Social Engineer Toolkit (SET): Install, Attack Vectors and Safe Use
The Social-Engineer Toolkit (SET) is an open-source penetration testing framework aimed at the human layer rather than the software layer: spear-phishing, credential harvesting, malicious media and similar attacks. It was written by David Kennedy at TrustedSec, runs on Linux, and is launched with the command setoolkit.
The Social Engineer Toolkit (SET) is an open-source framework for simulating social engineering attacks, built by TrustedSec and shipped with Kali Linux. It automates the phishing pages, credential harvesters and payload delivery a penetration tester would otherwise assemble by hand, which makes it the standard tool for testing the part of a security program that patching cannot fix.
What is the Social Engineer Toolkit?
SET is a menu-driven Python framework aimed squarely at the human attack surface. Where a network scanner looks for unpatched services, SET builds the pretext: a cloned login page, a malicious attachment, a QR code, a spoofed SMS. It has been maintained by TrustedSec since 2009 and is included by default in Kali Linux and Parrot OS.
The name appears in three forms in the wild, all the same tool: SET, the SET toolkit, and the Social Engineering Toolkit. TrustedSec's own name for it is the Social Engineer Toolkit.
Why it is used
Technical controls do not stop a user from entering their password into a convincing copy of their own login page. Social engineering remains the most reliable initial access route into most organizations precisely because it targets judgement rather than software, and the only way to measure your exposure to it is to run the attack under controlled conditions and count what happens. SET is how that test gets built.
Installing SET
SET is preinstalled on Kali Linux and Parrot OS, where it runs with sudo setoolkit. To install it from source on a Debian-based system:
sudo apt update
sudo apt install -y git python3-pip
git clone https://github.com/trustedsec/social-engineer-toolkit/ set/
cd set
pip3 install -r requirements.txt
sudo python3 setup.py installLaunch it with sudo setoolkit. Root is required because several modules bind privileged ports, such as serving a cloned site on port 80.
The SET menu and attack vectors
SET is navigated by numbered menus rather than flags. The first menu leads to Social-Engineering Attacks, which is where almost all real use happens. The vectors that matter in practice:
- Spear-phishing attack vectors. Builds and sends targeted mail with a malicious attachment, using a chosen payload and a mail relay you supply.
- Website attack vectors. The most used branch. Includes the credential harvester, which clones a real login page and captures what is typed into it, and the tabnabbing and web jacking variants.
- Infectious media generator. Produces an autorun payload for USB or CD, for physical-access testing.
- Mass mailer attack. Sends to a list rather than an individual, for measuring click and submit rates across a whole population.
- Powershell attack vectors. Generates PowerShell payloads, historically effective because the interpreter is signed and present everywhere.
- QRCode generator. Encodes a target URL into a QR code, which has become materially more relevant as quishing has grown.
The credential harvester in practice
The most common workflow is site cloner plus credential harvester: SET fetches a copy of a login page, serves it from your machine, and records every submission before forwarding the visitor to the real site so the interaction looks unremarkable. Combined with a lookalike domain and a plausible pretext, that is the attack most organizations actually face, which is why it is the one worth simulating first.
Talk to a SubRosa security engineer
Get a straight answer on where your defenses actually stand. No pitch, no obligation.
Book a consultationUsing SET legally and usefully
SET builds real attacks. Running one against people who have not authorized it is a criminal offense in most jurisdictions regardless of intent, and running one carelessly against your own staff damages trust you need. Before a campaign, get written authorization naming the scope and the window, agree who is told in advance, and define what happens to captured credentials, which should be that they are counted and never stored.
The output that matters is not how many people fell for it. It is click rate and report rate tracked over time by team, because a rising report rate is the thing that actually shortens attacker dwell time. A campaign that produces a number and no follow-up teaching produces nothing.
SET alongside the rest of a program
SET tests one surface. A social engineering assessment that stops at email misses the phone call to the service desk, the contractor badge, and the supplier who can email your finance team and be believed. SubRosa runs social engineering as part of full-scope engagements for that reason, and pairs the testing with the ongoing teaching that changes the numbers rather than just recording them.
Frequently asked questions
What is the Social-Engineer Toolkit (SET)?
SET is an open-source penetration testing toolkit designed to simulate social engineering attacks against people rather than software. It is used in authorised security testing to measure how an organisation's staff respond to phishing and similar techniques.
Who created the Social-Engineer Toolkit?
David Kennedy, who goes by ReL1k, at TrustedSec. The project is open source and maintained on GitHub.
How do you install SET?
Clone the repository from the TrustedSec GitHub project and install its Python requirements, then launch it with python setoolkit from the install directory. It is built for Linux distributions such as Ubuntu and Fedora, and ships preinstalled on several security-focused distributions.
What is the SET Credential Harvester?
A module within SET's website attack vectors that clones a real site and captures any credentials entered into the copy. In an authorised engagement it demonstrates how convincingly a login page can be imitated, and how little that imitation costs an attacker.