WEBVTT

00:00:03.300 --> 00:00:06.880
Hi there. I'm Rishalin Pillay, and welcome to my course called

00:00:06.890 --> 00:00:10.340
People Information Gathering with the Social Engineering Toolkit.

00:00:10.340 --> 00:00:13.610
When we think of social engineering attacks,

00:00:14.080 --> 00:00:18.000
these attacks do not entail breaking into a system directly, rather,

00:00:18.330 --> 00:00:19.970
it involves the human element.

00:00:20.510 --> 00:00:24.350
Humans are the best resource of security vulnerabilities.

00:00:24.840 --> 00:00:27.840
I mean, let's face it, because of our trusting nature,

00:00:28.200 --> 00:00:31.480
attackers can easily abuse that by tricking us into opening a

00:00:31.480 --> 00:00:35.320
malicious link or navigating to a malicious website where we will

00:00:35.320 --> 00:00:37.480
then provide some sensitive information.

00:00:37.940 --> 00:00:40.250
Social engineering attacks are common,

00:00:40.720 --> 00:00:44.430
and they are often the entry point into more nefarious attacks.

00:00:44.540 --> 00:00:46.480
For example, when you look at your email,

00:00:46.690 --> 00:00:50.800
how often do you see emails stating that you have either won some

00:00:50.810 --> 00:00:55.130
ridiculous amount of money or that you are an inheritant to some

00:00:55.130 --> 00:00:58.950
inheritance? And within those emails are malicious links.

00:00:59.340 --> 00:01:03.420
Unfortunately, many people still fall for those attacks today.

00:01:03.490 --> 00:01:04.170
In this course,

00:01:04.170 --> 00:01:07.550
we're going to look at how we can use the Social‑Engineering Toolkit to

00:01:07.550 --> 00:01:10.000
perform some of these social engineering attacks.

00:01:11.080 --> 00:01:13.720
The tool is designed and created by David Kennedy.

00:01:13.730 --> 00:01:15.910
It is now maintained by TrustedSec.

00:01:15.920 --> 00:01:19.760
Thanks a lot David, this is a really great tool that enables us to use

00:01:19.760 --> 00:01:22.950
various social engineering techniques in red team assessments.

00:01:23.080 --> 00:01:26.350
The tool is an open source penetration testing framework,

00:01:26.380 --> 00:01:29.850
which is designed specifically for social engineering.

00:01:29.940 --> 00:01:34.830
It is often abbreviated as SET. SET has a number of custom attack vectors that

00:01:34.830 --> 00:01:38.250
allow you to make a believable attack quickly and easily.

00:01:39.040 --> 00:01:42.220
The Social‑Engineering Toolkit is an open source tool,

00:01:42.350 --> 00:01:43.970
and it's available on GitHub.

00:01:44.090 --> 00:01:47.050
You can use the tool on both macOS, Linux,

00:01:47.440 --> 00:01:51.150
and you can use it within Windows 10 if you make use of the Windows

00:01:51.150 --> 00:01:55.310
subsystem for Linux. It supports multiple attack vectors.

00:01:55.790 --> 00:01:58.820
For example, you can craft spear‑phishing attacks,

00:01:58.960 --> 00:02:03.280
website attack vectors, you can also go ahead and create infectious media,

00:02:03.510 --> 00:02:08.580
and a lot more. When we consider the kill chain, the social engineering tool

00:02:08.600 --> 00:02:10.880
can be used within the reconnaissance phase.

00:02:11.340 --> 00:02:13.630
Since social engineering really can work across

00:02:13.630 --> 00:02:15.480
multiple phases in the kill chain,

00:02:15.830 --> 00:02:18.700
this tool can be used across the entire kill chain.

00:02:20.040 --> 00:02:22.460
When we consider the MITRE PRE‑ATT&CK tactics,

00:02:23.000 --> 00:02:26.920
the social engineering tool falls within two different tactics,

00:02:27.250 --> 00:02:29.860
the first being technical information gathering.

00:02:30.740 --> 00:02:35.230
Within this tactic, it falls under T1249, which is Conduct Social

00:02:35.230 --> 00:02:40.660
Engineering, and T1397, which is Spearphishing for Information.

00:02:41.400 --> 00:02:44.580
Another category that this falls under is people information

00:02:44.580 --> 00:02:47.800
gathering. Within people information gathering, it falls under

00:02:47.800 --> 00:02:51.250
T1268, which is Conduct Social Engineering.

00:02:52.700 --> 00:02:57.980
In this course, I will be using Kali Linux, and I'll be using version 2020.2.

00:02:58.840 --> 00:03:03.120
Since the Social‑Engineering Toolkit is part of the operating system, ensure

00:03:03.120 --> 00:03:08.270
that you update the OS so that you get the latest updates and any bug fixes

00:03:08.430 --> 00:03:10.120
for the Social‑Engineering Toolkit.