Social Engineering

Kali Linux is an operating system that is focused on hacking and penetration testing. It is the same operating system used by hackers and ethical hackers. With this operating system, we can hack passwords, websites, and inject viruses and trojans on to other computers and files. But we will be focusing on social engineering.

We will be using the social engineer toolkit. With this tool, we can trick humans to fall for our attacks.

The social engineering toolkit can be found in the social engineering tools list.

A terminal will show up and it will look like this:

We need to then enter y in the bottom.

After we enter y, menus will show up on our terminal. We must pay attention to the first option.

We need to enter ‘1’ in the terminal and press enter. After we type in ‘1’, a spear-phishing menu module will appear. This allows you to send personalised emails to victims that have FileFormatmalicious payloads. We can send a malicious PDF document which if opened, can compromise a system.

If we select option 1, we can let the social engineering toolkit do everything for us. If we select option two, we must do the emails ourselves.

Website Cloning

For this we would first need to check our IP address. We can check this by entering ifconfig in our terminal.

After this we now need to check the machines within our network. We can do this by typing in Netdiscover -r(IP Address) in the command. This screen should then come up.

We now need to ping the IP to check whether the hosts are live. Type in ping (IP Address) in the command.

Now let us open the social engineering framework. Type in settoolkit in the command.

We need to select the first option. Then choose the second option because we are cloning a website.

Website Attack Vectors

After that click on the fifth option

Web Jacking Attack Method

Lastly, click on site cloner which is the second option.

The URL of the website needs to be entered inside the terminal. We will be cloning Facebook. Go on to the Facebook website and copy the URL into the terminal. After this it will clone the website.

After the URL has been cloned, we can send the fake URL to our victim and when they go on the website, we will get all of their information.

They will be redirected to a blank page with a link. Once they click on the link they will be redirected to the login page.

When they type in the their credentials, it will be stored in our Kali Linux. We have to go on our root directory, .set//reports/html (usually the current date and time).

We now have the email and password of our victim.