EvilGoPhish
The ultimate combination of evilginx3 and GoPhish for advanced red team operations.
What is EvilGoPhish?
EvilGoPhish is a powerful red teaming tool that combines the proxy man-in-the-middle capabilities of evilginx3 with the comprehensive email campaign management features of GoPhish.
In simple terms, EvilGoPhish allows cybersecurity professionals to conduct sophisticated phishing campaigns that can bypass two-factor authentication (2FA) and multi-factor authentication (MFA) while maintaining detailed tracking statistics of campaign effectiveness.
// EvilGoPhish combines two powerful tools:
evilginx3 = "Proxy MitM framework for phishing credentials & session cookies"
gophish = "Open-source phishing toolkit for email campaigns"
evilgophish = evilginx3 + gophish // A complete solutionThis integration creates a complete solution for authorized penetration testing and red team engagements where operators have explicit written permission to conduct social engineering assessments.
The Logic Behind EvilGoPhish
EvilGoPhish was created to address three key limitations of using evilginx3 alone for social engineering engagements:
Lack of Tracking
evilginx3 doesn't provide unique tracking statistics per victim (opened email, clicked link, etc.), which is problematic for clients who need these statistics for social engineering engagements.
Incomplete Toolkit
evilginx3 only provides proxy man-in-the-middle capabilities; it doesn't provide functionality for sending emails or SMS messages to targets.
No GUI
The visual representation of data for a social engineering campaign is invaluable. Operators need a thorough understanding of campaign success through visual data representation.
By combining evilginx3 with GoPhish, EvilGoPhish creates a comprehensive solution that addresses all these limitations while maintaining the ability to bypass 2FA/MFA.
Key Features
2FA/MFA Bypass
Leverage evilginx3's proxy capabilities to capture authentication tokens and bypass multi-factor authentication mechanisms.
Comprehensive Tracking
Track detailed campaign statistics including email opens, link clicks, and credential submissions per victim.
Email Campaign Management
Use GoPhish to create, send, and manage sophisticated phishing email campaigns with detailed templates.
SMS Campaign Support
Conduct SMS-based phishing campaigns for comprehensive security assessments across multiple communication channels.
Real-time Notifications
Receive instant notifications of campaign events through a local websocket/HTTP server.
Cloudflare Turnstile Integration
Protect your phishing infrastructure from bots and automated detection systems.
GitHub Repository
Combination of evilginx3 and GoPhish for advanced phishing campaigns with 2FA/MFA bypass capabilities.
The official EvilGoPhish repository contains everything you need to get started with this powerful red teaming tool.
The public repository is free to use but may not contain the latest features. For the most up-to-date version with all features and bug fixes, consider supporting the developer through GitHub Sponsors.
EvilGoPhish Mastery (2025)
Master advanced phishing techniques with the most comprehensive training available for EvilGoPhish.
This extensive course is designed for advanced hackers, red teams, and penetration testers looking to master advanced phishing & smishing techniques with EvilGoPhish, one of the most powerful reverse-proxy phishing tools that combines both Evilginx3 & GoPhish.
"The course not only teaches you how to execute sophisticated phishing engagements with the latest pro version of Evil gophish 3.0 for your teams but also equips you with the proper knowledge and tricks to stay ahead."
EvilGoPhish Mastery
Frequently Asked Questions
What is EvilGoPhish?
EvilGoPhish is an integration of evilginx3 and GoPhish that provides a complete solution for conducting sophisticated phishing campaigns. It combines evilginx3's ability to bypass 2FA/MFA with GoPhish's campaign management capabilities, offering a comprehensive toolkit for authorized red team engagements.
How does EvilGoPhish differ from using evilginx3 or GoPhish separately?
EvilGoPhish addresses three main limitations of using evilginx3 alone: lack of tracking statistics per victim, absence of email/SMS sending capabilities, and no GUI. By integrating with GoPhish, EvilGoPhish provides detailed tracking, email delivery functionality, and a visual dashboard for campaign management while maintaining evilginx3's ability to bypass 2FA/MFA.
Is EvilGoPhish legal to use?
EvilGoPhish should only be used in authorized penetration testing or red team engagements where operators have been given explicit written permission to conduct social engineering. Any other use may violate laws regarding unauthorized access to computer systems.
What are the system requirements for running EvilGoPhish?
EvilGoPhish requires a Linux environment with internet access. The setup involves configuring evilginx3 to listen on an externally accessible address (typically port 443), while GoPhish runs locally on ports 8080 and 3333. Detailed setup instructions are available in the GitHub repository.
How does the Cloudflare Turnstile integration work?
EvilGoPhish integrates Cloudflare Turnstile technology to protect your phishing infrastructure from bots and automated detection systems. This replaces the previous approach of using redirect rules and IP blacklists, providing better protection against automated scanning of phishing infrastructure.
Where can I learn how to use EvilGoPhish effectively?
The most comprehensive training available is the EvilGoPhish Mastery (2025) course offered by Simpler Hacking. This course covers all aspects of setting up and using EvilGoPhish for advanced phishing campaigns, including detailed tutorials and best practices for red team engagements.