Social Engineering Attacks

1) This tutorial will perform Phishing on Facebook using setoolkit in Linux OS.

Required Sources:
 Kali-Linux
 Windows OS

Instructions
1. Open the terminal and type setoolkit
2. Out of the 6 options available, select the first option that is social engineering attack.
3. Out of the 10 options available, select the second option which is website attack vectors
4. Out of the 8 options available, select the third option that is credential harvester attack
method
5. Out of the 3 options available, select the second option that is site cloner
6. Now he is requesting for your IP address for the post back. So check what is your IP
address using the ifconfig command and then provide it to Harvester.
7. Now enter the URL of the website which you want to clone http://www.facebook.com
8. Now open the web browser and paste the ip address
9. Victims will enter their login credentials (username and password)
10. The information will be saved into the computer’s file system /var/www

Screenshots each step and document your lab activity.

2) Research and identify social engineering attacks
Instructions
Using a web browser find the article “Methods for Understanding and Reducing Social
Engineering Attacks” on the SANS Institute website. A search engine should easily find the
article.

The SANS Institute is a cooperative research and education organization that offers
information security training and security certification. The SANS Reading Room has many
articles that are relevant to the practice of cybersecurity analysis. You can join the SANS
community by creating a free user account in order to access to the latest articles, or you can
access the older articles without a user account.
Read the article or choose another article on social engineering, read it, and answer the
following questions:

a) What are the three methods used in social engineering to gain access to information?
b) What are three examples of social engineering attacks from the first two methods in step
a)?
c) Why is social networking a social engineering threat?
d) How can an organization defend itself from social engineering attacks?

Prep: 20mins
Discussion:
** Submit your work before leaving.