SOCIAL_ENGINEERING_TOOLKIT

Social Engineering Toolkit (SET) Integration

Overview

PenMaster Security now includes full integration with the Social Engineering Toolkit (SET), one of the most widely used open-source penetration testing frameworks for social engineering attacks. This addition brings PenMaster's autonomous toolset to 18 tools.

What is SET

The Social Engineering Toolkit was created # by David Kennedy (ReL1K) and is maintained by TrustedSec. It is the industry standard framework used by professional penetration testers to simulate real-world social engineering attacks against organizations. SET is preinstalled on Kali Linux and designed specifically for human-based attack vector testing.

How PenMaster Uses SET

SET has been integrated directly into the MCP tool interface via the # run_setoolkit tool. The agent can now autonomously invoke SET attack modules by passing an attack type and target through the standard tool execution pipeline in #mcp_server.py. This allows PenMaster to include social engineering vectors as part of a full autonomous engagement without manual intervention.

Available Attack Vectors Through SET

Website Attack Vectors including credential harvesting and site cloning are the primary focus of this integration. The credential harvester module clones any target website and captures usernames and passwords submitted through the cloned login page. This is used during authorized engagements to test whether employees can identify phishing pages.

Phishing Research

As part of validating this integration, manual phishing simulations were conducted using zphisher to understand the full attack chain from cloned page generation through cloudflared tunnel deployment to credential capture. This research confirmed how attackers leverage compromised servers as relay points to obscure their true origin while hosting phishing infrastructure on remote machines.

Security Note

All tools integrated into PenMaster Security are intended exclusively for authorized penetration testing engagements. Written client authorization is required before deploying any social engineering attack vectors.