Social engineering toolkit kali linux инструкция

Social engineering toolkit is a free and open-source tool that is used for social engineering attacks such as phishing, faking phone numbers, sending SMS, etc. it’s a free tool available in Kali Linux or you can directly download and install it from Github. The Social Engineering Toolkit is designed and developed by a programmer named Dave Kennedy. This tool is used by security researchers, penetration testers all around the globe for checking cybersecurity flaws in systems. Social engineering toolkit targets to perform attacking techniques on their machines. This tool kit also offers website vector attacks or custom vector attacks by which you can clone any website and can perform phishing attacks. There are various features of the social engineering toolkit some of them are given below.

Social Engineering Toolkit  in Kali Linux .

Features of Social Engineering toolkit:

  • SET is free and Open Source
  • SET is already installed in your Kali Linux however you can also download and install it from Github.
  • SET is portable, which means you can easily change attack vectors.
  • SET is a Multi-platform tool: It can run on Linux, Unix, and Windows.
  • SET Supports integration with third-party modules.
  • SET Includes access to the Fast-Track Penetration Testing platform
  • SET provides many attack vectors such as Spear-Phishing Attacks, Website Attacks, Infection Media Generator etc.

Uses of Social Engineering Toolkit:

  • Phishing Attacks: Social Engineering Toolkit allows you to perform phishing attacks on your victim. By using SET you can create phishing pages of many websites such as Instagram, Facebook, Google, etc. SET will generate a link of the option that you have chosen, and then you can send that URL to the victim once the victim open that URL and he /she will see a legitimate webpage of a real website which is actually a phishing page .once he/she entered his/her id password then you will get that id password on your terminal screen this is how phishing attack using SET works.
  • Web Attack: Web Attack is a module in SET. This module combines different options for attacking the victim remotely by using this module you can create a payload and can deliver payload onto your victim browser using Metasploit browser exploit. web attack has  Credential Harvester method using which you can clone any website for a phishing attack and can send the link of that webpage to the victim to harvest the information from user and password fields.
  • Create a Payload and Listener: when you will first run the Social Engineering Toolkit. You will see the 4th option which is to create a payload and listener by using that module of SET you’ll be able to create malicious payloads for Windows, including Shell Reverse_TCP, Reverse_TCP Meterpreter, Shell Reverse_TCP X64, and Meterpreter Reverse HTTPS. You can use these payloads in the same way how you use payloads from metasploitable.
  • Mass Mailer Attack: mass mailer attack is a module in the social engineering toolkit that is used for bombarding emails on target mail account for that you can use your own Gmail account also or you can own a server for that.

These were some attack vectors that you can perform using Social Engineering Toolkit .when you will run the SET you will feel fun because using SET is very easy now we will see how you can install Social Engineering Toolkit and how you can use it for phishing attack.

Installation of Social engineering toolkit :

Step 1: Open your Kali Linux Terminal and move to Desktop 

cd Desktop 

Social Engineering Toolkit  in Kali Linux .

Step 2: As of now you are on a desktop so here you have to create a new directory named SEToolkit using the following command.

mkdir SEToolkit

Social Engineering Toolkit  in Kali Linux .

Step 3: Now as you are in the Desktop directory however you have created a SEToolkit directory so move to SEToolkit directory using the following command.

cd SEToolkit

Social Engineering Toolkit  in Kali Linux .

Step 4: Now you are in SEToolkit directory here you have to clone SEToolkit from GitHub so you can use it.

git clone https://github.com/trustedsec/social-engineer-toolkit setoolkit/

Social Engineering Toolkit  in Kali Linux .

Step 5: Social Engineering Toolkit has been downloaded in your directory now you have to move to the internal directory of the social engineering toolkit using the following command.

cd setoolkit

Social Engineering Toolkit  in Kali Linux .

Step 6: Congratulations you have finally downloaded the social engineering toolkit in your directory SEToolkit. Now it’s time to install requirements using the following command.

pip3 install -r requirements.txt

Social Engineering Toolkit  in Kali Linux .

Step 7: All the requirements have been downloaded in your setoolkit. Now it’s time to install the requirements that you have downloaded 

python setup.py

Step 8: Finally all the processes of installation have been completed now it’s time to run the social engineering toolkit .to run the SEToolkit type following command.

setoolkit

Social Engineering Toolkit  in Kali Linux .

Step 9: At this step, setoolkit will ask you (y) or (n). Type y and your social engineering toolkit will start running.

y

Social Engineering Toolkit  in Kali Linux .

Step 10: Now your setoolkit has been downloaded into your system now it’s time to use it .now you have to choose an option from the following options .here we are choosing option 2

Website Attack Vectors:

option : 2

Social Engineering Toolkit  in Kali Linux .

Step 11: Now we are about to set up a phishing page so here we will choose option 3 that is the credential harvester attack method.

Option : 3

Social Engineering Toolkit  in Kali Linux .

Step 12: Now since we are creating a Phishing page so here we will choose option 1 that is web templates.

option 1

Social Engineering Toolkit  in Kali Linux .

Step 13: At this time the social engineering tool will generate a phishing page at our localhost.

Step 14: Create a google phishing page so choose option 2 for that then a phishing page will be generated on your localhost.

Step 15: Social engineering toolkit is creating a phishing page of google.

Social Engineering Toolkit  in Kali Linux .

As you can see on our localhost means on our IP address setoolkit created a phishing page of google. This is how the social engineering toolkit works. Your phishing page will be created by social engineering toolkit. Once the victim types the id password in the fields the id password will be shown on your terminal where SET is running.

Last Updated :
05 Oct, 2021

Like Article

Save Article

The Social Engineering Toolkit (SET) is a Kali Linux operating system software program. SET is a powerful tool for conducting various social engineering attacks, including phishing, spear-phishing, and other social engineering attacks.

Multiple attack vectors: SET provides a variety of attack vectors, including email, SMS, USB, and more.

Easy customization: SET makes it easy to customize the attack payloads to suit the target environment and objectives.

Automated attack workflows: SET automates the entire attack workflow, from payload creation to delivery, making it easy for non-technical users to carry out social engineering attacks.

Built-in reporting: SET provides detailed reporting on the success and failure of the attack, allowing users to evaluate the effectiveness of their social engineering campaigns.

Let’s see some of the options of SET in action.

Creating a  payload using Social Engineering Tool Kit in Kali Linux and exploiting it.

  • Under “Social Engineering attacks” select “Create a Payload and Listener.”
  • Select “Windows Reverse_TCP Meterpreter”
  • Enter LHOST and LPORT.
Generating Payload
  • A payload exe file will be saved: /root/.set/payload.exe

After the above steps, msfconsole will be launched automatically with all the payloads set.

  • Send the payload to the victim using any phishing technique. When the victim executes the payload file, immediately attacker will receive the reverse shell to the victim’s machine.

Using Social Engineering Tool Kit Generates QR Code

  • We can see our QRCode generated.

  • Scanning this QR will take the user to the evil website.

Now using any email-sending technique from the same toolkit, send the QRCode. I’ll use the Mass Mailer option from the menu for this demo.

Select Mass Mailer and enter the required details, as shown in the image below.

After giving body, it will automatically send the email to the victim.

Performing basic Pen-testing using Social Engineering Tool Kit.

  • Target Host – rexxxxd.ac.in
  • Our target URL uses WordPress  for managing its content.
  • MySQL and Redis databases are being used at the backend.
  • Operating Systems: Ubuntu.

Furthermore, it uses various JavaScript libraries and Apache Webserver.

  • Our target seems to use shared web hosting owned by TataTeleServices.

The above image gives us more detail about our target, like the IP address and the target’s location.

There are two open ports and details of the same, including SSL certificates of the website. 

  • The target is vulnerable to over 40+ vulnerabilities. Details of the same and CVEs assigned to them are available using them, and the target can be exploited.

Step-by-step process of getting  ID  and  Password

  • Select Website Attack Vectors from the SET options.
  • Select Credential Harvester Attack Method -> Web Templates -> Press Enter -> Select Google.
  • The IP address shown above is hosting the fake Google sign-in page. Now an attacker can change the ip address into a URL using any online tool and can trick into opening it.
  • Now, whatever details the victim enters it will get a prompt on the attacker’s terminal.
  • After clicking on “Sign In” the victim will get redirected to a new tab automatically but end up giving the credentials. The URL will work until the attacker closes the terminal.

Creating a cloner for the below website

  • Under “Social Engineering attacks,” select “Website Attack Vectors.”
  • Select Credential Harvester Attack Method -> Site Cloner -> Press Enter -> Enter URL to clone.
  • Open the IP in the browser, and it will open as Amazon.  An attacker can change the IP into convincible IP.
  • Now the attacker can monitor the victim’s activity sitting remotely.

SET automates the entire attack workflow, making it easy for non-technical users to carry out social engineering attacks. However, it is important to use SET ethically and only for authorized penetration testing or other legitimate purposes and to comply with all relevant laws and regulations.

Note: The content provided is for education and information purposes only.

Please consider following and supporting us to stay updated with the latest information.

The Social-Engineer Toolkit (SET)

  • Copyright ©️ 2020
  • Written by: David Kennedy (ReL1K) @HackingDave
  • Company: TrustedSec

Description

The Social-Engineer Toolkit is an open-source penetration testing framework designed for social engineering. SET has a number of custom attack vectors that allow you to make a believable attack quickly. SET is a product of TrustedSec, LLC – an information security consulting firm located in Cleveland, Ohio.

DISCLAIMER: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes, period.
Please read the LICENSE under readme/LICENSE for the licensing of SET.

Supported platforms:

  • Linux
  • Mac OS X (experimental)

Installation

Install via requirements.txt

pip3 install -r requirements.txt
python3 setup.py 

Install SET

=======

  • Mac OS X

Installation

Windows 10 WSL/WSL2 Kali Linux

Kali Linux on Windows 10 is a minimal installation so it doesn’t have any tools installed.
You can easily install Social Engineer Toolkit on WSL/WSL2 without needing pip using the above command.

Linux

git clone https://github.com/trustedsec/social-engineer-toolkit/ setoolkit/
cd setoolkit
pip3 install -r requirements.txt
python setup.py

SET Tutorial

For a full document on how to use SET, visit the SET user manual.

Bugs and enhancements

For bug reports or enhancements, please open an issue here.

Humans are the best resource and end-point of security vulnerabilities ever. Social Engineering is a kind of attack targeting human behavior by manipulating and playing with their trust, with the aim to gain confidential information, such as banking account, social media, email, even access to target computer.  No system is safe, because the system is made by humans.The most common attack vector using social engineering attacks is spread phishing through email spamming. They target a victim who has a financial account such as banking or credit card information.

Social engineering attacks are not breaking into a system directly, instead it is using human social interaction and the attacker is dealing with the victim directly.

Do you remember Kevin Mitnick? The Social Engineering legend of the old era. In most of his attack methods, he used to trick victims into believing that he holds the system authority. You might have seen his Social Engineering Attack demo video on YouTube. Look at it!

In this post i am going to show you the simple scenario of how to implement Social Engineering Attack in daily life. It is so easy, just follow along the tutorial carefully. I will explain the scenario clearly.

Social Engineering Attack to gain email access

Goal: Gaining email credential account information

Attacker: Me

Target: My friend. (Really? yes)

Device: Computer or laptop running Kali Linux. And my mobile phone!

Environment: Office (at work)

Tool: Social Engineering Toolkit (SET)

So, based on the scenario above you can imagine that we don’t even need the victim’s device, i used my laptop and my phone. I only need his head and trust, and stupidity too! Because, you know, human stupidity can not be patched, seriously!

In this case we first are going to setup phishing Gmail Account login page in my Kali Linux, and use my phone to be a trigger device. Why i used my phone? I will explain below, later.

Fortunately we are not gonna install any tools, our Kali Linux machine has pre-installed SET (Social Engineering Toolkit), That’s all we need. Oh yeah, if you don’t know what is SET is, i will give you the background on this toolkit.

Social Engineering Toolkit, is design to perform human-side penetration test. SET (shortly) is developed by the founder of TrustedSec (https://www.trustedsec.com/social-engineer-toolkit-set/), which is written in Python, and it is open source.

Alright that was enough let’s do the practice. Before we conduct the social engineering attack, we need to set up our phising page first. Here, i am sitting down on my desk, my computer (running Kali Linux) is connected to the internet the same Wi-Fi network as my mobile phone (i am using android).

STEP 1. SETUP PHISING PAGE

Setoolkit is using Command Line interface, so don’t expect ‘clicky-clicky’ of things here. Open up terminal and type:

You will see the welcome page at the top and the attack options at the bottom, you should see something like this.

Yes, of course, we are going to perform Social Engineering Attacks, so choose number 1 and hit ENTER.

And then you will be displayed the next options, and choose number 2. Website Attack Vectors. Hit ENTER.

Next, we choose number 3. Credential Harvester Attack Method. Hit Enter.

Further options are narrower, SET has pre-formatted phising page of popular websites, such Google, Yahoo, Twitter and Facebook. Now choose number 1. Web Templates.

Because, my Kali Linux PC and my mobile phone were in the same Wi-Fi network, so just input the attacker (my PC) local IP address. And hit ENTER.

PS: To check your device IP address, type: ‘ifconfig’

Alright so far, we have set our method and the listener IP address. In this options listed pre-defined web phising templates as i mentioned above. Because we aimed Google account page, so we choose number 2. Google. Hit ENTER.

the

Now, SET starts my Kali Linux Webserver on port 80, with the fake Google account login page. Our setup is done. Now i am ready walking into my friends room to login into this phishing page using my mobile phone.

STEP 2. HUNTING VICTIMS

The reason why i am using mobile phone (android)? Let see how the page displayed in my built-in android browser. So, i am accessing my Kali Linux webserver on 192.168.43.99 in the browser. And here is the page:

See? It looks so real, there are no security issues displayed on it. The URL bar showing the title instead the URL itself. We know the stupid will recognize this as the original Google page.

So, i bring my mobile phone, and walk into my friend, and talk to him as if i failed to login to Google and act if I am wondering if Google crashed or errored. I give my phone and ask him to try to login using his account. He doesn’t believe my words and immediately begins typing in his account information as if nothing will happen badly here. Haha.

He already typed all the required forms, and let me to click the Sign in button. I click the button… Now It is loading… And then we got Google search engine main page like this.

PS: Once the victim clicks the Sign in button, it will send the authentication information to our listener machine, and it is logged.

Nothing is happening, i tell him, the Sign In button is still there, you failed to login though. And then i am opening again the phising page, while another friend of this stupid coming to us. Nah, we got another victim.

Until i cut the talk, then i go back to my desk and check the log of my SET. And here we got,

Goccha… I pwnd you!!!

In conclusion

 I am not good at story telling (thats the point), to sum up the attack so far the steps are:

  • Open ‘setoolkit’
  • Choose 1) Social Engineering Attacks
  • Choose 2) Website Attack Vectors
  • Choose 3) Credential Harvester Attack Method
  • Choose 1) Web Templates
  • Input the IP address
  • Choose Google
  • Happy hunting ^_^

About the author

Penetration Tester with Kali Linux. Reach me on Facebook https://www.facebook.com/xbimando

Are you looking for a way to use the Social Engineer Toolkit in Kali?

Social engineering attacks have become a significant threat to personal and organizational security. Understanding and defending against these attacks is vital. This guide focuses on the Social Engineering Toolkit (SET) – an essential tool for cyber security professionals, ethical hackers, and security enthusiasts alike.

Join us as we discuss three different ways to use this software. As you read on, you’ll discover the versatility of SET, learn how to leverage its features, and gain valuable insights into the ever-growing world of social engineering attacks.

We will show you how to use the infectious media generator to create a malicious EXE. Next, we will show you how to set up an individual phishing attack, and lastly, we will show you how to use the Social Engineer Toolkit to clone a legitimate website and harvest credentials.

Table Of Contents

  1. What Is the Social Engineer Toolkit?
  2. Getting Started with Social Engineer Toolkit
  3. Infectious Media Generator
  4. Phishing Attacks
  5. Website Cloning and Credential Harvesting
  6. Conclusion

Before diving into the Social Engineering Toolkit, let’s discuss what social engineering is.

Social Engineering

Social engineering is a psychological tactic that tricks people into taking certain actions or revealing sensitive information. It relies on exploiting human emotions, trust, and curiosity rather than using technical methods to gain unauthorized access to confidential data.

In simple terms, social engineering is like a con artist’s game, where the attacker manipulates the target’s feelings and trust to get what they want.

By understanding and manipulating human behavior, these attackers can deceive their victims into disclosing their details, like passwords or financial information, or performing actions that compromise security.

The Social Engineer Toolkit

The Social Engineer Toolkit (SET), written in Python, is a powerful collection of tools designed for social engineering. Penetration testers or Red Team members often use it to test an organization’s security by simulating social engineering attacks on employees.

Developed by TrustedSec and available on GitHub, SET comes pre-installed on Kali Linux, making it a readily accessible resource for cyber security professionals.

Need guidance on installing Kali on VMware or VirtualBox? Check out our easy-to-follow guides to get started with your virtual lab setup!

SET offers many attack vectors, such as spear phishing, malicious payloads, infectious media generation, and website cloning. These attacks leverage the inherent human vulnerabilities of most security systems, making them potent and challenging to defend against.

Getting Started with Social Engineer Toolkit

Having discussed what social engineer toolkit is, let’s move on and discuss the setup and the numerous options it has.

Warning

The information provided in this blog, including using the Social-Engineer Toolkit (SET), is for educational purposes. We urge you to apply the techniques and knowledge shared here only with explicit permission from the relevant parties. Engaging in unauthorized hacking activities is unethical and illegal. We encourage you to practice responsible and ethical hacking.

Startup

The Social Engineer Toolkit already comes pre-installed in Kali. To start SET, simply head to your terminal and type: sudo setoolkit

You will be asked to read the terms and conditions before continuing.

Start Social Engineer Toolkit

Options

Once SET launches, you’ll be presented with a menu of options. This article will focus on option one: Social-Engineering Attacks, which offers a variety of attack vectors. Here is an overview of the options available in this category:

1) Social-Engineering Attacks: This option focuses on various social engineering attack vectors, including spear phishing, website attacks, infectious media generation, and credential harvesting. It allows users to simulate and test various human-centered attack scenarios.

2) Penetration Testing (Fast-Track): Fast-Track is a collection of testing tools and scripts designed to rapidly deploy and exploit security vulnerabilities. It helps automate various aspects of penetration testing and speeds up the process of discovering and exploiting vulnerabilities

3) Third Party Modules: This option provides integration with external tools and modules developed by the security community. These modules extend SET’s functionality and can offer additional attack vectors, exploits, and payloads for use within the toolkit.

4) Update the Social-Engineer Toolkit: This option allows you to update SET to the latest version, ensuring you have the most recent features, bug fixes, and improvements. Regular updates are essential to maintaining an effective and reliable toolkit.

5) Update SET configuration: This option lets you modify the SET configuration file.

6) Help, Credits, and About: This option provides access to the help documentation, credits to the developers and contributors, and general information about the Social Engineer Toolkit. It is a useful resource for understanding the toolkit’s functionality, getting assistance, and learning about its development history.

Infectious Media Generator

The Infectious Media Generator in SET allows you to create malicious files, such as PDFs and EXEs, that can trigger a reverse Meterpreter shell when opened. This section will guide you through the process of creating a malicious EXE.

 The Social Engineering Toolkit - Malicious File

SET has many options for malicious payloads, but they may be limited depending on the software and operating system versions the target is using.  

Setup

  • From the SET main menu, select one «Social-Engineering Attacks.»
  • Choose three «Infectious Media Generator.»

Select Infectious Media Generator

There are two options inside the “Infectious Media Generator,” “File-Format Exploits,” and “Standard Metasploit Executable.”

File-Format Exploits: This attack vector exploits vulnerabilities in popular formats like PDFs, Microsoft Office documents, and image files. Attackers craft malicious files containing embedded payloads that, when opened by unsuspecting users, exploit these vulnerabilities to gain unauthorized access to their systems.

The primary advantage of this approach is its stealthiness, as the malicious files often appear legitimate and are less likely to raise suspicion. Moreover, users perceive these file formats as harmless, making them more likely to be opened.

These are dependent on the OS version of the target system.

Standard Metasploit Executable: Using the Metasploit Framework, this attack vector involves creating a standalone executable containing a malicious payload.

When a user runs the executable, the payload is executed, and the attacker gains control over the target system. This approach is more straightforward than File-Format Exploits, as it doesn’t rely on exploiting specific vulnerabilities in file formats.

However, it may also be more conspicuous, as users are generally more cautious when running unfamiliar executables. A successful attack using this vector often relies on strong social engineering techniques to convince the target to run the executable, such as disguising it as a software update, a useful utility, or a desirable file.

Next, you will be asked which format you would like to use. We will be selecting option two.

 The Social Engineering Toolkit - Metasploit Executable

You will be asked to select the reverse shell you want to use. For this option, choose two, which is the Windows Meterpreter Reverse TCP shell. Enter the IP address and port for your listener.

 The Social Engineering Toolkit - Reverse Meterpreter

The Social Engineering Toolkit will now create the malicious exe file, call it payload.exe, and save it to the /root/.set directory.

 The Social Engineering Toolkit - Payload

You can now rename the file to something else if you want. An attacker might change the name to something that will entice a victim to click on it, such as an update for an application.

 The Social Engineering Toolkit - Change File Name

Start the multi-handler in metasploit using the same IP and port you chose above and type run.

Metasploit Multi Handler

The user must click on the malicious file to initiate the reverse shell.

 The Social Engineering Toolkit - Payload Executed

Once the user clicks the file, you should have a reverse meterpreter shell to the target.

Meterpreter Session

In search of a reverse shell cheat sheet? We’ve got you covered in our detailed post. Check it out now!

Phishing Attacks

Phishing is a widely-used social engineering attack that aims to deceive users into revealing sensitive information, such as login credentials, financial details, or personally identifiable information.

By manipulating users into believing they are interacting with a legitimate source, attackers can trick them into clicking on malicious links, downloading malware-infected files, or divulging confidential information.

You can use Gmail, Hotmail, Yahoo, or an email address from your domain to perform a phishing attack with SET.  Gmail is the default option and the one we will be using. To change between Gmail, Hotmail, or Yahoo, you must edit the /etc/setoolkit/set.config file.

 The Social Engineering Toolkit - Change Email Provider

Mass Mailer

With the mass mailer option in SET, you can create a phishing email and send it to the target. SET allows for both individual phishing and mass mailing attacks, with the latter targeting multiple victims simultaneously.

In this walkthrough, we will show you the individual attack and how we can include a malicious link to a cloned site we will be creating in our next section. The mass mailer attack is similar; the only difference being you can use a list of emails instead of a single address.

You will need to use an App password to use a Gmail account. App passwords let you sign in to your Google Account from apps on devices that don’t support 2-Step Verification.

Here is a great article on setting up App passwords in your Google account.

Google is removing this option for new accounts and has plans to remove it from all accounts in the future, so be aware that using your Gmail account may not work, and you may need to use an email from a domain you own instead.

You will need an SMTP open relay to use an email attached to your domain. For this scenario, we recommend using SMTP2GO, where you can send up to a thousand emails at no cost.

Phishing Campaign

Let’s walk you through setting up the phishing campaign using a Gmail address to send an email with a malicious link.

We will email the target pretending to be GitHub support and ask the user to click the link. The link will be to a cloned site we will host on our server.

From the main menu, choose option one, “Social Engineering Attacks,” then choose option five, “Mass Mailer Attack,” and finally select “E-mail Attack Single Email Address.”

 The Social Engineering Toolkit - Mass Mailer Attack

You will be asked to input the target and sender email. Let’s walk through each prompt.

  • Send email to: This is the email of the target.
  • Next, you can use a Gmail account or one from your server.
  • Your Gmail account: The account you want to send the email from.
  • The FROM NAME the user will see: The from name you want to be displayed.
  • Flag this message(s) as high priority: Whether you want it to be flagged as high priority.
  • Do you want to attach a file: Yes or No
  • Do you want to attach an inline file: Yes or No
  • E-mail Subject: The subject line for the email.
  • Send the message as HTML or plain text: Choose how you want to send the email.
  • Enter the body of the message: Enter the actual email text here. Once you have finished writing the email, type END and hit enter.

SET will tell you when it has finished sending the emails.

 The Social Engineering Toolkit - Mass Mailer Settings

Once the email has been sent, your target should receive it in their inbox.

 The Social Engineering Toolkit - Phishing Email

 The Social Engineering Toolkit - Full Phishing Email

If you want to send an email from your server, the setup in SET is similar. You need the SMTP server and port number from your server. For SMTP2GO, that would be mail.smtp2go.com and port 2525. You need a username and password, which can be set up in SMTP2GO.

An attacker may often use «typosquatting» or «URL hijacking» to register domain names similar to legitimate ones. Doing so allows them to use a more convincing email address to send out phishing emails.

The Social Engineering Toolkit - Use Your Own Email

Now, let’s look at setting up a cloned Github login page where we will direct our target and harvest their credentials.

Website Cloning and Credential Harvesting

Website cloning and credential harvesting are two essential techniques in the arsenal of social engineers. These techniques involve creating a replica of a legitimate website and tricking users into entering their sensitive information on the fake website, such as usernames and passwords.

This information can then be used for various malicious activities, including unauthorized access to user accounts, identity theft, or even corporate espionage.

 The Social Engineering Toolkit - Cloning A Site

Clone Site

Before setting up a cloned site in SET, you need to enable the Apache web server in the SET configuration file located at /etc/setoolkit/set.config. Change the line APACHE_SERVER=OFF to APACHE_SERVER=ON, save the file, and restart SET to apply the changes.

 The Social Engineering Toolkit - Apache Web Server On

To use the Site Cloner in SET, follow these steps:

  1. Launch SET by running setoolkit in the terminal.
  2. Select option one, which is Social-Engineering Attacks.
  3. Choose option two, Website Attack Vectors.
  4. Select option three, Credential Harvester Attack Method.
  5. Choose option two, Site Cloner.

 The Social Engineering Toolkit - Site Cloner

  1. Enter the IP address of the machine running SET, which will be used as the redirect IP for captured credentials.
  2. Input the URL of the target website you want to clone (e.g., https://www.github.com/login).

 The Social Engineering Toolkit - Pick Site To Clone

SET will now clone the website and host it on your machine, with a phishing page to capture user credentials.

For this to work effectively, you need to clone a site that has the username and password fields on the same page.

 The Social Engineering Toolkit - Fake GitHub Login

Credential Harvesting

When users visit the cloned website and enter their login information, the credentials will be captured and sent to the attacker’s machine. This information can then be used to gain unauthorized access to the user’s account on a legitimate website.

The user will then be redirected to the actual login page of the service.

 The Social Engineering Toolkit - Harvest Credentials

If we head back to our terminal in Kali, we should see the credentials come through.

 The Social Engineering Toolkit - Captured Credentials

To make the cloned website more convincing, attackers often employ tactics like typosquatting (registering domains with similar names to the target site), such as amzon.com (instead of amazon.com), or using the target site’s name as a subdomain of another legitimate site they control (amazon.myfakesite.com).

These techniques help create a sense of credibility for the fake website, increasing the chances of successfully tricking users into revealing their credentials.

It’s important to note that tools like SET can quickly deploy cloned websites on cloud platforms like AWS, complete with public URLs, making it even easier for attackers to create convincing phishing campaigns.

Always remember to use these tools and techniques for educational purposes and in authorized penetration testing engagements only. Ethical hacking is about understanding and improving security, not exploiting it for malicious purposes.

Conclusion

Throughout this guide, we have explored the powerful capabilities of the Social Engineer Toolkit (SET) in conducting various social engineering attacks. We’ve delved into the Infectious Media Generator, creating malicious payloads that can compromise systems upon execution.

We’ve also discussed phishing attacks and how to send a malicious link in an email. Finally, we examined website cloning and credential harvesting, highlighting the importance of awareness and vigilance regarding online security.

However, it is crucial to remember that SET is capable of much more than what we’ve covered in this guide. Other attack vectors, penetration testing modules, and third-party integrations make SET indispensable for ethical hackers, security researchers, and penetration testers.

As we continue to emphasize, the knowledge and techniques shared in this guide should only be used for educational purposes or authorized security assessments.

The Social Engineer Toolkit is a versatile and powerful suite of tools that can significantly aid security professionals in understanding and mitigating the risks associated with social engineering attacks. By becoming familiar with these techniques and tools, you’ll be better equipped to protect yourself, your organization, and your users from falling victim to the ever-evolving landscape of cyber security threats.

Why not explore some of our fantastic courses that can help you expand your knowledge in social engineering?

Level Up in Cyber Security: Join Our Membership Today!

  • Richard Dezso

    Penetration Tester with Kali Linux. Reach me on Facebook https://www.facebook.com/xbimando

Are you looking for a way to use the Social Engineer Toolkit in Kali?

Social engineering attacks have become a significant threat to personal and organizational security. Understanding and defending against these attacks is vital. This guide focuses on the Social Engineering Toolkit (SET) – an essential tool for cyber security professionals, ethical hackers, and security enthusiasts alike.

Join us as we discuss three different ways to use this software. As you read on, you’ll discover the versatility of SET, learn how to leverage its features, and gain valuable insights into the ever-growing world of social engineering attacks.

We will show you how to use the infectious media generator to create a malicious EXE. Next, we will show you how to set up an individual phishing attack, and lastly, we will show you how to use the Social Engineer Toolkit to clone a legitimate website and harvest credentials.

Table Of Contents

  1. What Is the Social Engineer Toolkit?
  2. Getting Started with Social Engineer Toolkit
  3. Infectious Media Generator
  4. Phishing Attacks
  5. Website Cloning and Credential Harvesting
  6. Conclusion

Before diving into the Social Engineering Toolkit, let’s discuss what social engineering is.

Social Engineering

Social engineering is a psychological tactic that tricks people into taking certain actions or revealing sensitive information. It relies on exploiting human emotions, trust, and curiosity rather than using technical methods to gain unauthorized access to confidential data.

In simple terms, social engineering is like a con artist’s game, where the attacker manipulates the target’s feelings and trust to get what they want.

By understanding and manipulating human behavior, these attackers can deceive their victims into disclosing their details, like passwords or financial information, or performing actions that compromise security.

The Social Engineer Toolkit

The Social Engineer Toolkit (SET), written in Python, is a powerful collection of tools designed for social engineering. Penetration testers or Red Team members often use it to test an organization’s security by simulating social engineering attacks on employees.

Developed by TrustedSec and available on GitHub, SET comes pre-installed on Kali Linux, making it a readily accessible resource for cyber security professionals.

Need guidance on installing Kali on VMware or VirtualBox? Check out our easy-to-follow guides to get started with your virtual lab setup!

SET offers many attack vectors, such as spear phishing, malicious payloads, infectious media generation, and website cloning. These attacks leverage the inherent human vulnerabilities of most security systems, making them potent and challenging to defend against.

Getting Started with Social Engineer Toolkit

Having discussed what social engineer toolkit is, let’s move on and discuss the setup and the numerous options it has.

Warning

The information provided in this blog, including using the Social-Engineer Toolkit (SET), is for educational purposes. We urge you to apply the techniques and knowledge shared here only with explicit permission from the relevant parties. Engaging in unauthorized hacking activities is unethical and illegal. We encourage you to practice responsible and ethical hacking.

Startup

The Social Engineer Toolkit already comes pre-installed in Kali. To start SET, simply head to your terminal and type: sudo setoolkit

You will be asked to read the terms and conditions before continuing.

Start Social Engineer Toolkit

Options

Once SET launches, you’ll be presented with a menu of options. This article will focus on option one: Social-Engineering Attacks, which offers a variety of attack vectors. Here is an overview of the options available in this category:

1) Social-Engineering Attacks: This option focuses on various social engineering attack vectors, including spear phishing, website attacks, infectious media generation, and credential harvesting. It allows users to simulate and test various human-centered attack scenarios.

2) Penetration Testing (Fast-Track): Fast-Track is a collection of testing tools and scripts designed to rapidly deploy and exploit security vulnerabilities. It helps automate various aspects of penetration testing and speeds up the process of discovering and exploiting vulnerabilities

3) Third Party Modules: This option provides integration with external tools and modules developed by the security community. These modules extend SET’s functionality and can offer additional attack vectors, exploits, and payloads for use within the toolkit.

4) Update the Social-Engineer Toolkit: This option allows you to update SET to the latest version, ensuring you have the most recent features, bug fixes, and improvements. Regular updates are essential to maintaining an effective and reliable toolkit.

5) Update SET configuration: This option lets you modify the SET configuration file.

6) Help, Credits, and About: This option provides access to the help documentation, credits to the developers and contributors, and general information about the Social Engineer Toolkit. It is a useful resource for understanding the toolkit’s functionality, getting assistance, and learning about its development history.

Infectious Media Generator

The Infectious Media Generator in SET allows you to create malicious files, such as PDFs and EXEs, that can trigger a reverse Meterpreter shell when opened. This section will guide you through the process of creating a malicious EXE.

 The Social Engineering Toolkit - Malicious File

SET has many options for malicious payloads, but they may be limited depending on the software and operating system versions the target is using.  

Setup

  • From the SET main menu, select one «Social-Engineering Attacks.»
  • Choose three «Infectious Media Generator.»

Select Infectious Media Generator

There are two options inside the “Infectious Media Generator,” “File-Format Exploits,” and “Standard Metasploit Executable.”

File-Format Exploits: This attack vector exploits vulnerabilities in popular formats like PDFs, Microsoft Office documents, and image files. Attackers craft malicious files containing embedded payloads that, when opened by unsuspecting users, exploit these vulnerabilities to gain unauthorized access to their systems.

The primary advantage of this approach is its stealthiness, as the malicious files often appear legitimate and are less likely to raise suspicion. Moreover, users perceive these file formats as harmless, making them more likely to be opened.

These are dependent on the OS version of the target system.

Standard Metasploit Executable: Using the Metasploit Framework, this attack vector involves creating a standalone executable containing a malicious payload.

When a user runs the executable, the payload is executed, and the attacker gains control over the target system. This approach is more straightforward than File-Format Exploits, as it doesn’t rely on exploiting specific vulnerabilities in file formats.

However, it may also be more conspicuous, as users are generally more cautious when running unfamiliar executables. A successful attack using this vector often relies on strong social engineering techniques to convince the target to run the executable, such as disguising it as a software update, a useful utility, or a desirable file.

Next, you will be asked which format you would like to use. We will be selecting option two.

 The Social Engineering Toolkit - Metasploit Executable

You will be asked to select the reverse shell you want to use. For this option, choose two, which is the Windows Meterpreter Reverse TCP shell. Enter the IP address and port for your listener.

 The Social Engineering Toolkit - Reverse Meterpreter

The Social Engineering Toolkit will now create the malicious exe file, call it payload.exe, and save it to the /root/.set directory.

 The Social Engineering Toolkit - Payload

You can now rename the file to something else if you want. An attacker might change the name to something that will entice a victim to click on it, such as an update for an application.

 The Social Engineering Toolkit - Change File Name

Start the multi-handler in metasploit using the same IP and port you chose above and type run.

Metasploit Multi Handler

The user must click on the malicious file to initiate the reverse shell.

 The Social Engineering Toolkit - Payload Executed

Once the user clicks the file, you should have a reverse meterpreter shell to the target.

Meterpreter Session

In search of a reverse shell cheat sheet? We’ve got you covered in our detailed post. Check it out now!

Phishing Attacks

Phishing is a widely-used social engineering attack that aims to deceive users into revealing sensitive information, such as login credentials, financial details, or personally identifiable information.

By manipulating users into believing they are interacting with a legitimate source, attackers can trick them into clicking on malicious links, downloading malware-infected files, or divulging confidential information.

You can use Gmail, Hotmail, Yahoo, or an email address from your domain to perform a phishing attack with SET.  Gmail is the default option and the one we will be using. To change between Gmail, Hotmail, or Yahoo, you must edit the /etc/setoolkit/set.config file.

 The Social Engineering Toolkit - Change Email Provider

Mass Mailer

With the mass mailer option in SET, you can create a phishing email and send it to the target. SET allows for both individual phishing and mass mailing attacks, with the latter targeting multiple victims simultaneously.

In this walkthrough, we will show you the individual attack and how we can include a malicious link to a cloned site we will be creating in our next section. The mass mailer attack is similar; the only difference being you can use a list of emails instead of a single address.

You will need to use an App password to use a Gmail account. App passwords let you sign in to your Google Account from apps on devices that don’t support 2-Step Verification.

Here is a great article on setting up App passwords in your Google account.

Google is removing this option for new accounts and has plans to remove it from all accounts in the future, so be aware that using your Gmail account may not work, and you may need to use an email from a domain you own instead.

You will need an SMTP open relay to use an email attached to your domain. For this scenario, we recommend using SMTP2GO, where you can send up to a thousand emails at no cost.

Phishing Campaign

Let’s walk you through setting up the phishing campaign using a Gmail address to send an email with a malicious link.

We will email the target pretending to be GitHub support and ask the user to click the link. The link will be to a cloned site we will host on our server.

From the main menu, choose option one, “Social Engineering Attacks,” then choose option five, “Mass Mailer Attack,” and finally select “E-mail Attack Single Email Address.”

 The Social Engineering Toolkit - Mass Mailer Attack

You will be asked to input the target and sender email. Let’s walk through each prompt.

  • Send email to: This is the email of the target.
  • Next, you can use a Gmail account or one from your server.
  • Your Gmail account: The account you want to send the email from.
  • The FROM NAME the user will see: The from name you want to be displayed.
  • Flag this message(s) as high priority: Whether you want it to be flagged as high priority.
  • Do you want to attach a file: Yes or No
  • Do you want to attach an inline file: Yes or No
  • E-mail Subject: The subject line for the email.
  • Send the message as HTML or plain text: Choose how you want to send the email.
  • Enter the body of the message: Enter the actual email text here. Once you have finished writing the email, type END and hit enter.

SET will tell you when it has finished sending the emails.

 The Social Engineering Toolkit - Mass Mailer Settings

Once the email has been sent, your target should receive it in their inbox.

 The Social Engineering Toolkit - Phishing Email

 The Social Engineering Toolkit - Full Phishing Email

If you want to send an email from your server, the setup in SET is similar. You need the SMTP server and port number from your server. For SMTP2GO, that would be mail.smtp2go.com and port 2525. You need a username and password, which can be set up in SMTP2GO.

An attacker may often use «typosquatting» or «URL hijacking» to register domain names similar to legitimate ones. Doing so allows them to use a more convincing email address to send out phishing emails.

The Social Engineering Toolkit - Use Your Own Email

Now, let’s look at setting up a cloned Github login page where we will direct our target and harvest their credentials.

Website Cloning and Credential Harvesting

Website cloning and credential harvesting are two essential techniques in the arsenal of social engineers. These techniques involve creating a replica of a legitimate website and tricking users into entering their sensitive information on the fake website, such as usernames and passwords.

This information can then be used for various malicious activities, including unauthorized access to user accounts, identity theft, or even corporate espionage.

 The Social Engineering Toolkit - Cloning A Site

Clone Site

Before setting up a cloned site in SET, you need to enable the Apache web server in the SET configuration file located at /etc/setoolkit/set.config. Change the line APACHE_SERVER=OFF to APACHE_SERVER=ON, save the file, and restart SET to apply the changes.

 The Social Engineering Toolkit - Apache Web Server On

To use the Site Cloner in SET, follow these steps:

  1. Launch SET by running setoolkit in the terminal.
  2. Select option one, which is Social-Engineering Attacks.
  3. Choose option two, Website Attack Vectors.
  4. Select option three, Credential Harvester Attack Method.
  5. Choose option two, Site Cloner.

 The Social Engineering Toolkit - Site Cloner

  1. Enter the IP address of the machine running SET, which will be used as the redirect IP for captured credentials.
  2. Input the URL of the target website you want to clone (e.g., https://www.github.com/login).

 The Social Engineering Toolkit - Pick Site To Clone

SET will now clone the website and host it on your machine, with a phishing page to capture user credentials.

For this to work effectively, you need to clone a site that has the username and password fields on the same page.

 The Social Engineering Toolkit - Fake GitHub Login

Credential Harvesting

When users visit the cloned website and enter their login information, the credentials will be captured and sent to the attacker’s machine. This information can then be used to gain unauthorized access to the user’s account on a legitimate website.

The user will then be redirected to the actual login page of the service.

 The Social Engineering Toolkit - Harvest Credentials

If we head back to our terminal in Kali, we should see the credentials come through.

 The Social Engineering Toolkit - Captured Credentials

To make the cloned website more convincing, attackers often employ tactics like typosquatting (registering domains with similar names to the target site), such as amzon.com (instead of amazon.com), or using the target site’s name as a subdomain of another legitimate site they control (amazon.myfakesite.com).

These techniques help create a sense of credibility for the fake website, increasing the chances of successfully tricking users into revealing their credentials.

It’s important to note that tools like SET can quickly deploy cloned websites on cloud platforms like AWS, complete with public URLs, making it even easier for attackers to create convincing phishing campaigns.

Always remember to use these tools and techniques for educational purposes and in authorized penetration testing engagements only. Ethical hacking is about understanding and improving security, not exploiting it for malicious purposes.

Conclusion

Throughout this guide, we have explored the powerful capabilities of the Social Engineer Toolkit (SET) in conducting various social engineering attacks. We’ve delved into the Infectious Media Generator, creating malicious payloads that can compromise systems upon execution.

We’ve also discussed phishing attacks and how to send a malicious link in an email. Finally, we examined website cloning and credential harvesting, highlighting the importance of awareness and vigilance regarding online security.

However, it is crucial to remember that SET is capable of much more than what we’ve covered in this guide. Other attack vectors, penetration testing modules, and third-party integrations make SET indispensable for ethical hackers, security researchers, and penetration testers.

As we continue to emphasize, the knowledge and techniques shared in this guide should only be used for educational purposes or authorized security assessments.

The Social Engineer Toolkit is a versatile and powerful suite of tools that can significantly aid security professionals in understanding and mitigating the risks associated with social engineering attacks. By becoming familiar with these techniques and tools, you’ll be better equipped to protect yourself, your organization, and your users from falling victim to the ever-evolving landscape of cyber security threats.

Why not explore some of our fantastic courses that can help you expand your knowledge in social engineering?

Level Up in Cyber Security: Join Our Membership Today!

  • Richard Dezso

    Richard is a cyber security enthusiast, eJPT, and ICCA who loves discovering new topics and never stops learning. In his home lab, he’s always working on sharpening his offensive cyber security skills. He shares helpful advice through easy-to-understand blog posts that offer practical support for everyone. Additionally, Richard is dedicated to raising awareness for mental health. You can find Richard on LinkedIn, or to see his other projects, visit his Linktree.

    View all posts

Понравилась статья? Поделить с друзьями:
  • Soccer goal demix ворота детские инструкция
  • Smsl sanskrit 10th mkii инструкция на русском
  • Soap pump and sponge caddy инструкция по эксплуатации на русском языке
  • Smsl dp5 инструкция на русском языке
  • Sofosbuvir 400 и velpatasvir 100 инструкция по применению