GO KALI FREE

Social Engineering Toolkit

Social Engineering

Advancedhigh risk

The Social-Engineer Toolkit (SET) is a penetration testing framework designed for social engineering. It has many attack vectors to exploit human weaknesses.

Installation

sudo apt install set

Basic Syntax

sudo setoolkit

Quick Facts

Full Name
SET (Social-Engineer Toolkit)
License
BSD
Written In
Python
Platforms
Linux, macOS
Category
Social Engineering
Attack Vectors
Phishing, Website Cloning, Payload Generation, Mass Mailer
First Release
2010
Author
TrustedSec (Dave Kennedy)

Tool Overview

The Social-Engineer Toolkit (SET) is the most widely used social engineering framework for penetration testing. Created by Dave Kennedy and TrustedSec, it automates social engineering attacks including spear-phishing, website cloning, credential harvesting, and malicious payload generation.

SET's menu-driven interface guides users through attack setup: selecting an attack vector, configuring the target, choosing payload or phishing content, and launching the attack. It integrates deeply with Metasploit for payload generation and listener management.

Security professionals use SET for authorized social engineering assessments to test organizational security awareness, identify vulnerable users, and demonstrate the effectiveness of security training programs.

Common Commands

sudo setoolkitLaunch SET
Option 1: Social-Engineering AttacksMain attack menu
Option 2: Website Attack VectorsWeb-based attacks
Option 3: Credential HarvesterClone sites for creds
sudo apt install setInstall SET from the Kali repositories
sudo setoolkit --helpShow command-line options and usage
Option 4: Mass Mailer AttackSend bulk phishing emails to a target list
Option 1 > 2 > 3: Harvester + Site ClonerClone a login page and capture submitted credentials
Option 1 > 4: Create a Payload and ListenerGenerate a Metasploit payload with a matching handler
Option 1 > 10: Third Party ModulesLoad community SET modules such as the Java applet attack
Option 99: Return / ExitBack out of the current menu or exit SET
nano /etc/setoolkit/set.configEdit SET configuration (Metasploit path, email, web settings)
setoolkitLaunch interactive menu
setoolkit -pSpear-phishing menu
setoolkit -tWebsite attacks

Step-by-Step Guide

  1. 1Launch: sudo setoolkit
  2. 2Select attack category
  3. 3Choose attack vector
  4. 4Configure attack parameters
  5. 5Launch attack
  6. 6Capture credentials

Warnings

Use Cases

Spear-Phishing Campaigns

Send targeted phishing emails with malicious attachments or links to specific individuals.

Website Cloning

Clone legitimate websites to harvest credentials entered by unsuspecting users.

Credential Harvesting

Capture usernames and passwords through fake login pages and form submissions.

Payload Generation

Create malicious executables, PDFs, and Office documents with Metasploit payloads.

Mass Email Campaigns

Send bulk phishing emails to large lists of targets for broad security awareness testing.

Multi-Attack Vectors

Combine multiple attack methods in a single campaign for comprehensive testing.

Related Tools

Metasploit

Exploitation

Exploitation framework used with SET for payload generation and listener management.

BeEF

Exploitation

Browser Exploitation Framework for client-side attacks through XSS hooks.

Responder

Sniffing & Spoofing

LLMNR/NBT-NS poisoning and credential capture tool.

SET (Social-Engineer Toolkit)

Social Engineering

The primary social engineering framework itself.

GoPhish

Social Engineering

Open source phishing framework with campaign management and analytics.

Frequently Asked Questions

What is SET used for?

The Social-Engineer Toolkit (SET) is a framework for social engineering attacks including phishing campaigns, website cloning, credential harvesting, malicious file generation, and multi-attack vectors for authorized penetration testing.

What attack vectors does SET support?

SET supports spear-phishing attacks, website attack vectors (cloning, credential harvesting), infectious media generator, mass mailer, Arduino-based attacks, SMS spoofing, and wireless access point attacks.

Can SET bypass two-factor authentication?

SET can capture credentials entered into cloned websites, which may include 2FA tokens. However, real-time 2FA bypass requires more sophisticated proxy-based tools.

Is SET legal to use?

SET is legal for authorized security testing only. Using it to phish individuals or organizations without explicit written permission is illegal and violates computer fraud and wiretapping laws.

How does SET perform social engineering attacks?

SET automates social engineering by providing menu-driven attack vectors including spear-phishing emails, website cloning, credential harvesting pages, malicious payload generation, and infectious media creation. It integrates with Metasploit for payload delivery and listener management.

Can SET create phishing campaigns?

Yes, SET supports mass mailer attacks for bulk phishing campaigns. It can send customized phishing emails with malicious attachments or links to cloned websites, track which targets interact with the campaign, and capture submitted credentials.

How does credential harvesting work in SET?

SET clones a legitimate website, modifies its forms to capture submitted data, and hosts the clone on the attacker's system. When victims enter credentials into the fake login page, SET captures them and can forward victims to the real site to avoid suspicion.

Can SET clone any website?

SET can clone most static websites by downloading HTML, CSS, and JavaScript. Dynamic sites with heavy JavaScript or authentication redirects may not clone perfectly. SET also provides predefined templates for common login pages like Google, Facebook, and Office 365.

What payloads can SET generate?

SET integrates with Metasploit to generate payloads including reverse shells, meterpreter sessions, and DLL injections. It supports Windows executables, PDFs with embedded exploits, Office macro documents, and cross-platform payloads for various operating systems.

What attack vectors does SET support?

SET supports spear-phishing, website attacks (cloning and credential harvesting), infectious media generation (USB/DVD), mass mailer campaigns, Arduino-based attacks, QR code generation, and wireless access point attacks for comprehensive social engineering assessments.

How do I update SET to the latest version?

Update with: cd /opt/social-engineer-toolkit && git pull. Or reinstall from GitHub: git clone https://github.com/trustedsec/social-engineer-toolkit.git /opt/set. Run setoolkit to verify the update.

Can SET create convincing phishing emails?

Yes, SET's mass mailer creates phishing emails with customizable templates, sender information, and attachments. Use the HTML import option to include professional-looking email content for realistic phishing campaigns.

How do I set up a credential harvesting server?

Use SET's website attack vector: select Credential Harvester, choose a template or clone a website, then SET automatically hosts the phishing page and captures submitted credentials.

Can SET generate malicious PDFs?

Yes, SET's infectious media generator creates PDFs with embedded Metasploit payloads. The PDF appears normal but contains an exploit that executes when opened, establishing a reverse connection.

How do I use SET for USB drop attacks?

Use the Infectious Media Generator: SET creates a USB with an autorun payload. When a victim plugs in the USB and opens the lure file, the payload executes and establishes a connection back to the attacker.

Can SET bypass email spam filters?

SET includes options for email spoofing and can send through external SMTP servers. However, modern spam filters are sophisticated. Use legitimate email infrastructure and test deliverability before campaigns.

How do I track phishing campaign results in SET?

SET logs credential submissions and payload connections. Monitor the SET terminal output for captured credentials and Metasploit listener for reverse connections from successful phishing attempts.

Can SET clone websites with JavaScript?

SET can clone most static websites including basic JavaScript. Heavy JavaScript applications or single-page applications may not clone perfectly. SET also provides predefined templates for popular login pages.

How do I configure Metasploit integration with SET?

Ensure Metasploit is installed and running: msfdb start. SET automatically launches the appropriate listener when payloads are selected. Configure LHOST and LPORT in SET's options for correct callback addresses.

Tags

#social-engineering

Output Explanation

Menu-driven interface showing attack options and captured data.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.