Social-Engineer Toolkit v2.3 released (Eclipse)

The Social-Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of pentesting. It’s main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed.

Currently SET has two main methods of attack, one is utilizing Metasploit payloads and Java-based attacks by setting up a malicious website (which you can clone whatever one you want) that ultimately delivers your payload. The second method is through file-format bugs and e-mail phishing. The second method supports your own open-mail relay, a customized sendmail open-relay, or Gmail integration to deliver your payloads through e-mail. The goal of SET is to bring awareness to the often forgotten attack vector of social-engineering.

Changelog v2.3

fixed a bug that would not load the menus properly when loading SET (bad return placement)
fixed an annoying bug that has been around for a number of versions, finally tracked down..some occasions where it would show “Moving payload to website”, you couldn’t control-c out to exit and would have to close the console window. This has been resolved.
rewrote shellcodeexec again to evade AV
added the shellcodeexec.c modified source code
removed improper way to mask error messages through 1> /dev/null and 2> /dev/null, pipe information through subprocess.PIPE instead
fixed a bug in fast-track with the mssql bruter where if using the SET interactive shell, it wouldn’t spawn the HTTP server properly due to to site.template and attack.vector files not being found. Added better granularity on detecting files and setting defaults if its not found
adjusted the repeater time to 2 seconds versus 3
added additional passwords found in pentests to the wordlist
removed excess code from setcore
moved Signed_Update.jar that is generated through Java Applet attack it now goes through src/program_junk versus src/html
rewrote large portions of SET to place cloned websites and files under src/program_junk/web_clone versus src/webattack/web_clone/site/template
added new config option for OSX/LINUX payload ports and removed the automatic prompt after generating metasploit payload if you want to target OSX/Linux. It will automatically target Linux/OSX and removes another prompt in setting everything up
added additional stability to powershell injection, it is now enabled by default. If powershell is injected, it will send a payload straight through memory versus touching disk. Note that you may get two shells back. This is intentional as its a failsafe if the one method fails through powershell. So regardless, if the powershell injection fails to compromise, the backup dropper will still execute
bug fix in mssql.py where it would throw an error about not finding the proper payload in the fasttrack mssql bruter