Social engineering — Guided walkthrough
A real campaign, five artifacts, all in an isolated lab. We simulate a small business boutique-eclair.ca with 5 fictional employees who receive a booby-trapped email. At the end, we read the statistics the way a client would.
This exercise uses fictional employees (fake email addresses on an internal lab SMTP server). You target no real person. No data leaves the lab. This is the only setting where you can learn phishing without human risk.
What you will be able to do after this lesson
- Install and configure Gophish in a lab.
- Generate a typosquatted domain with
dnstwist. - Write a convincing email with a pretext, stacked levers, a realistic signature.
- Clone a landing page and replace it with an awareness page.
- Analyze the campaign statistics and draw 3 recommendations from them.
The setup
Add to the existing lab:
- Kali attacker (
10.10.10.5) — you. - Gophish server (
10.10.10.30) — minimal Ubuntu 22.04, where Gophish runs. - Fictional target mail server (
10.10.10.40) — a Postfix/Dovecot that receives the mail and a Roundcube webmail to read it. - 5 fictional mailboxes:
alice@boutique-eclair.local,bob@,carla@,david@,emma@.
The domain boutique-eclair.local is resolved locally in the lab, via a shared /etc/hosts.
Step 1 — Install Gophish (10 min)
On the server 10.10.10.30, as root:
cd /opt
wget https://github.com/gophish/gophish/releases/latest/download/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip -d gophish
cd gophish
chmod +x gophish
# Edit config.json — admin listens on 3333, phishing server on 80
sed -i 's/127.0.0.1:3333/0.0.0.0:3333/' config.json
sed -i 's/127.0.0.1:80/0.0.0.0:80/' config.json
./gophish
Grab the temporary password shown at first launch:
[2026-04-20T14:22:11] Please login with the username admin and the password <temp-password>
From Kali, open https://10.10.10.30:3333, log in, change the password. You are in the interface.
Step 2 — Generate the typosquatted domain (5 min)
dnstwist -f json boutique-eclair.ca > variantes.json
jq '.[] | .domain' variantes.json | head -20
Typical output:
"bouttique-eclair.ca"
"boutlque-eclair.ca"
"boutique-eciair.ca"
"boutique-eclair.co"
"boutique-eclair-support.com"
"boutique-eclair-rh.com"
For the lab demo, we choose boutique-eclair-rh.local — the word rh makes the pretext consistent with the message we are preparing. We add it to the target's /etc/hosts (in the lab, this is a shortcut to avoid standing up a DNS).
On a real engagement, you buy the domain ~48 h ahead and configure SPF/DKIM/DMARC so you do not get dropped by the filter.
Step 3 — Configure Gophish (15 min)
In the Gophish interface, four screens to fill in, in this order:
3.1. Sending Profile (the SMTP)
Sending Profiles → New Profile
Name : Lab-SMTP
From : Sophie Tremblay <sophie.tremblay@boutique-eclair-rh.local>
Host : 10.10.10.30:25
Username : (empty in lab)
Password : (empty in lab)
Test → Send Test Email to alice@boutique-eclair.local. Alice receives it. Good.
3.2. Landing Page
Landing Pages → New Page
Import Site option — point it at http://boutique-eclair.local/rh/login. Gophish downloads the page and saves it.
Editing: check Capture Submitted Data (for school 1) OR uncheck it and redirect to an awareness page http://boutique-eclair-rh.local/sensibilisation.html (school 2, recommended for the demo).
Contents of sensibilisation.html — which you prepare separately:
<!DOCTYPE html>
<html>
<head><title>Phishing simulation — Training</title></head>
<body>
<h1>This was a test</h1>
<p>This email was a phishing simulation run as part of an authorized
security audit. No data was recorded.</p>
<p>You could have noticed:</p>
<ul>
<li>The sender domain (<code>boutique-eclair-rh.local</code>) differs
from the official domain (<code>boutique-eclair.ca</code>).</li>
<li>The excessive urgency ("before 5 p.m. today") is a classic
phishing lever.</li>
<li>The link pointed to an unusual subdomain.</li>
</ul>
<p>If in doubt in the future, forward the suspicious email to
<code>signalement@boutique-eclair.ca</code>.</p>
<p>Thank you for taking part in ongoing training.</p>
</body>
</html>
3.3. Email Template
Email Templates → New Template
Name : RH-nouveau-reglement
Subject : [URGENT] New HR policy — sign before 5 p.m. today
Envelope Sender : sophie.tremblay@boutique-eclair-rh.local
HTML content:
<div style="font-family: Arial; font-size: 14px;">
<p>Hi {{.FirstName}},</p>
<p>Management is asking us to have a <b>new internal policy</b> signed
before end of day. I already had 34 out of 42 colleagues approve it this
morning; if you could do the same it would be a huge relief for the
team.</p>
<p>Please use the link below, authentication is done with your usual
account:</p>
<p><a href="{{.URL}}">Sign the HR policy — click here</a></p>
<p>Best regards,<br>
Sophie Tremblay<br>
Human Resources Department<br>
Boutique Eclair Inc.</p>
{{.Tracker}}
</div>
The {{.FirstName}} and {{.URL}} are substituted by Gophish at send time. {{.Tracker}} is an invisible pixel that records the open.
3.4. Users & Groups
Users & Groups → New Group
Import a CSV cibles.csv:
First Name,Last Name,Email,Position
Alice,Martin,alice@boutique-eclair.local,Accountant
Bob,Nguyen,bob@boutique-eclair.local,Developer
Carla,Ross,carla@boutique-eclair.local,Customer support
David,Poulin,david@boutique-eclair.local,Project manager
Emma,Kadri,emma@boutique-eclair.local,Marketing
Group name: Lab-cibles-5.
Step 4 — Launch the campaign (2 min)
Campaigns → New Campaign
Name : Semaine 6 - Nouveau reglement RH
Email Template : RH-nouveau-reglement
Landing Page : (the one created above)
URL : http://10.10.10.30
Launch Date : Now
Sending Profile : Lab-SMTP
Groups : Lab-cibles-5
Launch Campaign button. Gophish sends the 5 emails.
Step 5 — Victim behavior (10 min)
Open the Roundcube webmail at http://10.10.10.40/roundcube, log in with each account in turn to check delivery. Let's simulate five different behaviors:
| User | Behavior |
|---|---|
| Alice | Opens the email, does not click. |
| Bob | Opens, clicks, lands on the awareness page. |
| Carla | Opens, ignores. |
| David | Opens, clicks, enters a password (school 1 only). |
| Emma | Opens, forwards to signalement@boutique-eclair.ca. |
Each action is recorded by Gophish thanks to:
- The pixel in the email (open).
- The
ridparameter in the link URL (click). - The submitted form (school 1, capture).
Step 6 — Read the statistics (10 min)
In Gophish, open the running campaign. The dashboard gives you, in order:
Emails Sent : 5
Emails Opened : 4 (80%)
Emails Clicked : 2 (40%)
Emails Submitted Data : 1 (20%) <- school 1 only
Emails Reported : 1 (20%)
Click Timeline to see the exact chronology:
14:22:11 — Campaign Created
14:22:12 — Email Sent to alice@boutique-eclair.local
14:22:12 — Email Sent to bob@...
...
14:23:44 — Email Opened by alice@boutique-eclair.local
14:24:11 — Email Opened by bob@...
14:24:21 — Clicked Link by bob@... (User-Agent: Mozilla/5.0, IP: 10.10.10.40)
14:25:03 — Email Opened by david@...
14:25:18 — Clicked Link by david@...
14:25:47 — Submitted Data by david@... (creds captured)
14:27:11 — Email Reported by emma@...
Three important observations:
- Emma reported it in 5 minutes. Excellent. The client's SOC should aim for 100% of emails reported in under 15 min.
- David entered his password. He should receive discreet individual training (never in public).
- Bob clicked but did not submit. He saw the awareness page. Objective met: he learned something.
Step 7 — Generate the report for the client (15 min)
Open ~/labs/semaine-06/rapport/phishing.md. No individual names in the aggregated statistics. A single separate list holds the names — handed to the HR director only, in a separate envelope.
# Phishing campaign — Aggregated report
## 1. Objective
Measure the phishing susceptibility of a sample of 5 employees,
with a realistic scenario combining authority, urgency, and social proof.
## 2. Frame
- Authorization: Boutique Eclair mandate of 2026-04-15, section 4.
- Window: Wednesday 2026-04-20, 14:00-14:30 (ET).
- Pretext: new HR policy, urgent signature.
- Vector: HTML email from boutique-eclair-rh.local.
## 3. Aggregated results
| Metric | Value | % |
| ----------------------- | ------ | -- |
| Emails sent | 5 | 100 |
| Emails opened | 4 | 80 |
| Clicks on the link | 2 | 40 |
| Credentials submitted | 1 | 20 |
| Reports to the SOC | 1 | 20 |
| Time to first report | 5 min | - |
## 4. Analysis
The click rate (40%) is close to industry observations (25-45%).
The submission rate (20%) suggests a need for targeted training. The
report rate (20%) is acceptable but can be doubled with a quarterly
awareness campaign.
## 5. Recommendations
1. A 30-minute "phishing" training, mandatory yearly. Cost: negligible.
2. Quarterly internal simulation. Cost: Gophish-type tooling, 1 day/month.
3. Move DMARC to "quarantine" (currently "none"). This will reduce
externally spoofed emails.
## 6. Appendices
- Full timeline: timeline.csv (anonymized)
- Content of the phishing email: mail-source.html
- Awareness page shown to the victims: sensibilisation.html
Step 8 — The debriefing (10 min)
Two complementary deliverables, handed over separately:
- The aggregated report (above) — to management and IT.
- The nominative list of clickers — to the HR director alone, marked "do not distribute". It is used to organize individual training, never to punish.
In the RoE (week 2), you will have specified: "Individual data is destroyed 90 days after delivery. No penalty may result from the simulation."
Without this frame, your engagement causes more damage than value.
Wrap-up
In 90 minutes, in an isolated lab:
- You stood up Gophish from scratch.
- You sent 5 emails with a solid pretext and 4 stacked levers.
- You measured 5 different metrics.
- You produced an aggregated report that names no one.
- You prepared a nominative list for the HR director.
You now know how to run useful phishing. Week 6 is also when Assignment 1 of the course is due (see the course index).
Next lesson: your turn. A new campaign, a new pretext, in the same lab, with a variation of your choosing.