The Toolkit

Social Engineering Tools

The most reliable way into an organization is often the people in it. Social engineering tools automate the human-layer attack: cloning login pages to harvest credentials, generating malicious attachments, and — for a real phishing assessment — running a full campaign that sends the emails, tracks who opened and clicked, and captures what they submitted. Used with authorization, they measure an organization’s actual susceptibility, which no technical scan can.

Both live under Security → Social Engineering Tools. They pair naturally with BeEF for browser hooks and with the web servers in Running Services for hosting a convincing page.