Social Engineering Toolkit in the Hacking Village

This is the first of a series of posts describing how to perform the various types of attacks that are available to try in the Hacking Village at the ND Cyber Security Conference. These will serve as instructions during the conference, and as a resource after the conference.

First up is the Social Engineering Toolkit from Dave Kennedy of TrustedSec. This toolkit demonstrates how to perform a variety of social engineering attacks.

From the Toolkit:

DISCLAIMER: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes, period.

The attack method to be tested is cloning a website to harvest credentials.

1. Open a console on Kali Linux 
2. setoolkit and then enter to launch
3. 1 for Social-Engineering Attacks.
4. 2 for Website Attack Vectors
5. 3 for Credential Harvester Attack Method
6. 2 to clone a site
7. Enter to accept the default IP
8. https://apps.ndsu.edu/cas/login or a login form your control to clone
9. Enter to understand what they are saying
10. Launch Firefox
11. Go to http://localhost to load the page
12. Any credentials that you enter in will be posted back to SET in plain text. DO NOT USE REAL CREDENTIALS.
13. Go back to SET console and see provided credentials

More instructions and operations can be found on the SET website at https://github.com/trustedsec/social-engineer-toolkit/