Goblin is a phishing simulation tool designed for red and blue team exercises that uses reverse proxy techniques to stealthily capture user information and manipulate web content.
一款适用于红蓝对抗中的仿真钓鱼系统
Goblin is primarily used by red and blue teams to conduct phishing drills and security awareness exercises by simulating realistic phishing scenarios without disrupting user operations. It enables security professionals to capture user interactions and modify web content dynamically, helping organizations test and improve their phishing detection and response capabilities.
When deploying on a server, ensure to update the server_ip or domain in the configuration to avoid connectivity issues. Using Goblin behind a CDN or proxy (e.g., Cloudflare) helps conceal the actual Goblin host IP for stealth. Properly configure plugins and JS injection modules to tailor phishing scenarios. Review log levels carefully to balance between detailed capture and performance. Joining the project’s user group (via QR code) may provide additional support and updates.
Pull the Docker image with: docker pull becivells/goblin
Create and switch to a working directory for Goblin
Run Goblin container with volume mount and port mapping: docker run -it --rm -v $(pwd):/goblin/ -p 8084:8084 becivells/goblin
Alternatively, download the appropriate binary from the GitHub releases page: https://github.com/xiecat/goblin/releases
Modify the configuration file parameters as needed according to the documentation
Refer to the official usage documentation for detailed config file instructionsdocker run -it --rm -v $(pwd):/goblin/ -p 8084:8084 becivells/goblin
Run Goblin container with local directory mounted and port 8084 exposed for proxy usage
docker run -it --rm -p 8083:8083 -p 8084:8084 -p 8085:8085 -p 8086:8086 becivells/goblin-demo-flash
Run the Goblin Flash demo for quick phishing simulation experience
goblin -config goblin.yaml
Start Goblin using the specified configuration file
goblin -log goblin.log -log-level 2
Start Goblin with logging enabled to record POST requests
goblin -gen-plugin <plugin_name>
Generate a plugin rule file for customizing Goblin behavior
goblin -print-config
Print the current configuration file contents
goblin -test-notice
Send a test message alarm to verify notification setup
goblin -v
Show the Goblin version