Hero Image
Gogophish - Turning Gophish into a Command Line Utility

Introducing gogophish: A Command-Line Tool for Gophish I wanted to use this blog post to introduce gogophish, a command-line tool to interact with the Gophish phishing framework. This tool is the result of the many lessons learned during social engineering pentests. It started out as a small program to do one thing, and additional features were added over time to solve problems and add flexibility. This post covers the basic functionality of the tool, some of its more unique features, and a couple of use cases where it really excels. Enjoy!

    Thursday, November 5, 2026 Read
    Hero Image
    Continuous Phishing Model

    The Observation After doing multiple phishing engagements, listening to client feedback, and having a customer pay to build phishing infrastructure for them, I’ve come to the realization that Phishing/Social Engineering pentest should move to a continuous subscription model and not just a point-in-time test. I still think point-in-time phishing engagements are a good thing, but I believe there is a huge value add for the client to phish throughout the year. Over the past couple of weeks, I have been building out the continuous phishing model. It is still in the rough draft stage, but the implementation is going to look like something below.

      Friday, February 20, 2026 Read
      Hero Image
      Basics of Reverse Proxying

      The Basics This is some basic info about reverse proxying The Tools These are the tools I use

        Saturday, September 20, 2025 Read
        Hero Image
        Repo Raider

        Hey Everyone! Last week, I had the opportunity for growth and development. That is, I get a week to be non-billable and get paid to learn and build tools. An absolute dream. And this particular GDT, I had the opportunity to code! I wrote some code to scan code repositories with trufflehog. The issue arose during a pentest, where I found a Github account with several dozen public code repositories. I wanted to check those repositories, but I didnt want to download each one and run trufflehog against it. So I wrote a script to download each repo in the account and run trufflehog against it. Work smarter, not harder. This repo currently supports Github and Docker. Gitlab support has been included, but I haven’t added it yet. It will be added shortly and I will probably try to combine everything into one script since there is so much code usage. The repo can be found at https://github.com/Cipolone95/RepoMole. Enjoy!

        Thursday, June 26, 2025 Read
        Hero Image
        Cackalacky Con

        This past weekend, I had the opportunity to speak at Cackalacky Con in NC about phishing! It was the perfect opportunity to see some friends and practice my public speaking! This little blog post is about my experience. The Talk: The talk was a 25 minute lightening talk with two LIVE demos! For context, I run most of the phishing engagements at my place of employment so I’ve seen/learned/discovered some things and I wanted to share them with the community. The hardest part was keeping the talk to 25 minutes! Due to the essence of time, I focused on

        Thursday, May 22, 2025 Read
        Hero Image
        ARTE (AWS Red Team Expert) Review

        Hi Everyone! I recent passed the ARTE (AWS Red Team Expert) certification and I wanted to write a short blurb on the course, the exam, and the entire experience. As with most things I say, these thoughts are my own and don’t necessarily reflect those of my employer, HackTricks, my religion, or anybody/anything else. Background: I am a pentester and have done cloud reviews before so some topics were a review for me. Additionally, I have the pentester mindset so I came into the course with the ability to enumerate well, think critically, and know when I am going down a rabbit hole.

        Monday, June 8, 2020 Read