Social Engineer Toolkit (SET)Step-by-step reference: run authorized phishing simulations with SET credential harvester. Defense focus.FAQ

What is the Social-Engineer Toolkit?

SET is a free, open-source social engineering framework by TrustedSec, preinstalled on Kali. Its menu console builds phishing simulations — cloned login pages with a credential harvester, spear-phishing flows, and infectious-media demos — for authorized awareness training.

Is using SET legal?

SET itself is legitimate training software. Sending phishing content to anyone without explicit written authorization is illegal. Run simulations only with a signed scope, approved recipient lists, and agreed data-handling rules.

How do I install SET?

It ships with Kali Linux. Elsewhere, clone github.com/trustedsec/social-engineer-toolkit, run pip3 install -r requirements.txt, and launch with sudo ./setoolkit so the web server can bind to port 80.

How does the credential harvester work?

Pick website attack vectors, then the credential harvester, then the site cloner. SET clones the approved training login page, hosts it, and logs submitted training credentials to its reports folder for the debrief.

How should simulation data be handled?

Treat harvested training credentials as sensitive: restrict access to the simulation team, delete them after metrics and debrief, and never reuse them beyond the agreed scope.

What should a phishing simulation measure?

Track click rate, credential submission rate, and report rate. Report rate matters most — a workforce that reports phish quickly contains real attacks. Trend all three across simulations.

How do I spot a cloned login page?

Check the URL letter by letter, look for missing padlock or wrong domain, beware urgency and unexpected password resets, and use a password manager — it refuses to fill on lookalike domains.

What stops credential phishing best?

Phishing-resistant MFA like security keys, passwordless passkeys, verified sender domains with DMARC enforcement, and regular scoped simulations with fast reporting drills.

All tools · Sitemap · Games