Greetings. In this short video presentation, we're going to take a look at how to go about using the social engineering toolkit or set. The social engineering toolkit set is specifically designed to perform advanced attacks against the human element, I have updated and upgraded my Kali installation. And I have confirmed that I have connectivity between my Kali machine and my Windows XP victim, I confirm the connectivity by doing a ping from my colleague over to my Windows XP machine. To begin this lab, we're going to open up a terminal and at the terminal prompt, we're going to type in set toolkit, and I'm going to go ahead and just hit Enter. And just a moment, it's going to start up and here is where we have to agree to the terms of service.

So I'm gonna type in ally, and that brings us up to our first menu screen. On our first menu screen, we're going to type in the number one for social engineering attacks. Type in number one, I hit Enter On the second screen, we're going to type in the number two. For web site attack vectors. We're going to hit enter. On this next screen, we're going to type in the number three.

For credential harvester attack method, we're going to hit enter. On this next screen, we're going to type in number two for site Cloner. Hit enter. Notice that it captures the IP address of your Kali because Kali is going to act as the web server and when the individual types in their credentials onto this cloned web page. That information is going to be sent back over here to Kali. To get to the next step, we have to hit hit enter.

Now at wants the URL to be clone. For this lab, we're going to create a fake web page for Facebook. We're going to clone the website. And then we need to trick the end user into visiting our cloned website and given us their login. Once I've typed in the URL, I'm going to go ahead and hit enter In just a moment, the website for Facebook will be closed. So it's important that we read everything that's on this page has given you a lot of good information and it's telling you that the information will be displayed to you as it arrives below when it arrives from the victim machine.

So as the victim types in their username and password into the fake Facebook, log on page, that information is going to be sent over to our Cali machine and harvested. So we're now ready to play the victim in this harvesting attack. So how we get the user to partake in this scam is up to us. Normally, we would build a carefully crafted email, and we would make it look as if it was a problem with their account and they need to log in. And here's the link that you can use to log into your Facebook account or your bank account. Or your LinkedIn account, whatever the account is, and when they do that they're going to get a page cannot be found.

But though, that information that they inputted into the username and password field that's being sent over to your county server is being gathered up over there. So let's just see what happens. So here's the Facebook page. So I'm just going to type in a username here, I'll just type in cyber offense. And then I'm just going to type in the word password. And then I'm just going to say login.

Now notice that it says the page cannot be displayed. But if we go back over to our Cali, we see that the username and the password were harvested over onto our Kali machine. So we know that we got this information, and here are the attempts that were made. And there's my username, and there's my password. So you can see that this is a viable attack and it is a way to gather usernames and passwords. Words.

It's just depends on how we go about doing it. But it must work because cyber criminals and criminal organizations around the world use it to gain access to people's mail and their banking accounts. So once you're ready to generate your report, take note of where the report is going to be stored. Because this is where we're going to have to go find a report. The report is saved as an HTML document, and we're going to open it up in Firefox, but I'm going to show you a different way to access it. So we're now ready to go ahead and hit Enter.

And that brings us back to the main menu. On this screen, we can just type in 99 and hit enter and we hit 99. One more time, and hit enter and we hit 99. One more time, and hit enter. We're back to the prompt. I'm going to type in clear.

It's going to give me a nice clean terminal. To demonstrate how we go about accessing our harvested report. At the prop. We're going to Type in the cd command to change directory on over to the Ford slash route forward slash dot set directory. Now once we're up inside of the dot set folder, we can go ahead and type in LS. And that's going to list all the content.

Notice that we have a nother directory called reports. So we're going to CD over to reports. Hit enter. Now I'm inside of the reports directory. I'll do another LS, and here you can see the reports themselves. So what we need to do now is open up the HTML report using Firefox.

So I'm gonna type in Firefox, I'm just going to copy and paste all of this here to include the single quotes. Give it a minute. And just a second, Firefox is going to open up and it's going to give us the end there's our report. So you can go down and through this report, you can see the information presented to you in such a way that you can use Is it as part of a Fishel report or some other use such as record keeping? That concludes your short video presentation on how we go about using the social engineering toolkit to harvest credentials. In this short video presentation, you are shown how to use the set tool to call any website in this case Facebook and to trick users into giving us their username and password and how easy it was for Cali using the set tool to harvest those same credentials.

If you have any questions or concerns about this lab, please do not hesitate to reach out and contact your instructor and I will see you in my next video.