I. Social Engineering Penetration Testing using Social Engineering Toolkit

Scenario

As a security expert, you should circulate the best practices to be followed among the employees.

Social engineering is an ever-growing threat to organizations all over the world. Social engineering attacks are used to compromise companies every day. Even though there are many hacking tools available with underground hacking communities, a social engineering toolkit is a boon for attackers as it is freely available to use to perform spear-phishing attacks, website attacks, etc. Attackers can draft email messages and attach malicious files and send them to a large number of people using the spear-phishing attack method. Also, the multi-attack method allows utilization of the Java applet, Metasploit browser, Credential Harvester/ Tabnabbing, etc. all at once.

Though numerous sorts of attacks can be performed using this toolkit, this is also a must-have tool for a penetration tester to check for vulnerabilities. SET is the standard for social-engineering penetration tests and is supported heavily by the security community.

As an ethical hacker, penetration tester, or security administrator, you should be extremely familiar with the Social Engineering Toolkit to perform various tests for vulnerabilities on the network.

Lab Objectives

The objective of this lab is to help students learn to:

• Clone a website

• Obtain usernames and passwords using the Credential Harvester method

• Generate reports for conducted penetration tests

Lab Analysis

In this lab, you have learnt how to use encrypting/decrypting commands and generating hashes and checksum files. Analyze and document the results related to the lab exercise.