GitHub RadarDual-use project
Actively maintained, security-hardened fork of Gophish — the open-source phishing toolkit Primary language: Go. 7 stars.
Project links:Open GitHub projectBack to radar
<p align="center"> <img src="https://raw.github.com/raginx/gophish-ng/master/static/images/gophish-ng.png" alt="gophish-ng — a modernized, hardened fork of Gophish" width="960"> </p>
<h1 align="center">Gophish-NG</h1>
<p align="center"> <a href="https://github.com/raginx/gophish-ng/actions/workflows/ci.yml"><img src="https://github.com/raginx/gophish-ng/workflows/CI/badge.svg" alt="Build Status"></a> <a href="https://github.com/raginx/gophish-ng/blob/master/LICENSE"><img src="https://img.shields.io/github/license/raginx/gophish-ng" alt="License"></a> <img src="https://img.shields.io/github/go-mod/go-version/raginx/gophish-ng" alt="Go Version"> <a href="https://github.com/raginx/gophish-ng/releases/latest"><img src="https://img.shields.io/github/v/release/raginx/gophish-ng" alt="Latest Release"></a> <a href="https://github.com/raginx/gophish-ng/pkgs/container/gophish-ng"><img src="https://img.shields.io/badge/container-ghcr.io-blue" alt="Container Image"></a> <a href="https://github.com/raginx/gophish-ng/commits/master"><img src="https://img.shields.io/github/last-commit/raginx/gophish-ng" alt="Last Commit"></a> </p>
<p align="center"><strong>An actively maintained fork of Gophish, the open-source phishing toolkit.</strong></p>
<p align="center"> <img src="https://raw.githubusercontent.com/raginx/gophish-ng/master/docs/assets/screen_animation.gif" alt="Gophish-NG walkthrough: dashboard, campaign results, recipient timeline, and template/landing page examples" width="800"> </p>
---
Gophish is a widely used, battle-tested toolkit for running phishing simulations and security awareness training. Unfortunately, upstream `gophish/gophish` has had no commits since September 2024, go.mod still requires Go 1.13, and several of its core dependencies carry known CVEs — not great for a tool that security teams run inside their own networks.
This fork exists to keep that foundation solid, and to fill the gaps that show up when a team runs it. So far that's meant:
migration off the long-abandoned jinzhu/gorm (v1) to gorm.io/gorm (v2), the unmaintained bitbucket.org/liamstask/goose replaced with the actively maintained pressly/goose, and every dependency brought current. govulncheck findings went from 47 reachable vulnerabilities down to a single one with no upstream fix yet available.
the campaign delete dialog, a crash that could take down the whole process (not just one request), an SSRF-adjacent bug where configuring allowed_internal_hosts silently blocked all external traffic instead of just internal ranges, and an authorization bypass letting a locked-out user unlock their own account via their still-valid API key.
packages, two build systems quietly stepping on each other) replaced with a single esbuild script.
govulncheck, linting, andautomated dependency updates, none of which upstream had.
campaigns and assets instead of each working in their own silo; a read-only auditor role for reviewers and clients; OAuth 2.0 for IMAP reporting; SMTP CC and per-profile send rates.
Every change here is tested and verified against a running instance, not just "looks right." See CONTRIBUTING.md for how this fork is maintained and SECURITY.md for reporting vulnerabilities.
Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily set up and execute phishing engagements and security awareness training — landing pages, email templates, target groups, sending profiles, and per-recipient tracking, all through a single web UI.
Pre-built binaries for this fork are available on the releases page. Alternatively, build from source (see below). If you're looking for official upstream binaries instead, see the upstream releases page.
Requires Go 1.25 or above.
git clone https://github.com/raginx/gophish-ng.git
cd gophish-ng
go buildAfter this, you should have a binary called gophish in the current directory.
The built frontend assets (static/js/dist/, static/css/dist/) are checked into git, so this is all you need for a normal build. If you change anything under static/js/src/ or static/css/, rebuild them with:
npm install
npm run buildThis fork publishes its own Docker images to the GitHub Container Registry on every release:
docker pull ghcr.io/raginx/gophish-ng:latestConfiguration can be supplied via environment variables instead of mounting a config.json - see the Docker installation docs for the full list of supported variables.
After running the Gophish binary, open a browser to https://localhost:3333 and log in with the default username and password printed in the log output, e.g.:
time="2020-07-29T01:24:08Z" level=info msg="Please login with the username admin and the password 4304d5255378177d"The full user guide is available at [raginx.github.io/gophish-ng](https://raginx.github.io/gophish-ng/). Since this fork tracks upstream Gophish closely, the upstream documentation also mostly applies.
Found a bug specific to this fork? Please file an issue here. For issues that also affect upstream Gophish, consider checking the upstream issue tracker as well.
reinhard [at] westerholt [dot] me
MIT, same as upstream Gophish — see LICENSE for the full text.