Social Engineering Toolkit: Full Hands-On Guide for Kali Linux

Human error remains the primary entry point for corporate data breaches and unauthorized network intrusions. While firewalls and endpoint protection software safeguard perimeter interfaces, human deception attacks bypass technical defenses entirely. The Social Engineering Toolkit (SET) is a specialized framework designed to evaluate workforce security awareness by automating realistic phishing campaigns, credential harvesting, and client-side payload attacks inside Kali Linux.

Developed by David Kennedy (TrustedSec), SET consolidates multi-vector social engineering techniques into an accessible menu-driven interface. Security auditors and red teams use this framework to measure an organization’s susceptibility to targeted deception and validate email gateway security controls.

What Is the Social Engineering Toolkit (SET)?

The Social Engineering Toolkit is an open-source penetration testing framework written in Python. It simplifies social engineering operations by generating deceptive communications, malicious landing portals, and weaponized payloads without requiring custom exploit authoring for every assessment.

SET links directly with testing tools like the Nmap scanner and the Metasploit Framework. When an operator configures an attack vector, SET automatically creates the required payloads and starts the corresponding background network listener.

The framework supports diverse attack surfaces, including email spear-phishing, physical USB drop attacks, SMS spoofing, QR-based routing, and web portal harvesting. Review the open-source code on the official TrustedSec SET GitHub repository to learn more about its modular architecture.

Core Features and Capabilities

SET delivers automated workflows that simplify multi-stage attack simulations for red teams and security compliance auditors:

• Multiple Attack Vectors: Simulates attacks through malicious email delivery, physical HID USB devices, SMS spoofs, QR codes, and web portals.
• Automated Payload Deployment: Seamlessly packages reverse shells, PowerShell scripts, and executable payloads while launching listener consoles.
• Website Cloning and Harvesting: Clones real login pages in seconds to assess workforce susceptibility to domain impersonation.
• Integrated Mass Mailer: Sends targeted spear-phishing templates to individual targets or distributed department distribution lists.
• Detailed Campaign Reporting: Logs campaign metrics, tracking submitted credentials and listener callbacks to document training gaps.

Legal and Compliance Notice: Social engineering assessments require explicit, written authorization from organizational leadership. Simulating credential harvesting or delivering deceptive payloads against systems or employees without prior legal consent violates computer misuse laws.

Creating a Reverse TCP Meterpreter Payload and Listener

One of SET’s core functions is generating client-side executable payloads paired with active listeners to evaluate endpoint execution policies.

1. Launch the toolkit from your terminal by running setoolkit with administrative privileges.
2. Select Social-Engineering Attacks (Option 1) from the main menu.
3. Choose Create a Payload and Listener (Option 4).
4. Select the Windows Reverse_TCP Meterpreter payload.
5. Enter your local listening IP address (LHOST) and listening port (LPORT).

SET compiles the custom payload executable and saves it to your local filesystem path:

# Payload generated path
/root/.set/payload.exe

Immediately after generating the binary, SET launches msfconsole in the background, pre-configured with the corresponding multi/handler listener.

When an authorized user executes the file in an isolated test environment, the payload initiates a connection back to the attacker machine, establishing a reverse shell session.

Generating QR Code Attack Vectors

Mobile workforce deception increasingly uses malicious QR codes (often called quishing). Attackers place deceptive QR codes in physical lobbies, email flyers, or badge readers to divert mobile browsers away from enterprise authentication portals.

1. Generating the QR Code

From the main SET menu, select QRCode Generator and supply your target destination URL:

Specify the address of your harvested credential page or training awareness portal:

SET compiles the matrix code and saves the image directly into your root toolkit cache directory:

Scanning this image on a mobile device immediately opens the configured training URL:

2. Delivering the Attack Vector via Mass Mailer

To simulate an email notification requesting a mandatory scan, navigate to SET’s Mass Mailer Attack menu. Choose whether to target a single email address or import a list of corporate users.

Provide your outbound mail relay, message headers, and message body. SET dispatches the simulated campaign notifications to the recipient mailbox.

Performing Target Reconnaissance Before Campaigns

Effective social engineering requires reconnaissance. Attackers and authorized testers identify what server software, CMS versions, and hosting providers a target uses before designing convincing lures.

In this demonstration, passive and active web reconnaissance against a test host reveals significant infrastructure details:

Reconnaissance shows the target operates WordPress on Ubuntu, backed by MySQL and Redis database engines:

Target analysis reveals an Apache web server, JavaScript libraries, and hosting infrastructure running on Tata TeleServices:

Inspecting open service ports identifies active SSL certificates and network endpoints across the domain perimeter:

Further vulnerability assessment highlights multiple unpatched components and public CVE disclosures associated with the legacy server software:

To automate repetitive target scanning steps during audits, explore our guide on writing Python automation scripts for custom engagements.

Step-by-Step Credential Harvester Attacks

The Credential Harvester module evaluates whether staff members can spot deceptive login interfaces hosted on unofficial domain names.

Using Pre-Built Web Templates

SET includes pre-built templates for popular enterprise services like Google, Yahoo, and Microsoft Office 365.

1. Navigate to Social-Engineering Attacks > Website Attack Vectors.
2. Select Credential Harvester Attack Method.
3. Choose Web Templates and pick your template (for example, Google).

Confirm your interface IP address to host the simulated login page:

SET launches a local web server displaying the cloned authentication page. In live engagements, attackers disguise raw IP addresses using deceptive lookalike domains:

When a user enters credentials on the cloned page, SET captures the submitted username and password directly inside your active Linux shell:

After capturing credentials, SET automatically redirects the browser to the genuine domain to minimize suspicion while logging the interaction.

Cloning Custom Websites with the Site Cloner

When an assessment targets internal company portals, the Site Cloner module scrapes and clones live websites on demand.

1. Navigate to Website Attack Vectors > Credential Harvester Attack Method.
2. Select Site Cloner.
3. Enter the complete URL of the website you want to clone (for example, Amazon or an internal portal).

SET downloads the HTML, CSS, and image assets, then rewrites form action tags to point directly back to your harvester server:

When targets interact with the cloned site, all form submissions route straight to the evaluator’s terminal, enabling precise reporting on credential exposure.

Defensive Strategies: Mitigating Social Engineering Attacks

Understanding how SET works allows security teams to build resilient operational controls that mitigate employee deception risks.

• Enforce FIDO2/WebAuthn Multi-Factor Authentication: Traditional SMS codes and OTP push notifications can be intercepted by credential proxies. Hardware security keys bind authentication to the genuine cryptographic domain, neutralizing cloned phishing sites.
• Implement Domain and Email Protections: Configure strict SPF, DKIM, and DMARC enforcement policies to reject unauthorized spoofed email relays.
• Deploy Endpoint Application Control: Restrict arbitrary executable launches in user directories like AppData or /tmp using AppLocker or WDAC.
• Conduct Regular Workforce Simulations: Train employees with realistic simulations using frameworks like NIST SP 800-53 security controls to build vigilance against suspicious login requests and unverified QR codes.

Frequently Asked Questions

Is the Social Engineering Toolkit installed by default in Kali Linux?

Yes. SET is pre-installed in full Kali Linux installations. You can launch it by typing sudo setoolkit in your terminal or install it using sudo apt install set.

Can SET bypass modern antivirus software?

Default Meterpreter executables generated by SET use well-known signatures that modern endpoint detection and response (EDR) agents block immediately. Professional red teams test detection logic rather than relying on unencoded payloads.

How does SET handle HTTPS certificates for cloned websites?

SET supports integrating custom SSL/TLS certificates or generating self-signed certificates. In production simulations, testers configure Let’s Encrypt certificates to mimic secure production environments.

Conclusion

The Social Engineering Toolkit demonstrates how human trust remains an exploitable factor across digital architectures. By automating payload delivery, QR code routing, and site cloning, SET provides cybersecurity specialists with a structured framework to evaluate and reinforce organizational security awareness. Combining hardware-backed MFA, email authentication protocols, and regular training ensures that enterprise endpoints stay protected against deceptive attacks.