Install Gophish Phishing Framework on Kali Linux

Gophish bundles phishing email delivery, landing pages, and campaign reporting in one admin console. This walkthrough installs the current upstream release on Kali, adjusts config.json for a typical lab where Apache already listens on port 80, and captures the first-run admin password from the terminal.

What is Gophish in ethical hacking?

Gophish is an open-source phishing framework aimed at security teams and penetration testers who run authorized social-engineering exercises. You manage campaigns from a web admin UI while a separate phishing listener serves cloned landing pages and tracks opens, clicks, and submitted credentials.

In an ethical hacking lab, Gophish replaces a pile of manual steps: one console holds user groups, email templates, landing pages, SMTP sending profiles, and per-recipient results. The binary is written in Go; upstream ships pre-built ZIP files for Linux amd64 so you do not need to compile for a standard Kali install.

This article stops at a working admin login. For sending profiles, templates, and launching a campaign, continue with create phishing campaign with Gophish.

Compare Gophish install methods

The steps below use the pre-built ZIP because it matches what most readers need and what we exercised on Kali Rolling 2026.2.

Kali lab setup

Set two variables so download URLs stay versioned and repeatable. I install under ~/gophish so the framework lives outside the git repo.

export GOPHISH_VERSION="0.12.1"
export GOPHISH_DIR="${HOME}/gophish"
mkdir -p "${GOPHISH_DIR}"

Confirm unzip is available. Kali images usually include it; install with sudo apt install unzip if unzip is missing.

unzip -v | head -2

UnZip 6.00 of 20 April 2009, by Debian. Original by Info-ZIP.

Latest sources and executables are on ftp://ftp.info-zip.org/pub/infozip/ ;

The version line confirms the unzip package from the intro table is on PATH.

Download Gophish from GitHub

Pull the official linux-64bit archive for the version you set in GOPHISH_VERSION. Download it with curl command using -fL so redirects succeed and truncated HTML error pages fail the step.

curl -fL -o "/tmp/gophish-v${GOPHISH_VERSION}-linux-64bit.zip" "https://github.com/gophish/gophish/releases/download/v${GOPHISH_VERSION}/gophish-v${GOPHISH_VERSION}-linux-64bit.zip"

When the download finishes, curl reports 100% of roughly 32 MB for v0.12.1.

Extract the ZIP into GOPHISH_DIR. The archive drops gophish, config.json, static/, templates/, and database migration SQL into that folder.

unzip -o "/tmp/gophish-v${GOPHISH_VERSION}-linux-64bit.zip" -d "${GOPHISH_DIR}"

Archive:  /tmp/gophish-v0.12.1-linux-64bit.zip
  inflating: /root/gophish/gophish
  inflating: /root/gophish/config.json
  inflating: /root/gophish/README.md
  inflating: /root/gophish/VERSION
 ...

The gophish binary and config.json at the top of the listing are the two files you interact with most after install.

Mark the server binary executable before the first run.

chmod +x "${GOPHISH_DIR}/gophish"

chmod exits silently on success. Next, confirm the bundle version matches the release tag.

cat "${GOPHISH_DIR}/VERSION"

0.12.1

Configure config.json before first start

config.json in the install directory controls the admin HTTPS listener, the phishing HTTP listener, and the SQLite database path. Open it before the first start so port conflicts and exposure match your lab.

On my Kali VM, apache2 already listened on port 80. The stock phish_server value 0.0.0.0:80 would make Gophish exit with bind: address already in use. I changed the phishing listener to port 8080 and left the admin server on localhost.

The effective layout looks like this:

{
	"admin_server": {
		"listen_url": "127.0.0.1:3333",
		"use_tls": true,
		"cert_path": "gophish_admin.crt",
		"key_path": "gophish_admin.key",
		"trusted_origins": []
	},
	"phish_server": {
		"listen_url": "0.0.0.0:8080",
		"use_tls": false,
		"cert_path": "example.crt",
		"key_path": "example.key"
	},
	"db_name": "sqlite3",
	"db_path": "gophish.db",
	"migrations_prefix": "db/db_",
	"contact_address": "",
	"logging": {
		"filename": "",
		"level": ""
	}
}

Key fields to understand:

• admin_server.listen_url — admin UI bind address; keep 127.0.0.1:3333 on a lab workstation unless you deliberately expose the console.
• phish_server.listen_url — URL victims hit in campaigns; port 80 needs root or a free listener, so 8080 is a common lab alternative.
• trusted_origins — add upstream proxy hostnames when TLS terminates in front of Gophish (v0.12.1+).
• db_path — SQLite file created on first run; back it up before upgrades.

Start Gophish and read the first-login password

From the install directory, run the binary in a terminal you can keep open (or under systemd later). The first start applies SQLite migrations and prints a one-time admin password.

cd "${GOPHISH_DIR}" && ./gophish

On a fresh database you see migration lines followed by the generated password:

time="2026-08-02T13:16:45-04:00" level=warning msg="No contact address has been configured."
time="2026-08-02T13:16:45-04:00" level=warning msg="Please consider adding a contact_address entry in your config.json"
goose: migrating db environment 'production', current version: 0, target: 20220321133237
OK    20160118194630_init.sql
OK    20160131153104_0.1.2_add_event_details.sql
...
OK    20220321133237_0.4.1_envelope_sender.sql
time="2026-08-02T13:16:46-04:00" level=info msg="Please login with the username admin and the password 54190a1ef7868e3b"
time="2026-08-02T13:16:46-04:00" level=info msg="Starting phishing server at http://0.0.0.0:80"
time="2026-08-02T13:16:46-04:00" level=fatal msg="listen tcp 0.0.0.0:80: bind: address already in use"

Your password hash differs every fresh install. Copy the Please login line immediately; Gophish does not store that random password in a file.

After switching phish_server to 0.0.0.0:8080, a successful start ends with both listeners running:

time="2026-08-02T13:17:12-04:00" level=info msg="Creating new self-signed certificates for administration interface"
time="2026-08-02T13:17:12-04:00" level=info msg="Starting phishing server at http://0.0.0.0:8080"
time="2026-08-02T13:17:12-04:00" level=info msg="Background Worker Started Successfully - Waiting for Campaigns"
time="2026-08-02T13:17:12-04:00" level=info msg="TLS Certificate Generation complete"
time="2026-08-02T13:17:12-04:00" level=info msg="Starting admin server at https://127.0.0.1:3333"

Waiting for Campaigns means the worker is idle and the admin UI is ready for login.

Log in to the Gophish admin console

Open a browser on the Kali host and go to https://127.0.0.1:3333. Accept the self-signed certificate warning the first time Gophish generates gophish_admin.crt and gophish_admin.key.

Log in with username admin and the password from the terminal. Gophish forces a password reset on first login; pick a strong replacement and store it in your password manager.

After login you land on the dashboard. Sending profiles need SMTP hostnames and paths that match your lab mail setup; SMTP enumeration on Metasploitable or your own Postfix instance surfaces candidate addresses before you import targets. The left navigation maps to the objects you assemble before any campaign:

Walk through sending profiles, templates, and the launch wizard in the create phishing campaign with Gophish guide. For why department-specific lures matter, see social engineering attacks.

Upgrade Gophish

To move to a newer release, download the new ZIP, extract into a fresh directory, and copy (do not move) your existing gophish.db and any custom TLS files into that directory. Run the new binary from the new folder; migrations run automatically on start.

export GOPHISH_VERSION="0.12.1"
export GOPHISH_DIR_NEW="${HOME}/gophish-${GOPHISH_VERSION}"
mkdir -p "${GOPHISH_DIR_NEW}"
curl -fL -o "/tmp/gophish-v${GOPHISH_VERSION}-linux-64bit.zip" "https://github.com/gophish/gophish/releases/download/v${GOPHISH_VERSION}/gophish-v${GOPHISH_VERSION}-linux-64bit.zip"
unzip -o "/tmp/gophish-v${GOPHISH_VERSION}-linux-64bit.zip" -d "${GOPHISH_DIR_NEW}"
cp "${HOME}/gophish/gophish.db" "${GOPHISH_DIR_NEW}/"
cp "${HOME}/gophish/config.json" "${GOPHISH_DIR_NEW}/"
chmod +x "${GOPHISH_DIR_NEW}/gophish"

Stop the old process before starting the new binary so only one instance holds your database and ports.

Stop and remove Gophish

Stop the running process from another terminal when you finish lab work.

pkill -f "${GOPHISH_DIR}/gophish"

Remove the install tree and downloaded ZIP when you no longer need the lab copy.

rm -rf "${GOPHISH_DIR}" "/tmp/gophish-v${GOPHISH_VERSION}-linux-64bit.zip"

Deleting gophish.db destroys campaign history. Archive it first if you need report screenshots for coursework or client deliverables.

Gophish install troubleshooting

References

• Gophish documentation
• Gophish GitHub repository
• Gophish releases
• Go programming language

Summary

You downloaded Gophish v0.12.1 from the official GitHub release, unpacked the linux-64bit ZIP on Kali, and made the gophish binary executable. Editing config.json before the first start avoids the common Kali pitfall where Apache already owns port 80; moving the phishing listener to 8080 lets the admin UI and phish server start together.

The first ./gophish run applies SQLite migrations and prints a one-time admin password in the terminal. Log in at https://127.0.0.1:3333, reset the password, and use the console navigation to confirm dashboard, templates, landing pages, and sending profiles are available. That console is the control plane for authorized simulations, not a shortcut for unsolicited email.

For the next lab step, wire SMTP, templates, and targets into a live campaign in the create phishing campaign with Gophish guide. Keep simulations on an isolated network from pentest lab setup and document authorization before any mail leaves your lab.