SET

The Social Engineering Framework


The Social Engineering Framework is a searchable information resource for people wishing to learn more about the psychological, physical and historical aspects of social engineering. Please use the index below to find a topic that interests you.

Social Engineer Toolkit (SET)

The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the https://www.social-engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.
“The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SETwas designed to be released with the http://www.social-engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.”
Actually this hacking method will works perfectly with DNS spoofing or Man in the Middle Attack method. Here in this tutorial I’m only write how-to and step-by-step to perform the basic attack, but for the rest you can modified it with your own imagination ðŸ™‚ .

15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5 :

1. Change your work directory into /pentest/exploits/set/
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
2. Open Social Engineering Toolkit(SET) ./set and then choose "Website Attack Vectors" because we will attack victim via internet browser. Also in this attack we will attack via website generated by Social Engineering Toolkit to open by victim, so choose "Website Attack Vectors" for this options.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
3. Usually when user open a website, sometimes they don’t think that they are opening suspicious website that including malicious script to harm their computer. In this option we will choose "The Metasploit Browser Exploit Method" because we will attack via victim browser.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
4. The next step just choose "Web Templates", because we will use the most famous website around the world that already provided by this Social Engineering Toolkit tools.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
5. There are 4 website templates Ready To Use for this attack methods, such as GMail, Google, Facebook, and Twitter. In this tutorial I will use Google, but if you think Facebook or Twitter more better because it’s the most accessed website, just change into what do you want.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
6. For the next step…because we didn’t know what kind of vulnerability that successfully attack the victim and what type of browser, etc, in this option we just choose "Metasploit Browser Autopwn" to load all vulnerability Social Engineering Toolkit known. This tools will launch all exploit in Social Engineering Toolkit database.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
7. For payload options selection I prefer the most use Windows Shell Reverse_TCP, but you also can choose the other payload that most comfortable for you.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
8. The next step is set up the Connect back port to attacker computer. In this example I use port 4444, but you can change to 1234, 4321, etc
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
9. The next step just wait until all process completed and also wait until the server running.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
10. When the link given to user, the victim will see looks-a-like Google(fake website). When the page loads it also load all malicious script to attack victim computer.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
12. In attacker computer if there’s any vulnerability in victim computer browser it will return sessions value that mean the exploit successfully attacking victim computer. In this case the exploit create new fake process named "Notepad.exe".
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
13. To view active sessions that already opened by the exploit type "sessions -l" for listing an active sessions. Take a look to the ID…we will use that ID to connect to victim computer.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
14. To interract and connect to victim computer use command "sessions -i ID". ID is numerical value that given when you do sessions -l. For example you can see example in picture below.
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
15. Victim computer already owned. ðŸ™‚
15 Steps to Hacking Windows Using Social Engineering Toolkit and Backtrack 5
I’m practice to create this tutorial using Virtual Machine so it will not harm other computer and also you can doing a lot of experience with your OS.

Countermeasure :

1. Don’t trust to unknown link
2. Use personal firewall to detect inbound and outbound traffic

0 comments:

Subscribe to: Post Comments (Atom)
Copyright © 2013 Anonymous Hacker