Social Engineering Toolkit: Credential Harvesting

Overview
The Social Engineering Toolkit (SET) is specifically designed to perform advanced attacks against the human element.[1]


Requirements
For this blog post I used the Kali Linux operating system which comes with SET pre-installed.



Instructions
Launch SET

• Applications > Exploitation Tools > Social Engineering ToolKit

A. Loading Credential Harvesting

1. Select: "1) Social-Engineering Attacks" by typing the number 1
2. Select: "2) Website Attack Vectors" by typing the number 2
3. Select: "3) Credential Harvester Attack Method" by typing the number 3
4. Select: "3) Custom Import"  by typing the number 3

 B. Cloning A Website

1. Open a browser (Any browser will work)
2. Navigate to the Website Login page you wish to clone. 
3. Navigate to the File option in your browser.
4. Change the Name field to index.html (the name is case sensitive)
5. Change the Save Location to /var/www/html
6. Change Type to Web Page, Complete
7. Save

C. Arming the Website

1. Open a Terminal and type ifconfig
2. Copy the inet addr: xxx.xxx.xxx.xxx
3. Paste the inet addr into the terminal running SET
• set: webattack > IP address for the POST back in Harvester/Tabnabbing: xxx.xxx.xxx.xxx
4. Type the following file path:
• /var/www/html
5. Type the URL of the website you clone.
6. Type "y" for yes you want to start Apache server. 

D. Testing the Website
If everything was done correctly you'll see an exact clone of the website you cloned. 

1. Open a browser (on the same machine you used SET on)
2. Type in your inet addr: xxx.xxx.xxx.xxx into the URL bar.
3. Hit Enter key

Reference
1. Social Engineering Toolkit

Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec