In this lesson,
we're going to be using the Social Engineering Toolkit.
The Social Engineering Toolkit, also known as SET,
is installed by default inside of Kali Linux.
To launch it, we're simply going to be inside
of our root@kali terminal,
which you can access by using the root terminal emulator
from your Kali desktop.
Once you're there, type in setoolkit,
for a Social Engineering Toolkit, and hit Enter.
Once you do that, it will go ahead and log in,
and the first time you do need to agree
to the terms and conditions.
Now that you're at the main menu
of the Social Engineering Toolkit,
we can use the menu system
to navigate and configure the different tools.
There are lots of different tools
inside the Social Engineering Toolkit,
and for the exam,
you don't need to be familiar with all of them,
but you should realize that if you're conducting something
like farming or phishing,
the Social Engineering Toolkit
is the tool that's going to help you do that.
In this particular video,
I'm going to show you how we can direct users
to a site that we control
to try to collect their username and password
when they try to log into a site
that they believe is legitimate,
something like Facebook or LinkedIn.
To do this, we want to go ahead
and use the social engineering attacks, which is option one.
You'll see you're greeted by, again, another menu.
Here we can see things like Spear-Phishing Attack Vectors,
Website Attack Vectors, Infectious Media Generator,
Create a Payload and Listener, Mass Mailer Attacks,
Arduino-Based Attack Vectors,
Wireless Access Point Attack Vectors,
QR Code Generator Attack Vectors, PowerShell Attack Vectors,
and Third Party Modules.
Now, even though we're going to be doing
a spear-phishing attack,
I want to be able to create a website
that's going to collect their credentials from people.
So we're going to go under Website Attack Vectors first,
which is number two.
Once we get here, you'll see a short description
of each of the different functions listed on the screen.
The one we're going to be using is the credential harvester,
which is number three.
When we do this, it's going to utilize
web cloning of a website
that has a username and password field,
harvest all that information
that's being posted to the website,
and allow us to collect it.
So I'm going to hit three.
Once I'm there, we're going to see that this tells us
the first method will allow SET,
or the Social Engineering Toolkit,
to import a list of predefined web applications
that it can utilize within the attack.
The second method would completely clone a website
of your choosing and allow you to utilize the attack vectors
within the completely same web application
that you're attempting to clone.
The third method allows you to import your own website.
Note, you should only do this
when you have an index.html site
when you're importing the website functionality.
Now what we're going to use is number two,
which is the site cloner.
Now that we've done that,
you'll see additional information on the screen.
It's saying that credential harvester
is going to allow you to utilize the clone capabilities
within the Social Engineering Toolkit
to harvest credentials or parameters from a website,
as well as place them into a report.
Now, before you enter your IP address,
you need to read this important note.
This note says that if you're using an external IP address,
you need to place the external IP address below
and not your NAT address.
Now, in our particular lab environment,
I am going to stay with my NAT address,
which is my local system,
because I'm not putting this out on the internet
to try to actually exploit people.
But if I was,
I would have to use my public facing external IP address
instead of my private IP address that you see selected here.
I'm going to go ahead and hit enter,
which will end up using the default address
of 10.0.2.15, which is my current Kali Linux IP.
And then it says it supports both HTTP and HTTPS.
Now, what do we want this URL to be cloned?
Well, I'm going to make it easy on myself
and I'm just going to use something everybody uses,
which is facebook.com.
Alright, it's going off to Facebook,
it's capturing that site, it's cloning the login page,
and getting everything set up for me.
Okay, at this point, it is running in the background
and you can see it says the information
will be displayed below as it arrives.
So what we need to do is actually have a victim
go to the IP address of this Kali machine
so we can see what that form looks like.
Okay, to do that, I'm going to go ahead
and make this not full screen anymore.
I'm going to move this over to the right corner
so we can still see it,
and any information we gather should be displayed
right here underneath the blue text.
And then I'm going to open up Firefox.
Now that I have Firefox, I'm going to go to 10.0.2.15,
which was our website on our Kali machine.
And there it is.
We now see that we are at facebook.com,
and the reason it's showing in Spanish
is because I'm located in Puerto Rico,
so when I went out to Facebook to grab that,
it actually grabbed the Spanish version of the site.
Now, if I wanted to make sure this was in English,
I could do that through a VPN
when I was grabbing this originally
to make sure that I got the English version.
At this point, if somebody tries to log in,
for instance, jason@diontraining,
with the password, "password,"
what's going to happen?
Is it is actually going to go and take their password
and it redirected them over to facebook.com
so they can try again.
Now in the background,
the Social Engineering Toolkit
has actually grabbed that information,
so let's go ahead and take a look at that.
Okay, so now that we have Social Engineering Toolkit
has grabbed that information, we're going
to hit Control + C,
and this is actually going to go ahead
and put that information into a report
at root/.set/reports/ the date and time
for our reading after the fact.
So I'm going to go ahead and hit enter and there we go.
Now if I want to go and see that,
we're going to go ahead and open up another terminal.
From here, we are going to go into root/
.set/reports
and then hit Enter.
And there is our report.
So let me go ahead and make that a little bit bigger for us.
If we want to display it to the screen, we'll just use cat.
And I'm just going to do pipe, more,
and that way we'll see one page at a time.
So, what are we seeing here?
Well, we're seeing an XML file.
Now, this can be shown in all different formats
because it is XML,
but I'm just showing it here in TXT format
to make it really easy for us to look through.
Now as we go through,
we're going to see information based
on each individual person.
In this case, the first one we have was user zero.
This is a parameter that we're getting set here
so we can keep track of the users we've collected
because we might run this for a week
and collect all that information.
You'll see over and over that user zero is there
because that's the person that we were dealing with.
User zero, user zero,
but so far I don't see that username and password,
so I'm going to keep on looking.
And as I go down, we see that there it is.
We have the username and the password,
email and password right there that was collected.
And that's just a really simple example
of how you can use the Social Engineering Toolkit
to be able to collect information by cloning a website
and doing what is known as a farming attack.
Now that we know the website works,
we could create a spear-phishing email,
send that to our victims,
and try to get them to go to our web link.
Now, this is where it's helpful if you have a web domain
that looks like the original,
like facebooks.com instead of facebook.com,
so that way it's easier to trick users
into clicking that link.
Now, in addition to this,
we could go back into our Social Engineering Toolkit.
We close this window,
and now we want to get that website
over to our end users to click on the link and get there.
How would we do that?
Well, if we go back a menu
and we go up to our spear-phishing attack vectors,
you can see here that we could perform a mass email attack,
which would be phishing.
We could create a file format payload,
or we could create a social engineering template.
In our case, we're going to perform a mass email attack,
and from here,
we can start setting out what those
payloads are going to be.
Now, by default, the Social Engineering Toolkit's
spear-phishing campaigns or mass emailing campaigns
are going to try to attach a file
such as a PDF with an embedded EXE.
And so it's asking us, which payload do we want to deliver
as part of this exploit.
As you go into your attacks and exploits phase,
you'll be able to pick which of these is most relevant.
For example, if you're looking at number six,
which is Microsoft Word RTF,
that only applies if the person is running Microsoft Word.
If we're running something like OpenOffice,
it's not going to be vulnerable to that attack.
So going back to your reconnaissance
and information gathering
is going to be important to decide what you want to do.
Additionally, all of these are using an embedded EXE.
Now that means it's only going to be vulnerable
against Windows systems.
I run a MAC computer,
and so this attack would not work on my personal system.
Now, as we pick one,
let's go ahead and say we're going to pick number six,
which is the Microsoft Word vulnerability
because a lot of people use Word,
and then we can choose what payload we want,
whether that's a reverse shell, meterpreter shell,
or other types of shells like that.
Personally, I like a meterpreter reverse shell,
so I'm just going to hit number two,
and then we're going to set up our payload listener.
Now, this again, would need to be a public-facing IP
if you're going to be doing this attack over the internet.
In my case, I'm doing it locally inside my lab,
so I can use the default of 10.0.2.15,
which is the IP of my Kali machine.
And then what port do we want them to connect over?
I personally like using 443, just like it recommends,
because that looks normal to a network defender
when they're looking through their logs
that a workstation in their network
is connecting to some web server over 443,
which would be some kind of a secure HTTPS connection.
So using 443 works for us.
And there we go.
It's going to go ahead and do all the hard work for you
and get everything created for you.
All right, now that it is done creating that payload
and creating that malware for us,
we're able to start sending this out.
Now you'll notice here it says if you're using Gmail,
you need to create an application password
using Google to be able to set that up.
If you're using your own SMTP server,
that won't be an issue for you.
Now, the next option it has
is the ability for us to change the file name.
For example, right now it's named template.whatever.pdf.
Now, if I'm going to do something where I'm trying to say
this is an invoice that the company needs to pay,
I might want to call it something like invoice.
So I'm going to go ahead and hit number two
to rename the file
and we're going to enter in the new file name
of invoice1645.pdf and hit Enter.
All right, we now have this file
that is now called invoice1645.pdf,
which would be something that looks
like somebody would be able to click on
as an attachment in their email,
and that would be something that
most people in a business environment would open up
if you were sending it
to something like the accounting department.
Alright, the next thing we have to do
is look at the mass mailer.
At this point, we can send an email to a single address
or to everybody.
Now in my case, I'm going to do a targeted campaign.
Maybe I'm going towards the CFO,
the chief financial officer,
so I'm just going to go after a single email address.
At this point, we can use a predefined template
or we can craft one of our own.
I'm going to go ahead and do a crafting of my own.
The subject of the email, "Invoice from Dion Training
number 1645."
Will the message be plain text or HTML?
I'm going to use plain text and I prefer plain text
because a lot of corporations will actually strip out HTML,
and so using plain text is going to be a better option
to get through a lot of defenses.
And now we're going to enter the body of the message.
"Mr. Smith," [Enter]
"Attached is the copy of your invoice,
please remit payment within 30 days
per our NET30 terms."
[Enter] [Enter]
"Thank you, Alexandra Cortez,
CFO."
There we go. Okay.
Now that we're done, we'll hit Control + C.
And we're going to say, who are we
going to send this email to?
Let's say my target was john.smith@bigcorp.com,
and there we go.
Now, in this email, I didn't provide the link
to the website that we just set up,
but I could just as easily say,
"This is an email from Facebook,"
provide them the link to go to facebooks.com,
which goes to my site,
which is capturing their log in credentials.
It really is up to you to get creative
with how you want to do your targeting, whaling,
spear-phishing, and phishing emails
using the Social Engineering Toolkit.
But my purpose in this video
is just to show you the basics of how to use it.
Now, we need to figure out how we're going to send this.
Are we going to use a Gmail account
or use our own server or open relay?
At this point, we'll just hit number two
for our own server or our own open relay,
and then we're going to say, what is our from address?
In this case, it was alexandra@diontraining.
What was the from name?
Alexandra Cortez.
And then the open relay,
we'll go ahead and hit blank,
'cause it's an open relay
password is blank because it's an open relay.
And then the server, we're going to be using.
For instance, smtp.diontraining.com
or whatever open relay you have.
Now in this case, this is not a real SMTP server,
so we're going to get an error.
And then the port we're going to use is 25.
And then, flag this as high priority or not?
We're going to say no.
And then we're going to say, do
we want to set up a listener?
Yes, because we are attaching that reverse shell
inside that PDF.
So by setting up a listener,
we're now sitting here, waiting for somebody to connect.
As soon as they open up that PDF,
it's going to try to run that executable
inside of it that's embedded
and be able to create that reverse shell
with meterpreter's payload
and connect back to my system
so I can do further exploitation.
Now, we're not going to talk about Metasploit right now
in this particular lesson.
We're going to spend some time in Metasploit later on
when we get into attacks and exploits,
specifically focused on network attacks
and application attacks.
At this point that email is going, it is being sent,
and at this point we are sitting here
just waiting for somebody to connect.
If they connected, we would see a connection come on,
and then we'd have remote access to their system.