Build a Local Email Phishing Lab

Simulate a real phishing campaign using GoPhish and MailHog locally.

Introduction

30 Second Summary

Phishing emails are the number one way attackers break into organizations. Over 90% of data breaches start with a single deceptive email that tricks someone into clicking a link or entering their credentials.

In this project, you will build a complete local phishing simulation lab using GoPhish and MailHog, then run a full attack campaign following the same methodology professional penetration testers use.

What You'll Build

A safe, self-contained email penetration testing environment on your Ubuntu machine that simulates real-world phishing engagements without any emails leaving your computer.

By the end of this project, you'll have:

A running GoPhish instance connected to a MailHog mail trap, giving you a safe local phishing lab.
DNS reconnaissance results revealing how real organizations protect their email domains with SPF, DKIM, and DMARC.
A completed phishing campaign with captured test credentials and analytics mapped to the PTES methodology.
Secret Mission: Drop to raw SMTP with swaks to manually craft spoofed emails at the protocol level.

Are there any prerequisites?

This project assumes you have Ubuntu 26.04 LTS with basic command-line familiarity and Docker installed (version 29.6.1 or later). No prior penetration testing experience is required.

Set Up Your Phishing Lab Infrastructure

Every phishing simulation needs two things: a framework to craft and track the phishing emails, and a safe mail server that catches everything locally so nothing reaches real inboxes.

In this step, you will install GoPhish (the phishing framework) and MailHog (the local mail trap). Together, they form a contained lab where you can safely practice the entire phishing campaign lifecycle.

In this step, get ready to:

Install helper packages and launch MailHog as your local email trap.
Download and configure GoPhish v0.12.1.
Launch GoPhish and log in to the admin dashboard.

Install tools and start MailHog

Before you can run phishing campaigns, you need a few command-line utilities and a local mail server that safely intercepts all outbound email.

Install the required packages by running this command:

sudo apt update && sudo apt install -y swaks dnsutils unzip wget

What do these packages do?

swaks is a Swiss Army knife for SMTP testing. You will use it in the Secret Mission.
dnsutils provides the dig command for DNS reconnaissance in Step 2.
unzip and wget let you download and extract the GoPhish binary.

Verify the packages installed by running:

swaks --version

You should see a version number printed in the terminal output.

Seeing 'Unable to locate package'?

Make sure the sudo apt update part ran successfully before the install. If your system prompts for a password, enter your Ubuntu user password.

help me fix a package installation error on Ubuntu

Start MailHog using Docker by running this command:

docker run -d --name mailhog -p 1025:1025 -p 8025:8025 mailhog/mailhog

What does this command do?

docker run -d starts a container in the background (detached mode).
--name mailhog gives the container a friendly name so you can reference it later.
-p 1025:1025 exposes the SMTP port. GoPhish will send emails here.
-p 8025:8025 exposes the web UI so you can view captured emails in your browser.
mailhog/mailhog is the official Docker image. It stores all emails in memory (nothing persists after you stop it).

Verify MailHog is running by opening http://localhost:8025 in your browser.

You should see an empty inbox interface. This is where all phishing emails will land safely.

Don't see the MailHog inbox?

Run docker ps to check if the container is running. You should see mailhog in the list with ports 1025 and 8025 mapped.
If the container is not listed, a previous container with the same name may exist. Remove it with docker rm -f mailhog and then re-run the docker run command above.

help me get MailHog running in Docker

Download and configure GoPhish

GoPhish is the industry-standard open-source phishing framework used by professional red teams. You will download the pre-built binary and make one configuration change before launching it.

Download and extract GoPhish v0.12.1 by running these commands:

cd ~
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip -d gophish
cd gophish
chmod +x gophish

What do these commands do?

cd ~ moves you to your home directory.
wget downloads the GoPhish release zip from GitHub.
unzip ... -d gophish extracts the contents into a folder called gophish.
chmod +x gophish makes the binary executable so you can run it.

Confirm the files exist by running:

ls

You should see gophish, config.json, and several other files in the output.

Seeing 'wget: command not found'?

Go back and re-run the sudo apt install command from the previous substep. It installs wget as one of the packages.

help me download GoPhish on Ubuntu

GoPhish's phishing server listens on port 80 by default. On Linux, binding to port 80 requires root privileges. You will change it to port 8080 so you can run GoPhish without sudo.

Open config.json in a text editor. You can use nano from the terminal:

nano config.json

Inside the phish_server section, find this line:

"listen_url": "0.0.0.0:80"

Change 80 to 8080, so the line now looks like this:

"listen_url": "0.0.0.0:8080"

Save the file by pressing Ctrl+O, then Enter, then exit with Ctrl+X.

Why change this port?

On Linux, ports below 1024 are restricted to the root user. Changing the phishing server to port 8080 lets you run GoPhish as a normal user. The admin dashboard stays on its default port 3333 (which is already above 1024).

Launch GoPhish and log in

Start GoPhish by running this command from the ~/gophish directory:

./gophish

What should I see?

GoPhish prints startup messages including a line with your temporary admin password. It looks something like this:

Please login with the username admin and the password [random-characters-here].

Copy that random password. You will need it in the next step.

Open https://localhost:3333 in your browser.
Your browser will show a certificate warning because GoPhish uses a self-signed certificate. Click Advanced and then Proceed to localhost (or the equivalent in your browser) to continue.
Log in with username admin and the temporary password from the terminal output.
GoPhish will prompt you to set a new password. Choose a password you will remember for this lab session.

You should now see the GoPhish admin dashboard with sections for Campaigns, Users & Groups, Email Templates, Landing Pages, and Sending Profiles.

Can't reach https://localhost:3333?

Make sure the GoPhish process is still running in your terminal. If you see an error about port 3333 being in use, check for other processes on that port with lsof -i :3333.
If you accidentally closed the terminal, navigate back to the GoPhish directory and re-run it:

cd ~/gophish && ./gophish

help me access the GoPhish admin dashboard

✔️ Awesome, I've got everything!

Great. Make sure both tools stay running. GoPhish occupies your current terminal, and the MailHog container runs in the background.

ⓧ I'd like to double check my config.json

Your config.json file in ~/gophish/ should have the phish_server section looking like this (other sections remain at their defaults):

"phish_server": {
  "listen_url": "0.0.0.0:8080",
  "use_tls": false,
  "cert_path": "example.crt",
  "key_path": "example.key"
}

Your phishing lab infrastructure is up and running. Next, you will use DNS reconnaissance to probe how real organizations protect their email domains.

Reconnaissance - Probe Email Security with DNS

Your phishing lab is up and running. GoPhish is ready to launch campaigns, and MailHog is standing by to catch every email safely.

Before you craft any phishing emails, a real penetration tester always starts with reconnaissance. You need to understand how your target protects its email domain. In this step, you will use DNS queries to examine the email security configurations of real organizations.

In this step, get ready to:

Query SPF records to see which IP addresses are authorized to send email for a domain.
Query DMARC records to understand how domains enforce email authentication.
Interpret these records from an attacker's perspective, mapping your work to the PTES Intelligence Gathering phase.

Query SPF records

SPF (Sender Policy Framework) records tell mail servers which IP addresses are allowed to send email on behalf of a domain. An attacker looks for domains with weak or missing SPF because those domains are easier to spoof.

Switch back to your terminal and query Google's SPF record by running this command:

dig TXT google.com | grep "v=spf1"

You should see output containing v=spf1 followed by a list of authorized senders (IP ranges and include statements).

What does this output mean?

The v=spf1 prefix identifies this as an SPF record. Everything after it lists who is authorized to send email for google.com.

The include: entries reference other domains whose SPF records are also trusted. The ~all or -all at the end tells receiving servers what to do with mail from unauthorized senders.

Not seeing any output?

Make sure you have internet connectivity. The dig command queries public DNS servers, so you need an active network connection.

If you see connection timed out, check that your network is working by running ping 8.8.8.8.

Help me troubleshoot why dig is not returning results

Query DMARC records

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do when SPF or DKIM checks fail. This is the record that actually enforces email security policy.

Query Google's DMARC record by running:

dig TXT _dmarc.google.com

Look for the p= value in the output. This is the policy that tells receiving servers how to handle emails that fail authentication.

What do the DMARC policy values mean?

p=reject means strict enforcement. Spoofed emails are blocked entirely.
p=quarantine means suspicious emails get sent to spam.
p=none means no enforcement. The domain is not actively blocking spoofed emails. An attacker would note this as a weakness.

Now compare a few more domains to see how different organizations handle email security:

dig TXT _dmarc.github.com

dig TXT _dmarc.microsoft.com

Compare the p= values across all three domains. Note which ones use p=reject (strong protection) versus p=none (no enforcement).

Understand what this means for a penetration tester

This intelligence gathering phase maps directly to the PTES "Intelligence Gathering" phase. In a real engagement, you would use these findings to shape your attack strategy.

How would an attacker use this information?

A penetration tester performing email reconnaissance looks for three things:

Domains with p=none or no DMARC record at all. These are easier to spoof because receiving servers won't reject forged emails.
Authorized mail services listed in SPF. This reveals what infrastructure the target organization uses (Google Workspace, Microsoft 365, etc.).
Missing DKIM records. Without DKIM, email integrity is not verified, which means message content can be tampered with in transit.

Document your findings like a professional penetration tester. Note which domains you queried, their SPF and DMARC configurations, and whether each domain has strong or weak email authentication.

Why document findings during recon?

Professional penetration testers document every step for two reasons. First, the final report needs evidence to support its risk assessments. Second, recon findings inform later attack decisions.

For example, if you find a target domain with p=none, you know spoofed emails from that domain will land in inboxes. That changes your entire phishing strategy.

You now have a clear picture of how real organizations protect their email domains. Next up, you will use this attacker's mindset to configure your GoPhish attack infrastructure and build a convincing phishing campaign.

Configure Your Attack Infrastructure in GoPhish

You now know how organizations defend their email domains using SPF, DKIM, and DMARC. The next step in the PTES methodology is preparing your attack infrastructure.

In a real engagement, a penetration tester configures their tools to send convincing phishing emails, target specific people, and harvest credentials. You will do exactly that inside GoPhish by creating a sending profile, a target group, and a credential-harvesting landing page.

In this step, get ready to:

Create a sending profile that connects GoPhish to MailHog.
Add fake target users to a group.
Build a credential-harvesting landing page.

Create a sending profile

A sending profile tells GoPhish which SMTP server to use when delivering phishing emails. You will point it at MailHog so every email stays safely on your local machine.

In the GoPhish dashboard, click Sending Profiles in the left sidebar.
Click New Profile.
In the Name field, enter Local Lab SMTP.
In the From field, enter IT Support <it-support@company-test.local>.
In the Host field, enter localhost:1025.
Leave the Username and Password fields empty. MailHog requires no authentication.

Why no username and password?

MailHog is designed as a development mail trap. It accepts any email on port 1025 without requiring credentials. In a real engagement, you would enter SMTP credentials for your authorized sending server.

Click Send Test Email to verify the connection.
In the dialog, enter any email address (e.g. test@test.local) and click Send.
You should see a green success message indicating the email was sent.
Switch to your MailHog tab at http://localhost:8025 and confirm the test email arrived in the inbox.
Return to the GoPhish tab and click Save Profile.

Test email not showing up in MailHog?

Make sure you entered the Host as localhost:1025 with the port number included. GoPhish requires the full host:port format.
Verify that your MailHog container is still running by switching to your terminal and running docker ps. You should see the mailhog container listed.
If the container stopped, restart it with docker start mailhog.

Why isn't my GoPhish sending profile connecting to MailHog?

Create a target group

Target groups define who will receive the phishing emails. In a real penetration test, you receive an authorized list of targets from your client. Here you will add two fictional users.

In the GoPhish sidebar, click Users & Groups.
Click New Group.
In the Group Name field, enter Test Targets.
Under the group member fields, enter the first user: First Name as John, Last Name as Doe, Email as john.doe@test.local.
Click Add to add John to the group.
Enter the second user: First Name as Jane, Last Name as Smith, Email as jane.smith@test.local.
Click Add to add Jane to the group.
Click Save Group.

You should see both users listed under the Test Targets group in the Users & Groups page.

Why fake email addresses?

These .local addresses do not resolve to real mailboxes. Since MailHog catches everything regardless of the recipient address, the emails will still be delivered to your local mail trap. No real people will ever receive these phishing emails.

Create a landing page

The landing page is what victims see after clicking the phishing link. This is where credential harvesting happens. GoPhish captures any data submitted through the form and logs it in your campaign results.

In the GoPhish sidebar, click Landing Pages.
Click New Page.
In the Name field, enter Fake Login Portal.
Check the Capture Submitted Data checkbox.
Check the Capture Passwords checkbox that appears.
Click the HTML tab in the editor to switch to raw HTML mode.
Paste the following HTML into the editor:

<html>
<head><title>Company Portal - Login Required</title></head>
<body style="font-family: Arial, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; background-color: #f0f2f5;">
<div style="background: white; padding: 40px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); width: 350px;">
<h2 style="text-align: center; color: #333;">Company Portal</h2>
<p style="text-align: center; color: #666;">Please verify your identity to continue</p>
<form method="POST">
<input type="email" name="username" placeholder="Email Address" style="width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ddd; border-radius: 4px; box-sizing: border-box;" required>
<input type="password" name="password" placeholder="Password" style="width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ddd; border-radius: 4px; box-sizing: border-box;" required>
<input type="submit" value="Sign In" style="width: 100%; padding: 12px; background-color: #4285f4; color: white; border: none; border-radius: 4px; cursor: pointer; font-size: 16px;">
</form>
</div>
</body>
</html>

What does this HTML do?

The form uses method="POST" so GoPhish can intercept the submitted data.
The name="username" and name="password" attributes tell GoPhish which fields contain credentials.
The styling mimics a generic corporate login page to appear legitimate to the target.

In the Redirect to field, enter https://www.google.com.
Click Save Page.

Why redirect after submission?

After a victim submits their credentials, GoPhish redirects them to a harmless page. This prevents suspicion. The victim thinks the login failed or that they ended up on the wrong page. In a real engagement, you might redirect to the company's actual login portal so the experience feels seamless.

You should now see Fake Login Portal listed on the Landing Pages page in GoPhish.

Landing page not saving?

Make sure you are in the HTML tab of the editor, not the visual editor. Pasting raw HTML into the visual editor will escape the tags.
Confirm that both Capture Submitted Data and Capture Passwords are checked before saving.

Help me troubleshoot my GoPhish landing page configuration.

Your attack infrastructure is ready. You have a mail server, a sending identity, targets, and a credential-harvesting trap. Next up, you will craft a convincing phishing email and launch your campaign.

Craft and Launch Your Phishing Campaign

Your attack infrastructure is fully configured. You have a sending profile connected to MailHog, a group of test targets, and a credential-harvesting landing page ready to capture logins.

Now it is time to enter the PTES "Exploitation" phase. You will craft a convincing phishing email, launch it at your targets, and walk through the full victim experience to see credentials flow from the landing page back into your GoPhish dashboard.

In this step, get ready to:

Create a phishing email template with urgency-based social engineering.
Launch a campaign that delivers phishing emails to your test targets.
Simulate the victim experience and capture test credentials.

Create an email template

A phishing email needs to create urgency and give the target a reason to click. The "password expiry" pretext is one of the most effective lures in real engagements because it triggers immediate action.

In the GoPhish dashboard, click Email Templates in the left sidebar.
Click New Template.
In the Name field, enter Password Expiry Notice.
In the Subject field, enter Action Required: Your password expires in 24 hours.
Check the Add Tracking Image checkbox. This inserts a tiny invisible image that notifies GoPhish when a target opens the email.
Click the HTML tab to open the HTML editor, then click Source to switch to the raw HTML view.
Paste the following HTML into the editor:

<html>
<body style="font-family: Arial, sans-serif; padding: 20px;">
<p>Dear {{.FirstName}},</p>
<p>Our security team has detected that your company account password will expire in <strong>24 hours</strong>.</p>
<p>To avoid losing access to your email and company resources, please verify your credentials immediately:</p>
<p style="text-align: center; margin: 30px 0;">
<a href="{{.URL}}" style="background-color: #d93025; color: white; padding: 14px 28px; text-decoration: none; border-radius: 4px; font-size: 16px;">Verify Account Now</a>
</p>
<p style="color: #666; font-size: 12px;">This is an automated message from IT Security. If you did not request this, please contact helpdesk@company-test.local</p>
<p>Best regards,<br>IT Security Team</p>
</body>
</html>

What do the template variables do?

GoPhish replaces template variables with real values when it sends each email. {{.FirstName}} becomes the target's first name (e.g., "John"), making the email feel personally addressed.

{{.URL}} becomes a unique tracking link for each recipient. When a target clicks it, GoPhish records the click event and serves your landing page. The unique link also lets GoPhish attribute each action to a specific target.

Click Save Template.

You should see Password Expiry Notice appear in your templates list.

Template not saving?

Make sure you pasted the HTML into the Source view (raw HTML mode), not the visual editor. If you paste raw HTML tags into the visual editor, they render as text instead of markup.

Also confirm the Name and Subject fields are both filled in. GoPhish requires both to save.

Help me troubleshoot my GoPhish email template

Launch the campaign

All the pieces are in place. The campaign ties together your email template, landing page, sending profile, and target group into a single coordinated attack.

Click Campaigns in the left sidebar.
Click New Campaign.
In the Name field, enter Password Expiry Test - Round 1.
From the Email Template dropdown, select Password Expiry Notice.
From the Landing Page dropdown, select Fake Login Portal.
In the URL field, enter http://localhost:8080. This is the address GoPhish inserts into {{.URL}} in your template.
From the Sending Profile dropdown, select Local Lab SMTP.
In the Groups field, select Test Targets.
Click Launch Campaign.
A confirmation dialog will appear. Click Launch to confirm.

What does the URL field control?

The URL field tells GoPhish where to point all {{.URL}} links in your template. It must point to GoPhish's phishing server (which you configured on port 8080 in Step 1). Each recipient gets a unique version of this URL with a tracking parameter (rid) appended, so GoPhish can attribute clicks to specific targets.

Your campaign is now live. GoPhish immediately sends the phishing emails through MailHog.

Campaign stuck on 'Queued'?

If your campaign shows emails as queued but not sent, confirm the MailHog container is still running. Switch to your terminal and run docker ps to check. If mailhog is not listed, restart it with docker start mailhog.

Help me troubleshoot my GoPhish campaign delivery

Simulate the victim experience

To verify your campaign is working end-to-end, you will now play the role of a target who receives, opens, and falls for the phishing email.

Open http://localhost:8025 in your browser to switch to the MailHog web UI.
You should see two phishing emails (one for John Doe, one for Jane Smith). Click on the email addressed to John Doe.
Read the email content. Notice how {{.FirstName}} has been replaced with John and the button contains a unique tracking link.
Click the Verify Account Now button in the email. This opens the fake login page at localhost:8080.
In the Email Address field, enter john.doe@test.local.
In the Password field, enter password123.
Click Sign In. You will be redirected to Google (the redirect URL you configured on the landing page).

Why does the page redirect to Google?

In a real phishing attack, the redirect makes the victim think they successfully logged in and got forwarded to a legitimate page. The credentials have already been captured by GoPhish before the redirect happens. The victim has no idea their password was just harvested.

Return to the GoPhish dashboard at https://localhost:3333.
Click on your campaign name Password Expiry Test - Round 1 to view the results.

You should see a timeline of events for John Doe: Email Sent, Email Opened, Clicked Link, and Submitted Data. Click on the submitted data entry to view the captured credentials.

What do these events mean?

Email Sent confirms delivery to the mail server.
Email Opened fires when the tracking image loads (the checkbox you enabled earlier).
Clicked Link records when the target visited the phishing URL.
Submitted Data captures everything the target typed into the landing page form.

Not seeing 'Email Opened' events?

The "Email Opened" event depends on the tracking image loading. Some email clients block images by default. In MailHog, try clicking the email's HTML tab to render it fully, which should trigger the tracking pixel. The other three events (Sent, Clicked, Submitted) are more reliable indicators.

Help me understand why GoPhish is not recording email opened events

You have just executed a full phishing campaign from email delivery through credential capture. Next, you will analyze these results and map your work to the PTES reporting framework.

Analyze Results and Write Your Report

Your phishing campaign has run its course. You launched emails, watched targets click, and captured credentials. Now comes the part that separates a real penetration tester from someone just running tools.

In this step, you will analyze your campaign data, export results, and write a professional report mapped to the PTES methodology. This is the Reporting phase, and it is what clients actually pay for.

In this step, get ready to:

Review campaign analytics and per-target timelines in GoPhish.
Export results as CSV and write an executive summary.
Map every project activity to the 7 PTES phases.

Review campaign analytics

The GoPhish campaign results page gives you the same analytics a professional red team would review after an engagement.

Return to the GoPhish admin dashboard at https://localhost:3333.
Click on Campaigns in the left sidebar.
Click on your campaign name Password Expiry Test - Round 1 to open the results page.

You should see the campaign results page with a timeline chart at the top and stat charts showing sent, opened, clicked, and submitted data counts.

Scroll down to the Details section. This table shows each target's Result ID, First Name, Last Name, Email, Position, and Status.
Expand a target row (click the arrow next to a recipient) to see their individual timeline of actions: when they received the email, when they opened it, when they clicked the link, and when they submitted credentials.

What should I see?

Each target should show a status of Submitted Data. When you expand a target's row, you see the exact timestamp for each event: Email Sent, Email Opened, Clicked Link, and Submitted Data.

In a real engagement, you would note the time between email delivery and the first click. A fast response time suggests the target did not scrutinize the email before acting.

Click on a target who submitted data to view their captured credentials.

What do these metrics mean for a penetration tester?

A real pentest report would include these key metrics:

Open rate: how many targets opened the email vs. how many received it.
Click-through rate: how many targets clicked the phishing link.
Submission rate: how many targets entered credentials on the fake portal.
Response time: how quickly targets acted after receiving the email.

Export and document findings

Professional engagements always produce documented evidence. GoPhish lets you export raw data and mark the campaign as finished.

On the campaign results page, click the Export CSV dropdown button near the top of the page.
Select Results to download a CSV file with each target's current status.
Click Export CSV again and select Raw Events to download the full event stream showing every action in chronological order.

What is in each CSV export?

The Results export contains fields like id, email, first_name, last_name, position, status, ip, latitude, and longitude. This gives you a snapshot of where each target ended up.

The Raw Events export contains a chronological stream of every event that occurred during the campaign. This is useful for building a detailed timeline in your report.

Click the Complete button (flag icon) at the top of the campaign results page.
Confirm when prompted to mark the campaign as completed.

Your campaign status now shows as completed. This is the equivalent of closing out an engagement.

Now write a brief executive summary as if you were delivering findings to a client. Open any text editor and include the following sections:

Campaign Objective: State that you conducted a phishing simulation to assess employee susceptibility to credential harvesting attacks.
Methodology: Note that you followed the PTES framework using GoPhish with a password-expiry pretext delivered via a local SMTP relay.
Key Findings: Record that 2/2 targets (100%) clicked the phishing link and submitted credentials on the fake login portal.
Risk Assessment: Explain that a 100% submission rate indicates no email filtering, no user awareness training, and no multi-factor authentication in place.
Recommendations: Suggest deploying email filtering, conducting security awareness training, and enforcing MFA on all accounts.

Keep it concise

A real executive summary is typically one page. Clients want clear findings and actionable recommendations, not a wall of technical detail. Save the deep technical content for the appendix.

Connect to the PTES framework

Everything you have done in this project maps directly to the 7 phases of the PTES (Penetration Testing Execution Standard). Understanding this framework is what makes you a methodical professional rather than someone who just clicked buttons.

Map each project activity to the corresponding PTES phase:

Phase 1 - Pre-engagement Interactions: You defined the scope by setting up a local lab with specific test targets. In a real engagement, this is where you agree on rules of engagement with the client.
Phase 2 - Intelligence Gathering: You performed DNS reconnaissance using dig to query SPF and DMARC records, learning how organizations protect their email domains.
Phase 3 - Threat Modeling: You chose a password-expiry pretext because it creates urgency, a common and effective social engineering pattern.
Phase 4 - Vulnerability Analysis: You identified that your test environment has no email filtering, no SPF enforcement, and no security awareness training in place.
Phase 5 - Exploitation: You launched the phishing campaign, delivered emails, and harvested credentials through the fake login portal.
Phase 6 - Post Exploitation: You analyzed what access those captured credentials would grant. In a real scenario, you would attempt lateral movement or privilege escalation.
Phase 7 - Reporting: You documented findings, exported evidence as CSV, and wrote an executive summary with risk assessment and recommendations.

Why does PTES matter?

Following a recognized methodology like PTES ensures your work is repeatable, defensible, and professional. Clients and auditors expect structured engagements, not ad-hoc hacking. When you write a pentest report, mapping your work to PTES phases demonstrates due diligence.

You now have a completed phishing engagement with documented results and a professional report structure. Next up, the Secret Mission challenges you to go deeper by crafting raw SMTP transactions at the protocol level.

Secret mission

Raw SMTP Hacking with swaks

You have launched a phishing campaign using GoPhish's GUI. But what happens at the protocol level when an email is sent? In this secret mission, you will drop down to raw SMTP and manually craft emails using swaks. This is the skill that separates operators who understand their tools from those who just click buttons.

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing costs. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

MailHog Docker container and image (local, in-memory storage, no cost).
GoPhish binary, database, and configuration files in ~/gophish.
Downloaded zip file ~/gophish-v0.12.1-linux-64bit.zip.

Keep everything running

No action needed. Choose this if you are still actively experimenting with your phishing lab or want to try more campaigns.

MailHog continues to catch emails on port 1025 and display them at http://localhost:8025.
GoPhish remains accessible at https://localhost:3333 as long as the process is running in your terminal.
The swaks and dnsutils packages remain installed on your system for future use.

Pause - I'll come back to this later

Shut down running processes to free up memory. Your files stay on disk so you can resume later.

Stop GoPhish by pressing Ctrl+C in the terminal where it is running.
Stop the MailHog container by running:

docker stop mailhog

When you are ready to resume, start MailHog and GoPhish again by running:

docker start mailhog
cd ~/gophish && ./gophish

Delete - I don't want to use this again

Remove all project resources and start fresh. This deletes the MailHog container and image, plus the GoPhish files from your system.

Stop GoPhish by pressing Ctrl+C in the terminal where it is running.
Remove the MailHog container and image by running:

docker rm -f mailhog
docker rmi mailhog/mailhog

Remove the GoPhish files and the downloaded zip by running:

rm -rf ~/gophish ~/gophish-v0.12.1-linux-64bit.zip

Optionally, remove the swaks and dnsutils packages if you no longer need them:

sudo apt remove -y swaks dnsutils

Nice Work!

You just built a complete email penetration testing lab and executed a phishing campaign using the same tools and methodology professional red teams rely on.

You've learned how to:

Set up a local phishing simulation lab with GoPhish and MailHog, creating a safe environment where no emails leave your machine.
Execute a full phishing campaign that captured test credentials, from crafting email templates and landing pages to analyzing victim interactions in real time.
Perform DNS reconnaissance on real domains and map your workflow to the PTES methodology used by professional penetration testers.
Secret Mission: Used swaks to manually craft raw SMTP transactions including spoofed emails, understanding email headers at the protocol level.

Ready to quiz yourself?