Perimeter
7/30/2010
07:08 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Real-World Attacks With Social Engineering Tookit

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.According to Dave Kennedy (aka Rel1k), he created the Social Engineering Tookit (SET) for a couple of reasons: hackers are doing these same attacks, we need to promote user awareness, and security controls to prevent these attacks need to be tested. Essentially, it gives penetration testers a streamlined way to perform social engineering attacks using exploits available in the Metasploit Framework. Since penetration testers are hired to gain access into a network as a malicious hacker would, they should be using the same techniques to verify existing vulnerabilities such as poor user awareness and unpatched client applications.

Codenamed "Arnold Palmer," the new 0.6 release of SET includes a slew of new features and bug fixes. It provides three major attack vectors, including spear-phishing, Web attacks through site-cloning, and malicious USB/DVD/CDs, along with the brand new Arduino-based Teensy USB HID device.

The existing attack vectors are very good, but I'm most excited about the Teensy attack vector since I've been dabbling in hardware hacking more lately. The Teensy can act as a keyboard and mouse allowing an attacker to inject keystrokes into a system and deploy an attack payload (such as the Metasploit Framework's meterpreter) via PowerShell or WSCRIPT. The attack bypasses any autorun protections that may be implemented since it simulates a keyboard and not a USB storage device.

In addition to the Teensy-based attack, SET 0.6 includes TabNabbing, the option to use the Python HTTP server or Apache Web server, the Man-Left-in-the-Middle attack, over 45 bug fixes, Ettercap DNS poison attacks, and the latest Adobe, LNK, and Internet Explorer exploits. The Java Applet attack, available previously, has also been released as open source as of version 0.6, and it's been improved to evade antivirus through heavy obfuscation of the Java and payload.

SET is truly an incredible tool and Dave has done an amazing job at developing something that can really help penetration testers be more effective at testing areas -- namely humans -- that are often overlooked. As he stated during his presentation, "if you aren't doing social engineering as part of your regular penetration tests, you are seriously missing out." For more information about social engineering, check out the social-engineer.org site and listen to their excellent podcast.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0750
Published: 2015-05-22
The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.

CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.