Being social with your target

If you are not using Social-Engineer Toolkit (SET, https://www.trustedsec.com/social-engineer-toolkit/), you are missing out on something important. We can certainly use it to spoof Google, Facebook, and Twitter to attract victims and launch attacks or scrape their credentials, but we can also use it in spoofing our target web application so as to hijack sessions and map user behaviors. As victims unknowingly browse these duplicate websites from the comfort of a coffee shop chair, attackers can gather the victims' passwords or even inject a command shell that gives them full access to the victims' systems. It is a great tool for security professionals to demonstrate how users more often than not will not pay attention to the location where they enter sensitive information as long as the page looks legit.

Let's take a look at how to...