Backtrack 4: Penetration Testing with Social Engineering Toolkit

All right, follow along, this is really technical and there are a lot of steps. Okay, I am kidding, it is a really simple, menu driven process. And remember that this is a tool for the good guys, who knows what the bad guys are using. One last note, turn off Apache or the SET won’t run.

1. Obtain Backtrack 4, the VMWare image works great.
2. First click on the menu button, Start the networking service. Then click on Backtrack, and then the Penetration Menu and finally Social Engineering Toolkit.
3. This will bring up a program menu; you need to update both the Social Engineering Toolkit and the Metasploit Framework.
4. Next, I had to reboot my machine to get it to work right after the updates.
5. Now, click on main option 2 – Website Attack Vectors (Notice step 3 – Infections USB/CD/DVD Generator…)
6. Next, chose Option 1, Web Templates, Let SET create a website for you. (Notice options to clone websites to match the company that you are doing the penetration test for…)
7. Next is your choice for attack methods, the Java attack works well, chose 1 – Java Applet Attack Method
8. Next select 1- Java Required (Notice other options…)
9. Next select the type of payload for the attack, I like option 2 – Windows Reverse_TCP Meterpreter.
10. Next chose the encoder to bypass anti-virus. I have never had anything detect number 2 – Shikata_Ga_Nai with 3 encryption passes (encryption passes is next option).
11. Next chose port for the Metasploit Listener, 80 is default, I just hit enter
12. Next option is “Do you want to create a Linux/OSX payload too?” I hit no, my target is a Windows PC
 

 Many Thanks to 

SET creator David Kennedy.