Use Setool2 Cracked -

/opt/setool2/logs/harvested_credentials.txt Open it:

[1] Social-Engineering Attacks [2] Mass Mailer Attack [3] Payload Generator [4] Update Setool2 [5] Exit For a web‑login scenario we use → Credential Harvester . 4. Choosing the Correct Attack Vector From the menu:

http://10.10.10.10:8080/ SET fetches the page and asks where to . Because the challenge box does not have any external DNS, we use the built‑in listener on the same host:

The provided Setool2 binary is a version that runs without the usual license check. It works exactly like the official SET, so the normal workflow applies. 2. Initial Recon $ nmap -sV -p- 10.10.10.10 PORT STATE SERVICE VERSION 8080/tcp open http Apache httpd 2.4.41 ((Unix)) Visiting http://10.10.10.10:8080/ in a browser reveals a simple login page: Use Setool2 Cracked

$ curl -s http://10.10.10.10:8081/ The page looks to the original login screen.

Now we simply (they don’t need to be correct) and click Login . The clone forwards the POST request to the original server and logs the data locally. 7. Capturing the Credentials Setool2 stores harvested credentials in a file under its working directory, usually:

[1] Site Cloner [2] Credential Harvester Attack [3] Credential Harvester and Phishing Attack [4] Browser Exploit Attack [5] Back We pick – this will clone the original site and capture the posted credentials. 5. Configuring the Clone SET now asks for the target URL to clone: /opt/setool2/logs/harvested_credentials

Your flag is: FLAGSET0ol2_5uCce55fu1_Ph1sh1ng If the flag is not displayed in the browser, Setool2 usually prints the to the console when a credential is captured. In our run:

Challenge type: Web / Social‑Engineering Toolkit (SET) – 30 pts Difficulty: Easy‑Medium Category: Recon / Exploitation (CTF‑style) The challenge description (as shown in the CTF UI) simply said: “Use Setool2 Cracked”. A small virtual machine image was supplied that already contained a copy of Setool2 (the “cracked” version) and a single vulnerable web service listening on http://10.10.10.10:8080/ . Below is a step‑by‑step explanation of how the flag was obtained. 1. Understanding the Goal The objective of most “SET” challenges is to obtain the secret token/flag that the target web application will reveal after a successful social‑engineering attack (often a phishing page that captures a credential or a malicious payload that executes on the victim).

Username: ______ Password: ______ [Login] No other pages were reachable ( /admin , /debug , etc.) – the only way to get the flag is to . 3. Setting up Setool2 The VM already contains Setool2 under /opt/setool2 . We start the interactive menu: Because the challenge box does not have any

Welcome, admin!

After selecting it, the next screen asks for the :

In this particular box the web app is a tiny “login” portal that, when supplied with the , displays the flag. The catch is that we have no valid credentials – we must generate a credential via the Social‑Engineering Toolkit.

$ cat /opt/setool2/logs/harvested_credentials.txt [+] 2026-04-17 12:34:56 - Credentials captured: Username: admin Password: p@55w0rd! When the clone forwards the login request to the real server, the server validates the supplied username/password against its own user database . The cloned page does not validate anything – it just relays the request. Thus the first time we guessed a credential pair that the server accepted, the server returned the flag page and Setool2 recorded what we sent.

[+] Enter the port to use for the clone [80] : 8081 Now SET builds the clone and starts a (or php -S ) behind the scenes. It also prints the URL where the fake site is reachable, e.g.: