setoolkit: A social engineering framework used for phishing, credential harvesting, and more

What is SEToolkit?

The Social-Engineer Toolkit (SET) is an open-source penetration testing framework designed for social engineering attacks. It automates phishing, credential harvesting, exploit delivery, and other attack vectors that exploit human psychology rather than technical vulnerabilities.

Key Features:

• Phishing attacks (website cloning, credential harvesting)
• Spear-phishing (email spoofing)
• Infectious media generation (malicious USB/CD)
• QR code attacks
• PowerShell-based attacks
• Metasploit integration for exploitation

How SEToolkit Works

SEToolkit leverages social engineering tactics to trick users into:

• Entering credentials on fake login pages
• Opening malicious files/links
• Running payloads that grant attacker access

It integrates with Metasploit for payload generation and post-exploitation.

Installation

SEToolkit comes pre-installed in Kali Linux. If missing, install it via:

sudo apt update
sudo apt install setoolkit

Alternatively, clone from GitHub:

git clone https://github.com/trustedsec/social-engineer-toolkit.git
cd social-engineer-toolkit
pip3 install -r requirements.txt
python3 setup.py

Basic Usage

Starting SEToolkit

sudo setoolkit

(Requires root privileges for some attacks.)

Main Menu Options

1) Spear-Phishing Attack Vectors  
2) Website Attack Vectors  
3) Infectious Media Generator  
4) Create a Payload and Listener  
5) Mass Mailer Attack  
6) QRCode Generator Attack  
7) Powershell Attack Vectors  
8) Third Party Modules  

Advanced Usage Examples

1. Spear-Phishing Attack (Email Spoofing)

1) Spear-Phishing Attack Vectors  
1) Perform a Mass Email Attack  
2) Email attack single email address  

• Uses Gmail, SMTP, or Sendmail for spoofing.
• Attaches a malicious payload (e.g., PDF exploit).

2. Website Cloning (Credential Harvesting)

2) Website Attack Vectors  
3) Credential Harvester Attack Method  
2) Site Cloner  

• Clones a login page (e.g., Facebook, Gmail).
• Captures credentials entered by victims.

3. Malicious QR Code Attack

6) QRCode Generator Attack  
1) Generate QRCode for a URL  

• Generates a QR code pointing to a malicious site.
• Useful for physical social engineering.

4. PowerShell Attack (Windows Exploitation)

7) Powershell Attack Vectors  
1) Powershell Alphanumeric Shellcode Injector  

• Generates obfuscated PowerShell payloads.
• Bypasses AV detection.

5. Infectious USB/DVD Attack

3) Infectious Media Generator  
1) File-Format Exploits  

• Creates a malicious PDF, Word doc, or executable.
• Auto-executes when opened.

Command-Line Options

Run SEToolkit non-interactively:

setoolkit --help

Common flags:

• --update → Update SEToolkit.
• --config → Modify configuration.
• --quick-start → Bypass intro.

Real-World Use Cases

1. Red Team Assessments

• Simulate phishing attacks to test employee awareness.
• Deliver fake updates to check security policies.

2. Penetration Testing

• Harvest credentials via cloned login pages.
• Test physical security with malicious USBs.

3. Law Enforcement (Ethical Use)

• Track cybercriminals via phishing traps.
• Gather evidence from malicious actors.

Troubleshooting Tips