Show Menu

Social Engineering Toolkit Cheat Sheet by

Cheatsheet showing the social engineering attacks within the social engineering toolkit

Menu Options

1 Social­-En­gin­eering Attacks
Various social engine­ering attacks
2 Penetr­ation Testing (Fast Track)
Attack vectors with a series of exploits and automation aspects to assist in penetr­ation testing
3 Third Party Modules
Third party modules such as RATTE and google analytic attacks
4 Update the Social­-En­gineer Toolkit
Updates SET and all of its modules
5 Update SET config­uration
Applies any updates made to the set.config file
6 Help, Credits, and About
Shows all of the credits as well as links to the official SET docume­ntation
99 Exit the Social­-En­gineer Toolkit
Exits SET as well as exiting any menu from within the modules

Social Engine­ering Attacks

Spear-­Phi­shing Attack Vectors
Allows you to specially craft emails and send to any number of people with attached fileformat malicious payloads
Website Attack Vectors
The Web Attack module is a unique way of utilizing multiple web-based attacks in order to compromise the intended victim. Attacks include Java Applet, Metasploit Browser Exploit, Credential Harvester, Tabnabbing and Web Jacking
Infectious Media generator
The Infectious USB/CD/DVD module will create an autoru­n.inf file and a Metasploit payload. When the DVD/USB/CD is inserted, it will automa­tically run if autorun is enabled
Create a Payload and Listener
Various Windows payloa­d/l­ist­eners ranging from meterp­reter sessions to VNC servers on the victim
Mass Mailer Attack
Sends phishing email to single email or various pulled from a user created list
Arduin­o-Based Attack Vector
Utilizes the Arduin­-based device to program the device. You can leverage the Teensy's, which have onboard storage and can allow for remote code execution on the physical system. Devices are registered as USB Keyboard's and will bypass any autorun disabled or endpoint protection on the system
Wireless Access Point Attack Vector
Creates a rogue access point and redirect victims back to the SET web server when associated
QRCode Generator Attack Vector
Creates a QRCode for any URL entered. Can be paired with additional attack vectors within SET to deploy the QRCode to the victim
Powershell Attack Vectors
Allows you to create PowerShell Specific attacks such as shellcode injectors, reverse shells and bind shells

Penetr­ation Testing (Fast-­Track)

Microsoft SQL Bruter
Will attempt to identify live MSSQL servers and brute force the weak account passwords that may be found. If that occurs, SET will then compromise the affected system by deploying a binary to hexade­cimal attack vector which will take a raw binary, convert it to hexade­cimal and use a staged approach in deploying the hexade­cimal form of the binary onto the underlying system
Custom Exploits
Obscure exploits that are primarily python driven. Exploits include MS08-067, Firefox 3.6.16 mChannel object use, Solarwinds remote SQL injection, RDP denial of service, MySQL Authen­tic­ation Bypass and F5 Root Authen­tic­ation bypass
SCCM Attack Vector
Utilizes SCCM config­ura­tions to deploy malicious software. Requires an SMSServer name and packageID you want to package on the website
Dell DRAC/C­hassiss Default Checker
Identifies the default instal­lations of Dell DRAC and chassis instal­lat­ions. If found allows you to access remote admini­str­ation capabi­lities to compromise the entire infras­tru­cture
RID_ENUM - User Enumer­ation Attack
Enumerate user accounts through a rid cycling attack through null sessions. Used internally against a domain controller
PSEXEC Powershell Injection
Injects a meterp­reter backdoor through powershell memory injection. Will circumvent Anti-Virus since it never touches the disk


No comments yet. Add yours below!

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.

          Related Cheat Sheets

          Reddit Cheat Sheet