S-VYASA DEEMED TO BE UNIVERSITY,
SCHOOL OF ADVANCED STUDIES
SATTVA GLOBAL CITY,MYSORE ROAD,BENGALURU-560059
“ETHICAL HACKING AND VAPT (MCCE346)”
PROJECT REPORT ON “PHISHING ”
Submitted in partial fulfilment of the requirements for the course of the 3rd semester.
MASTER OF SCIENCE IN COMPUTER SCIENCE
SUBMITTED BY
DEEKSHA P - 2232408002
UNDER THE GUIDANCE OF
[Link] B
ASSISTANT PROFESSOR DEPARTMENT OF CSE
S VYASA SCHOOL OF ADVANCED STUDIES , BENGALURU
2024 – 2025
S-VYASA(DEPARTMENT OF C S)-MSC CEH AND CF [2232408002]
1
OBJECTIVE
The objective of this project was to understand how phishing attacks work and to design a
controlled, simulated phishing campaign using GoPhish. The aim was to raise awareness
among users and demonstrate defenses without collecting real credentials or harming
participants.
LEARNING OUTCOMES
By completing this project, I learned to:
● Explain the social engineering lifecycle.
● Design a simulated phishing email and landing page safely.
● Measure and analyze user response rates ethically.
● Recommend awareness and technical defenses against phishing.
PROJECT SET UP
Tools Used:
● GoPhish: Open-source phishing simulation platform.
● MailHog: Dummy SMTP server to catch emails safely.
● HTML editor: For landing page customization.
● CSV file: Test participant emails (consented classmates).
S-VYASA(DEPARTMENT OF C S)-MSC CEH AND CF [2232408002]
2
SETUP PROCEDURE
1. Installed GoPhish on a local VM.
2. Configured SMTP with MailHog (dummy mail server).
3. Added test participants to a group called “Test Class Group”.
4. Created a safe email template and landing page.
CAMPAIGN DESIGN
Campaign Name: Student Portal Password Update
Email Template: Student Portal Password Update
Landing Page: Fake Student Portal Login
URL: [Link] (local simulation)
Sending Profile: University Notification Profile
Target Group: Test Class Group
Launch Date: November 15th, 2025 – 1:50 AM
Email Body Example:
Dear Student,
We are conducting a routine security update for the University Student Portal.
Your account requires a password update to continue accessing academic
services.
Click here to update your password: {{.URL}}
This is part of regular maintenance.
If you have already updated your password, please ignore this message.
Regards, University IT Services
S-VYASA(DEPARTMENT OF C S)-MSC CEH AND CF [2232408002]
3
Landing Page Message:
“This was a simulated phishing test. Never enter credentials on unverified
pages.”
Figure 1: Campaign Timeline in GoPhish
S-VYASA(DEPARTMENT OF C S)-MSC CEH AND CF [2232408002]
4
Figure 2: Email Template Screenshot
Figure 3: Landing Page Screenshot
Note: Emails were not delivered due to the use of a dummy SMTP server. The purpose
of the exercise was to demonstrate the simulation workflow safely.
S-VYASA(DEPARTMENT OF C S)-MSC CEH AND CF [2232408002]
5
Analysis & Lessons Learned
● Users may click links if the email looks credible.
● Phishing can exploit trust and urgency (e.g., “password update required”).
● Awareness campaigns help teach users to verify URLs before clicking.
● Even dummy campaigns can teach reporting suspicious emails.
Recommendations
● Conduct regular phishing awareness training.
● Implement multi-factor authentication (MFA).
● Apply email authentication protocols (SPF, DKIM, DMARC).
● Encourage users to report suspicious emails promptly.
Reflection
This project helped me understand social engineering tactics and the importance of ethical
simulation. I learned how phishing campaigns are designed, how they can be simulated
safely, and the importance of raising awareness without compromising real user data.”
References
● GoPhish Official Documentation – [Link]
● MailHog – [Link]
● OWASP Social Engineering Awareness – [Link]
● Google Workspace Security Best Practices
S-VYASA(DEPARTMENT OF C S)-MSC CEH AND CF [2232408002]
6