Social

Engineering
Lab Manual

Hacking with

THE DOCUMENT INCLUDES ADDITIONAL

PRACTICALS WHICH MAY OR MAY NOT BE COVERED
IN THE COURSE
 INDEX
S. No. Practical Name Page No.
1 Creating a phishing page using Social Engineering Toolkit (SET) - 1
LAN Attack
2 Creating a phishing page using Social Engineering Toolkit (SET) - 4
WAN Attack
3 Hacking windows machines with HTA attack method 9
4 Web-jacking Attack using Social Engineering Toolkit 13
Practical 1: Creating a phishing page using Social Engineering Toolkit
(SET) -LAN Attack
In Kali Linux terminal, execute the below command to remove existing files from web root
location.

launch Social Engineering Toolkit by executing below command

Based on our requirement, we can choose from seven different options on the SE toolkit menu.
In this practical, we intend to create a phishing a page which looks similar to the Facebook login
page.

Select option 1 Social-Engineering Attacks

Page | 1
Select option 2 Website Attack Vectors

Select option 3 Credential Harvester Attack Method to harvest login credentials with the help
of phishing page.

Choose 2 Site Cloner to clone a live website.

Provide a local IP address (attacker private IP) for the postback.

Provide the address of website to be cloned (https://www.facebook.com/) press enter and wait
until Credential Harvester is running on port 80 message.

Page | 2
Trick victim to visit phishing page running on attacker’s IP address (use URL shortening service
to make IP address look like web link). If the victim submits login credentials on phishing page,
then the attacker will be able to view those credentials.
On victim’s computer:

On attacker’s computer:

Page | 3
Practical 2: Creating a phishing page using Social Engineering Toolkit
(SET) -WAN Attack
In Kali Linux terminal, execute the below command to remove existing files from web root
location.

Ngrok Installation and configuration:

Ngrok is a tool that opens access to the local ports on the internet and creates a secure tunnel.
Visit https://ngrok.com and register to download a free version of the software.

To install ngrok application follow the process shown in below images (We can also get detailed
installation steps from the ngrok website).

To run ngrok on our computer (attacker’s kali linux machine), from ngrok directory execute the
command given on the ngrok website.

Page | 4
Execute below command that starts ngrok.

After executing the above command, ngrok opens a new terminal with links to forwarded ports.

Creating the phishing page:

launch Social Engineering Toolkit by executing below command

Page | 5
In this practical, we intend to create a phishing a page that looks similar to the Facebook login
page which should be available for anyone on the internet.

Select option 1 Social-Engineering Attacks

Select option 2 Website Attack Vectors

Page | 6
Select option 3 Credential Harvester Attack Method to harvest login credentials with the help
of phishing page.

Choose 2 Site Cloner to clone a live website.

To perform WAN level phishing attack, provide domain generated by ngrok for the postback.

Provide the address of website to be cloned (https://www.facebook.com/) press enter and wait
until Credential Harvester is running on port 80 message.

Page | 7
Trick victim to visit https://06966015.ngrok.io . If the victim submits login credentials on
phishing page, then the attacker will be able to view those credentials.
On the victim’s computer:

On the attacker’s computer:

Page | 8
 Practical 3: Hacking windows machines with HTA attack method
In Kali Linux terminal, execute the below command to remove existing files from web root
location.

launch Social Engineering Toolkit by executing below command

Based on our requirement, we can choose from seven different options on the SE toolkit menu.
In this practical, we intend to create a phishing a page which looks similar to the Facebook login
page.

Select option 1 Social-Engineering Attacks

Page | 9
Select option 2 Website Attack Vectors

This time, choose Option 8 HTA Attack Method and hit enter

Choose 2 Site Cloner to clone a live website.

Provide the address of website to be cloned (https://www.facebook.com/) press enter

Provide IP address and Port number for reverse connection.

Page | 10
Choose Meterpreter Reverse TCP payload and press enter. This tool will create phishing page
and automatically starts Metasploit Framework and loads listener to receive connections.

Trick victim to open attacker’s IP address in the browser (use URL shortening service to make IP
address look like web link). This prompts the victim to download a file (Launcher.hta). Convince
the victim to execute this file to gain access to his computer.
On the victim’s computer:

Page | 11
On attacker’s computer:

Page | 12
Practical No 4: Web-jacking Attack using Social Engineering Toolkit.
In Kali Linux terminal, execute the below command to remove existing files from web root
location.

launch Social Engineering Toolkit by executing below command

Based on our requirement, we can choose from seven different options on the SE toolkit menu.
In this practical, we intend to create a phishing a page which looks similar to the Facebook login
page.

Select option 1 Social-Engineering Attacks

Page | 13
Select option 2 Website Attack Vectors

Choose option 5 Web Jacking Attack Method

Option 2 Site Cloner and hit enter

To perform LAN level attack, provide private IP address or provide a ngrok link for WAN level
attacks.

Page | 14
Provide the address of website to be cloned (https://www.facebook.com/) press enter.
Now, convince the victim to open attacker’s IP address (use URL shortening service to make IP
address look like web link)
On the victim’s computer:

If victim trusts this page and clicks on the link, the victim will be redirected to a phishing page
which displays original Facebook address (https://www.facebook.com/login.php) in URL bar for
a fraction of seconds and changes to attackers IP address.

Page | 15
On the attacker’s computer:

Page | 16