Social Engineering Attack Vectors

Social Engineering Toolkit (SET) is a powerful tool included in Kali Linux, designed to perform advanced social engineering attacks. It automates various techniques that trick users into divulging sensitive information, such as login credentials. SET provides multiple attack vectors to exploit human vulnerabilities rather than system vulnerabilities.

Spear-Phishing Attack Vector

This attack method targets a specific individual or group by crafting an email that appears legitimate. The attacker embeds a malicious payload inside an email attachment or links the victim to a fake login page to steal credentials.

Example Usage:

 setoolkit
 # Select Social-Engineering Attacks
 # Choose Spear-Phishing Attack Vectors
 # Select Create a File Format Payload
 # Select a malicious payload type (e.g., Meterpreter payload)

Once the victim opens the attachment, the attacker can gain access to their system.

 

Website Attack Vector

The Website Attack Vector allows attackers to clone a legitimate website and host a malicious version. When victims enter their credentials, the data is sent to the attacker.

Example Usage:

 setoolkit
 # Select Social-Engineering Attacks
 # Choose Website Attack Vectors
 # Select Credential Harvester Attack Method
 # Provide the URL of the website to clone

Once deployed, victims entering their credentials on the fake page unknowingly hand them over to the attacker.

Wireless Access Point Attack

This method creates a rogue Wi-Fi access point that appears legitimate. Victims connect to it, allowing attackers to intercept traffic and capture sensitive information.

Example Usage:

 setoolkit
 # Select Social-Engineering Attacks
 # Choose Wireless Access Point Attack

Once victims connect, attackers can perform man-in-the-middle (MITM) attacks to steal data.

QR Code Generator Attack

This attack generates malicious QR codes that, when scanned, redirect victims to a phishing site or download malware.

Example Usage:

 setoolkit
 # Select Social-Engineering Attacks
 # Choose QRCode Generator Attack
 # Enter the malicious URL

The generated QR code can be distributed via posters, emails, or websites, tricking victims into scanning them.

Legal disclaimer

Usage of the tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state and federal laws.