Imprimis, if you are not familiar with the concept of social engineering, take a look at:
https://en.wikipedia.org/wiki/Social_engineering_(security)
If you are looking for a good book on this topic, then I would highly suggest buying a copy of:
As for software implementations that you can use to leverage social engineering attacks on targets, David Kennedy‘s Social Engineering Toolkit (SET) is probably one of the best, if not only social engineering frameworks that I know of. SET does not really rely on vulnerable services which I believe is one of the most useful aspects of this toolkit. What you do have to rely on is social engineering. Services and software will be patched while humans will most likely always be vulnerable to social engineering attacks due to misplaced trust.
Despite the fact that this framework is practically the only of its kind, it does have some limitations in certain realms, namely the web site cloning feature. The issue I have ran into with SET is due to the user agent string not being easily switchable. To switch the user agent string for SET, you must manually edit the cloner.py (which is located in/src/webattack/web_clone/ directory) .
The default user agent of SET is:
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6
This means that when the Social Engineering toolkit makes a request on a website and clones it, the response of the web service is based on this user agent string.
What if I want to clone a website that is the mobile version? What if I want to clone a website that checks to see if end users are Microsoft Windows users? This is where the Social Engineering Toolkit User Agent Switcher(setuas.sh) is applicable. This is a very simple Bash shell program that edits the user agent string in the cloner.py module of SET to whatever you like. Simply execute this:
./setuas.sh /pentest/exploits/set/src/webattack/web_clone/cloner.py
You will then be prompted to enter in a user agent string which for instance could be:
Mozilla/5.0 (Linux; U; Android 2.3; en-us) AppleWebKit/999+ (KHTML, like Gecko) Safari/999.9
For the moment this is just a quick hack to address the issue. I believe that the SET team should add an option in the config file (/set/config/set_config) for end users to adjust accordingly.
setuas.sh is located here:
http://zitstif.no-ip.org/set/setuas.sh
If you want to just see the plain text version of this file, it is located at: