Gophish: Question/Discussion/Feature: Mark fake/test logins as "false positive"

[blacklist-arcc]

What version of Gophish are you using?:
0.10.1

Brief description of the issue:
In some situations users detect the fake-landingpage and produce fake/test logins which are counted as valid submissions. The changes in the overall statistics due to fake submissions are significant in small campaigns and change the overall picture.

What are you expecting to see happen? :
A possible solution could be to mark the affected login data as false positive, which will not be counted in the overall statistics. They could also be marked as reported at the same time.

I have not found any related issue to this topic so i want to start a small discussion here. What are your thoughts on this?

Best regards!

[jordan-wright]

Hey there!

I can appreciate the desire to do this. It's possible that I'll do something like this in the future, but for now there's a pretty long list of things in front of it.

I'll keep this issue open until I figure out the longterm 👍 or 👎 on this.

Thanks for sending this in!

[blacklist-arcc]

Thanks for your fast response. I think we can help to get this feature into gophish. Maybe you can provide your thoughts in which way this can be implemented. We will try to create a PR ;) I think it's nearly impossible without database changes.

[JOBERO81]

@jordan-wright
Hey,
I work with @blacklist-arcc and would like to take care of this issue.
If you have any hints or suggestions for me I would appreciate it very much.
Best regards

[blacklist-arcc]

@jordan-wright: @JOBERO81 is working with me on this project. I would be happy if you write a few more thoughts about it so we can start on the right path

[glennzw]

Hi @blacklist-arcc and @JOBERO81; if you're still interested in pursuing this feel free to submit a PR. There's some documentation on source code here: https://pkg.go.dev/github.com/gophish/gophish

I'd imagine this solution would require:

• Database change (adding a new field 'FalsePositiveSubmission' or some such. This would need to be tied to the event.
• Front end changes to add a toggle button, similar to the current reported button
• API/backend changes to handle the request from the UI and update the database

[blacklist-arcc]

Hey thanks for your comment. @JOBERO81 is not working on this task anymore. I will go into this next week's and submit a PR. I agree with your thoughts and will keep you updated

[blacklist-arcc]

Thoughts: The "mark as false positive" button on a specific event checks if the RID has any non false positives submit events. If not the status should be reverted to "Linked Clicked" in order to correct the statistics. Also the user should be able to decide if he wants to mark the rid as reported as well.

[JOBERO81]

I'm not sure, but maybe the Java Script will not create the submited Data field if it's reset to clicked link.
So my thought was to minus the submited Data counter for any fals positive flag.

[blacklist-arcc]

Ah was a bit to obvious for me. Thanks for the input this can be a smart solution

[JOBERO81]

Sure, If you want my documentation in this, i can give you. It ist almost done, but the setting of the Data field and the API call and the minus of the counter is not finished.--Diese Nachricht wurde von meinem Android Mobiltelefon mit WEB.DE Mail gesendet.Am 10.03.21, 20:00 schrieb Paul Werther [e-mail]:

Ah was a bit to obvious for me. Thanks for the input this can be a smart solution
—You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or unsubscribe.