Social Engineering Toolkit

From Embedded Lab Vienna for IoT & Security
Jump to navigation Jump to search

Summary

Social Engineering Toolkit (SET) is a menu driven system that allows you to control your attacks tailored to the desired target.

Requirements

As part of this guide, I used Kali (Kali GNU/Linux Rolling 5.10.0-kali3-amd64) as the OS, so it was already preinstalled. I installed Kali on a Virtual machine (VMware® Workstation 15 Pro 15.5.5 build-16285975).

Example

Below we have an example of how to start the BeEF service, and execute a "Google Phishing" client-side attack. With this example we'll see how to gather credential information of victim.


topmenu

Start: Run Social Engineering Toolkit and choose desired submenu

After launching the Social Engineering Toolkit we see the above mentioned menu. Here we can choose between submenus to specify our attack. Our Example will be about Twitter Sign in Phishing, therefore we have to select through several submenus as shown below.





submenu 2


Select 2nd submenu

For practicing purposes BeEF provides a localhost webpage.






submenu 3

Select 3rd submenu

If you click on the hooked browser, under "Details" you can see information about the browser.





submenu 4

Select 4rd submenu

There are hundreds of modules under "Commands", which include from social engineering to browser hacks. The desired module can be selected by clicking and executed with the "Execute" button at the bottom right. I choosed the "Google Phishing" module under the "Social Engineering" Folder and clicked to "Execute".


Twitter Phishing

Command execution in the Browser

There are hundreds of modules under "Commands", which include from social engineering to browser hacks. The desired module can be selected by clicking and executed with the "Execute" button at the bottom right. I choosed the "Google Phishing" module under the "Social Engineering" Folder and clicked to "Execute".




result


Result

After executing the "Google Phishing" module, the victim is asked to "Sign in". Victims entered credentials are visible under "Logs".




Courses

  • WFP-1

References