Hi there. I'm Rishalin Pillay, and welcome to my course called
People Information Gathering with the Social Engineering Toolkit.
When we think of social engineering attacks,
these attacks do not entail breaking into a system directly, rather,
it involves the human element.
Humans are the best resource of security vulnerabilities.
I mean, let's face it, because of our trusting nature,
attackers can easily abuse that by tricking us into opening a
malicious link or navigating to a malicious website where we will
then provide some sensitive information.
Social engineering attacks are common,
and they are often the entry point into more nefarious attacks.
For example, when you look at your email,
how often do you see emails stating that you have either won some
ridiculous amount of money or that you are an inheritant to some
inheritance? And within those emails are malicious links.
Unfortunately, many people still fall for those attacks today.
In this course,
we're going to look at how we can use the Social‑Engineering Toolkit to
perform some of these social engineering attacks.
The tool is designed and created by David Kennedy.
It is now maintained by TrustedSec.
Thanks a lot David, this is a really great tool that enables us to use
various social engineering techniques in red team assessments.
The tool is an open source penetration testing framework,
which is designed specifically for social engineering.
It is often abbreviated as SET. SET has a number of custom attack vectors that
allow you to make a believable attack quickly and easily.
The Social‑Engineering Toolkit is an open source tool,
and it's available on GitHub.
You can use the tool on both macOS, Linux,
and you can use it within Windows 10 if you make use of the Windows
subsystem for Linux. It supports multiple attack vectors.
For example, you can craft spear‑phishing attacks,
website attack vectors, you can also go ahead and create infectious media,
and a lot more. When we consider the kill chain, the social engineering tool
can be used within the reconnaissance phase.
Since social engineering really can work across
multiple phases in the kill chain,
this tool can be used across the entire kill chain.
When we consider the MITRE PRE‑ATT&CK tactics,
the social engineering tool falls within two different tactics,
the first being technical information gathering.
Within this tactic, it falls under T1249, which is Conduct Social
Engineering, and T1397, which is Spearphishing for Information.
Another category that this falls under is people information
gathering. Within people information gathering, it falls under
T1268, which is Conduct Social Engineering.
In this course, I will be using Kali Linux, and I'll be using version 2020.2.
Since the Social‑Engineering Toolkit is part of the operating system, ensure
that you update the OS so that you get the latest updates and any bug fixes
for the Social‑Engineering Toolkit.