xiecat/goblin

Health v2 · maintenance only

Adoption not part of the score

1538 stars · 199 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Goblin is a phishing simulation system for red team/blue team security exercises, built in Go. It works as a reverse proxy that transparently captures user information, allows content modification and JS injection via plugins, and can hide the real server through CDN and SOCKS5 proxying.

Use cases

• run phishing awareness exercises for employees
• clone a login page to capture credentials in an authorized pentest
• reverse proxy a target site and inject JavaScript
• hide a phishing server's real IP behind CDN and socks5
• log and dump all HTTP requests during a phishing drill
• modify response content of a proxied website with plugins

When to choose

• you need a self-hosted phishing simulation platform for authorized red-blue exercises
• you want transparent credential capture via reverse proxy without affecting user experience
• you need plugin-based page content manipulation and JS injection
• you want request logging to ES, syslog, or files during drills

When to avoid

• you need an email-based phishing campaign platform - Goblin handles web proxying, not mail delivery
• you want a general-purpose web proxy for normal development use
• you lack authorization to test target systems - this is a dual-use offensive tool
• you need actively maintained software - the last release was May 2023

Facets

application · maturity maintenance

proxy security http-server plugin-system logging security penetration-testing web-development windows self-hosted cli phishing-simulation red-team blue-team reverse-proxy security-awareness-training honeypot linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="xiecat/goblin")