goCabrito: Super organized and flexible script for sending phishing campaigns

by do son · December 7, 2021

goCabrito

Super organized and flexible script for sending phishing campaigns.

Features

Sends to a single email
Sends to lists of emails (text)
Sends to lists emails with first, last name (csv)
Supports attachments
Splits emails in groups
Delays sending emails between each group
Support Tags to be placed and replaced in the message’s body
- Add {{name}} tag into the HTML message to be replaced with name (used with –to CSV).
- Add {{track-click}} tag to URL in the HTML message.
- Add {{track-open}} tag into the HTML message.
- Add {{num}} tag to be replaced with a random phone number.
Supports individual profiles for different campaigns to avoid mistakes and confusion.
Supports creating a database for sent emails, each email with its unique hash (useful with getCabrito)
Supports dry test, to run the script against your profile without sending the email to test your campaign before the launch.

Qs & As

Why not use goPhish?

goPhish is a great choice too. But I prefer flexibility and simplicity at the same time. I used goPhish various times but at somepoint, I’m either find it overwhelming or inflexible.

Most of the time, I don’t need all these statistics, I just need a flexible way to prepare my phishing campaigns and send them. Each time I use goPhish I’ve to go and check the documentation about how to add a website, forward specific requests, etc. So I created goCabrito and getCabrito.

getCabrito optionally generates a unique URL for email tracking.

Email Opening tracking: Tracking Pixel
Email Clicking tracking

by generating a hash for each email and appending it to the end of the URL or image URL and storing this information along with other things that are useful for getCabrito to import and serve. This feature is the only thing that connects goCabrito with the getCabrito script, so no panic!.