Scribd Logo
Upload

Welcome to Scribd!

  • 59 views

    Lab+ +Harvesting+Credentials+Using+the+SET+Tool+Kit

    Uploaded by

    Mohcine Oubadi
    The document provides instructions for using the Social Engineering Toolkit (SET) to perform a credential harvesting attack. It describes launching Kali and Windows XP virtual machines. It then guides setting up a credential harvesting attack using SET to clone the Facebook login page. The IP address of the Kali machine is used to host the fake login page. When credentials are entered, they are harvested and stored in a report on the Kali machine. The report can then be viewed locally to reveal the captured username and password.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Lab+ +Harvesting+Credentials+Using+the+SET+Tool+Kit

    Uploaded by

    Mohcine Oubadi
    59 views10 pages
    The document provides instructions for using the Social Engineering Toolkit (SET) to perform a credential harvesting attack. It describes launching Kali and Windows XP virtual machines. It then guides setting up a credential harvesting attack using SET to clone the Facebook login page. The IP address of the Kali machine is used to host the fake login page. When credentials are entered, they are harvested and stored in a report on the Kali machine. The report can then be viewed locally to reveal the captured username and password.

    Original Description:

    Lab+ +Harvesting+Credentials+Using+the+SET+Tool+Kit

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides instructions for using the Social Engineering Toolkit (SET) to perform a credential harvesting attack. It describes launching Kali and Windows XP virtual machines. It then guides setting up a credential harvesting attack using SET to clone the Facebook login page. The IP address of the Kali machine is used to host the fake login page. When credentials are entered, they are harvested and stored in a report on the Kali machine. The report can then be viewed locally to reveal the captured username and password.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    59 views10 pages

    Lab+ +Harvesting+Credentials+Using+the+SET+Tool+Kit

    Uploaded by

    Mohcine Oubadi
    The document provides instructions for using the Social Engineering Toolkit (SET) to perform a credential harvesting attack. It describes launching Kali and Windows XP virtual machines. It then guides setting up a credential harvesting attack using SET to clone the Facebook login page. The IP address of the Kali machine is used to host the fake login page. When credentials are entered, they are harvested and stored in a report on the Kali machine. The report can then be viewed locally to reveal the captured username and password.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 10

    Lab - Harvesting Credentials Using the SET Tool Kit

    Hardware requirements for these labs:

    1. Do not use a Wi-Fi connection. Use an Ethernet cable to connect to the network. Wi-Fi is
    configured for IPSec which can impede the labs from working. The additional transport and
    tunneling protocols do not play well with Kali or Metasploit.

    2. The IP address shown in the lab are for demonstration purposes only. Your actual IP address
    with differ.

    Introduction:
    Overview of the Social-Engineering Toolkit (SET)
    The Social-Engineering Toolkit (SET) is specifically designed to perform advanced attacks against the
    human element. SET was designed to be released with the launch http://www.social-engineer.org and has
    quickly become a standard tool in the pen testers arsenal. The attacks built into the toolkit are designed to
    be targeted and focused attacks against a person or organization used during a penetration test.

    • The Social-Engineering Toolkit (SET) is a python-driven suite of custom tools which solely
    focuses on attacking the human element of penetration testing.
    • Its main purpose is to augment and simulate social-engineering attacks and allow the tester to test
    how a targeted attack may succeed effectively.
    Section 1 – Launch Kali and Windows XP SP2
    1. Open your VMWare Player and launch a Kali.
    2. Open a second instance of VMWare Player and launch your Windows XP SP2 victim
    Section 2. Update and upgrade your Kali install
    From the Kali quick launch menu, open a console terminal and type the following commands:

    • apt-get update && apt-get upgrade && apt-get dist-upgrade


    Once the updating and upgrading has completed, you can confirm the SET application has been updated
    by typing apt-get upgrade set

    Close the terminal session.


    Section 3. Open a Terminal Console and Retrieve Your Kali IP Address
    At the terminal prompt type ifconfig -a

    Stop! This is not your IP address. Your address will be similar, but this is not it.
    Write down your IP address. You’ll need it for later. Close the terminal session.
    Section 4. Start the Social Engineering Toolkit (SET)
    Open a new terminal session and from the prompt type 1
    Disregard the out of date warning. We have already confirmed we have the latest version. Hit enter.
    Accept the terms of service.

    Welcome screen appears:

    From the menu select Social Engineering Attacks (1).


    From the next menu select Website Attack Vectors (2).
    Read everything on the next screen!

    Select Credential Harvester Method (3)


    On the menu, select Site Cloner (2)

    The object of this exploit is to convince the victim that our Kali machine is now hosting Facebook, and
    this is where they should come to log in. When this happens, we will harvest the user’s username and
    password. You could do this for any website that requires a user to login with a username password. It
    could a be a corporate website. It could be a bank, PayPal, LinkedIn or whomever.

    Credential harvester will generate an exact clone of the website the user normally logs onto. All we have
    to do is convince that they are logging into the real site. Let’s see how we might do this.
    We’ve completed the setup on our end. Remember, we could have used our external or outside IP address
    in a real attack and sent the bogus URL out to tens of thousands of PayPal users. I wouldn’t recommend
    that as that would lead right back to your location.
    This hack is not isolated to just Windows XP; it will work on any operating system where a user can be
    convinced the message they received with the bogus address is real. If the user has a browser and a
    machine connected to the Internet (or in this case, the local area network), the exploit should succeed.
    • Social Engineering Note
    o The Victim does not have to be Windows XP. Windows 7, 8.1 and 10 are susceptible to
    these types of attacks.
    o It can be any type of web browser (i.e., Internet Explorer, Firefox, Chrome, etc.) for any
    type of Operating System (Windows, Linux, MacOS, etc.).
    o Imagine an attacker sending an email to the victim that reads, "Hey Check out the new
    beta version of Facebook," or whatever website was cloned.
    All of us get bogus emails with just an URL address in the message box. The reason we get so many of
    these types of messages is that these types of social engineering attacks are very successful.
    Organized crime my send out hundreds of thousands of bogus emails telling Bank of America customers
    they need to change their passwords for their web login. Same with PayPal and Facebook. You may not
    be a Bank of America customer, but someone who is a customer is receiving the same message.

    Section 5. Log on to your Windows XP Machine


    Open Internet Explorer

    In the address bar, type the address of your Kali machine.


    Hit enter. If the Facebook login page does not appear in timely fashion, refresh the browser by hitting the
    F5 key.
    The following login page will appear:
    Type in a bogus username and password.

    Once the user submits their username and password, they will receive a Page Cannot Be Displayed
    Error.
    1. Notice that the Address URL changed to Facebook.
    o This is to give the victim a sense of perhaps a failed login attempt instead of invoking
    suspicion and alarm.
    2. Continue to the next section to see the victim's username and password.
    Sine we have not updated IE 6, the web page will appear washed out. If you want to the actual Facebook,
    you need an updated browser.
    Here’s what the Facebook login appears like when I connect to Kali using a Firefox from my Windows 7
    machine:

    Return to your Kali terminal, and you will see the harvested username and password of the victim.

    When you are done, read the bottom of the screen.


    Read where the reports are cached.

    Hit enter.

    Opening the Report in Firefox


    At the terminal, type the following commands, one line at a time and hit enter after each entry.
    1. cd /root/.set
    2. ls (list the contents of the /.set directory.)
    3. cd reports
    4. ls (list the contents of the report directory)

    5. firefox ‘<name of report>.html' (this open the report. Hint: copy and paste
    the file name after you type in Firefox.)

    Here’s what my harvester file looks like:


    There’s a lot more we can do in a real-world pentest. We can use an outside address and on our router
    map the outside address to port 80 pointing to our Kali machine. All routers have a different interface for
    port forwarding but what you are telling the router is, “Any outside traffic for port 80, send it here.”

    We can also disguise the outside IP address by getting a free tiny URL the user sees in the place of the IP
    address.
    I took outside IP address and shortened it to a tiny URL using a free service called bitly.com
    https://bitly.com/ (this is not my real outside IP address)

    Now when the victim sees my email he won’t see my outside IP address, they’ll see bit.ly/1YhpPZd
    The other half of this hack is convincing someone your email is legit. This goes to the heart of social
    engineering. Hackers come up with very inventive ways to convince someone they are legit. What usually
    gives it up as not being legit is bad grammar and bad spelling.
    End of the lab!

    You might also like