GoPhish

Inspiration

As a student and full-time IT specialist with six years of hands-on experience, I’ve seen firsthand how often IT professionals have to respond to suspicious and phishing emails submitted by users. The typical process requires us to download the email, inspect the raw headers and data, copy that information into a verification tool, and manually determine whether the email is legitimate or malicious. I wanted to build a security tool that streamlines this process by automating the initial verification steps, helping IT professionals investigate suspicious emails faster and reducing the manual work involved.

What it does

GoPhish analyzes suspicious email headers and sender domains using live Google DNS-over-HTTPS (DoH) lookups and local heuristic checks to determine email legitimacy. Additionally, it features an integrated VirusTotal file-hashing workflow allowing IT staff to instantly cross-reference suspicious file attachments against global threat intelligence.

How we built it

The application is built entirely using vanilla HTML and client-side JavaScript as a standalone local web utility, leveraging internet connectivity to execute live DNS resolution lookups and API queries.

Challenges we ran into

My initial goal was to develop a native Microsoft Outlook add-in, but I ran into authentication and environment configuration roadblocks with Outlook accounts. While I initially wanted to build a Node.js backend, time constraints during the event forced me to pivot. I adapted the core concept into a lightweight, standalone local tool instead of a global deployment.

Accomplishments that we're proud of

I am proud to have successfully integrated the free Google DNS-over-HTTPS API to perform real-time domain resolution checks and incorporated VirusTotal file hash lookups to significantly enhance the overall security analysis of emails and attachments. This allows IT professionals to analyze suspicious emails with minimal manual effort.

What we learned

I learned how straightforward it is to prototype and deploy a standalone local application compared to navigating the tedious setup process of a live Outlook add-in. I also appreciated how seamlessly HTML and JavaScript work together to deliver a clean, intuitive user interface for IT personnel.

What's next for GoPhish

Moving forward, I plan to dive deeper into the Outlook add-in development ecosystem to resolve the initial authentication blockers. I also want to integrate additional threat intelligence APIs and refined heuristics to improve detection accuracy and minimize potential false positives. Also, make the UI more engaging than boring colors.

Built With

• html
• javascript