chrismaddalena
commented
7 years ago Hi Robin,
Thanks for the feedback and the question. I am aware of this and have kicked around some different ideas a few times. First, I'll try to add the version of this stat you're looking for into the results produced by GoReport. It's the difference between counting the number of events and counting the number of recipients with one of those events. That shouldn't be difficult and I'm currently working on a very big update. I can probably squeeze it into that update, which I hope to have done this week or next.
That said, and assuming asking my opinion on this subject means you want my take on how these statistics can be used, I'll say phishing statistics are complicated. What your management wants is typical. How many people clicked? Can we get that number lower?
However, seeing both versions of the stat can reveal interesting trends. I've tried to infuse GoReport with checks for some of the events I like to look for when I review phishing results, but you'll always need to do a manual review to catch some of the most interesting events.
For example, what does it mean if one recipient clicked three times and has four different IP addresses tied to them? The details might show multiple user-agents that, when combined with the IP address info, reveal this person viewed the email on their phone using an LTE connection, clicked on their phone on the company's BYOD WiFi, clicked again on their work laptop, and then again later that evening at home. If you're seeing a lot of that sort of behavior (maybe not so extreme) that might change how you view the company's security awareness and training needs. It paints a very different, and more complete, picture than showing that person clicked at least once.
You can also catch emails that were forwarded to other people. I have seen emails travel through two or more people, each one clicking the link, even when those recipients weren't on my target list or didn't click their own emails. You'll see unusual activity sometimes and then you may have to ask the person what they did to understand how you ended up with 5 clicks from 3 IP addresses.
However, a lot of this depends on how much time you can really spend on this project and what the end game is for you and your team.
On the subject of the "opened" events, those are tough figures to use. It's really just showing you how many people are willing to let an email load remote content. it's a good indicator your emails have reached inboxes while the campaign is new and active, but after that it's a much less useful figure.
I'll split-up the stats to show the total events and the total number of targets with at least one opened/clicked/submitted event. My advice is take a look at both versions. If you notice a big difference, that might mean you have some people clicking/submitting more than once.
RobinXaXa
Hi Chris,
First of all I'd like to thank you for your work on this script you've got some nice work done here :) I have a few questions and maybe some ideas to enhance the coherence of gophish statistics
To put on some context, we've laucnhed a few phishing campaigns in my company, The top managment were only interested by the click rate (mail opened / link clicked)
I think it would be interesting to have that statistic in the "high level results", I see two points which need some attention:
to this day you count the total of mail opened even if the same user has opened the mail several times as an exemple: i had a campain running with around 1k targets and i got 2k "opened" events
I guess it's the same thing with the "clicked link" event
What's your opinion on this subject ?
Regars, Robin