send phishing emails.
3. **Designing a Landing Page**: Create a fake login page (ACME IT Support) to capture user credentials.
4. **Crafting an Email Template**: Write a persuasive email with a link to the spoofed landing page.
5. **Setting Up Users & Groups**: Define target emails (e.g., martin@acmeitsupport.thm) for the campaign.
6. **Launching a Phishing Campaign**: Configure the campaign settings and send phishing emails.
7. **Viewing Results**: Track the status of emails and credentials submitted through the spoof website, identifying successful phishing attempts.
The campaign simulates phishing attacks by capturing and analyzing user interactions with the fake login page.