GoStats

Get statistics from GoPhish campaigns

Requirements

Pwdlyser - https://github.com/ins1gn1a/Pwdlyser

Installation and Usage

git clone the repo

chmod +x ./GoStats.php

Modify GoStats.php to contain your gophish URL, API key and path to pwdlyser

./GoStats.php

Example Output

root[/opt/GoStats]: ./GoStats.php
╔═╗┌─┐╔═╗┌┬┐┌─┐┌┬┐┌─┐
║ ╦│ │╚═╗ │ ├─┤ │ └─┐ v1.0
╚═╝└─┘╚═╝ ┴ ┴ ┴ ┴ └─┘
--help|-h                Shows help message
--list|-l                List campaigns and their ID's
--campaign|-c=integer    Get campaign by id
--dump|-d=string         Dump user:pass list to </path/to/file.txt>
--training|-t=string     Dump list of users requiring training </path/to/file.txt>
--all|-a                 All of the below options
--ips|-i                 Top 10 IP's
--useragent|-u           Top 10 user agents
--attempts|-m            Top 10 attempts to log in
--active|-o              Active times
--speed|-e               Clickthrough speed
--stats|-s               Victim statistics
--pass|-p                Password analysis with pwdlyser

root[/opt/GoStats]: ./GoStats.php -l
╔═╗┌─┐╔═╗┌┬┐┌─┐┌┬┐┌─┐
║ ╦│ │╚═╗ │ ├─┤ │ └─┐ v1.0
╚═╝└─┘╚═╝ ┴ ┴ ┴ ┴ └─┘
[+] Getting data from server
[id] -campaign name-
[33] Campaign_01
[60] Campaign_02

root[/opt/GoStats]: ./GoStats.php -c 60 -a
╔═╗┌─┐╔═╗┌┬┐┌─┐┌┬┐┌─┐
║ ╦│ │╚═╗ │ ├─┤ │ └─┐ v1.0
╚═╝└─┘╚═╝ ┴ ┴ ┴ ┴ └─┘
[+] Getting data from server
[60] Campaign_02

[+] Notable times
Campaign launched: 16-10-2017 09:28
First email sent: 16-10-2017 10:20
Last email sent: 16-10-2017 10:25
First email opened: 16-10-2017 10:28
First page view: 16-10-2017 10:28
First credentials submitted: 16-10-2017 10:29
Campaign finished: 21-10-2017 10:09

[+] Top 10 IPs
[177] 130.***.**.50 - United Kingdom, London
[96] 212.***.**.69 - France, 
[41] 86.**.**.2 - United Kingdom, Edgware
[32] 193.***.**.190 - United Kingdom, 
[28] 205.***.**.189 - United States, Chesterfield
[19] 86.***.***.47 - United Kingdom, Gillingham
[15] 82.**.**.34 - United Kingdom, Bradford-on-Avon
[14] 24.**.***.62 - United States, New York
[9] 66.**.**.130 - United States, West Jordan
[7] 2.**.**.183 - United Kingdom, London

[+] Top 10 User Agents
[60] WebClient/1.0
[32] Mozilla/4.0 (redacted details)
[30] Mozilla/4.0 (redacted details)
[29] Mozilla/4.0 (redacted details)
[26] Mozilla/4.0 (redacted details)
[26] Mozilla/4.0 (redacted details)
[22] Mozilla/4.0 (redacted details)
[20] Mozilla/5.0 (redacted details) Chrome/61.0.3163.100 Safari/537.36
[18] Mozilla/4.0 (redacted details)
[16] Mozilla/4.0 (redacted details) AppleWebKit/603.3.8 

[+] Top 10 Login Attempts
[19] b**********s@w***n.com
[12] b***************o@w***n.com
[8] n*************e@g*********e.com
[7] c****a@w***n.com
[7] s***************d@g*********e.com
[7] e**********r@w***n.com
[6] c*********m@w***n.com
[5] d******j@w***n.com
[3] j********d@a********l.com
[3] c***********n@a********l.com

[+] Active times (hour, actions & percent)
 0 -      =  0.00%  |  12 -   28 =  5.47% 
 1 -      =  0.00%  |  13 -   22 =  4.30% 
 2 -      =  0.00%  |  14 -   31 =  6.05% 
 3 -      =  0.00%  |  15 -   25 =  4.88% 
 4 -      =  0.00%  |  16 -   53 = 10.35% 
 5 -    1 =  0.20%  |  17 -    2 =  0.39% 
 6 -    5 =  0.98%  |  18 -   18 =  3.52% 
 7 -    9 =  1.76%  |  19 -    8 =  1.56% 
 8 -   21 =  4.10%  |  20 -      =  0.00% 
 9 -  134 = 26.17%  |  21 -    4 =  0.78% 
10 -  125 = 24.41%  |  22 -    1 =  0.20% 
11 -   24 =  4.69%  |  23 -    1 =  0.20% 
12 -   28 =  5.47%  |  24 -      =  0.00%

--- Rolling times (clicked link or submitted data) ---
10/16 9:00 - 9:30 = 6
10/16 9:30 - 10:00 = 89
10/16 10:00 - 10:30 = 18
10/16 10:30 - 11:00 = 19
10/16 11:00 - 11:30 = 6
10/16 12:00 - 12:30 = 4
10/16 12:30 - 13:00 = 1
10/16 13:00 - 13:30 = 1
10/16 13:30 - 14:00 = 7
10/16 14:30 - 15:00 = 5
10/16 15:00 - 15:30 = 3
10/16 15:30 - 16:00 = 9
10/16 16:30 - 17:00 = 1
10/16 18:00 - 18:30 = 13
10/16 19:30 - 20:00 = 8
10/17 6:30 - 7:00 = 2
10/17 10:00 - 10:30 = 3
10/17 12:00 - 12:30 = 4
10/17 16:30 - 17:00 = 23
10/18 9:30 - 10:00 = 1
10/18 11:30 - 12:00 = 4
10/18 16:00 - 16:30 = 4
10/19 7:30 - 8:00 = 1
10/19 18:30 - 19:00 = 3

[+] Clickthrough Speed
Quickest click: 2 sec
Longest click: 18 min
Users clicked < 5 sec: 7
Users clicked < 30 sec: 11
Users clicked < 1 min: 16

[+] Victim Statistics
Targets: 136
Email opened: 15 (11.03%)
Visited link: 20 (14.71%)
Submitted data: 20 (14.71%)
Total login attempts: 96

[+] Password Statistics
[+] Launching pwdlyzer
[!] pwdlyzer results at: /tmp/GoStats-VpGHth