The Social Engineering Toolkit

I just had to find a French translation for "Social Engineering Toolkit", or SET to its friends.

I'm a big fan of social engineering, not because I'm good at it, but because I'm fascinated by what can be done. Just as I do "hardening" on my computers, I think it's important to do some "hardening" of my mind. To that end, I religiously listen to the podcast from social-engineer.org, and I've read Social Engineering: The Art of Human Hacking by Christopher Hadnagy, along with several other books on the subject.

What brings me to talk about SET is that in the last podcast I listened to, they mentioned they were offering training (5 days of training + a certification). Among other things, that training covers SET. The toolkit has been available for a while now. It's essentially intrusion tools that have been adapted to fit into a social engineering framework. What does that mean? When running a social engineering test, some moves, like sending "spear phishing" emails, require technology tools that aren't always within everyone's reach... So all the functions needed to take a social engineering test to the next level were gathered into one tool suite. At the same time, SET doesn't replace the person running the test, since, as in every field, a talented person can't be replaced by tools.

SET is part of a bigger picture, the "Social Engineering Framework", which explains all the possible moves for carrying out social engineering scenarios. Since I'm not an SE expert, I won't venture into explaining the framework… I'm just pointing you to an excellent free source of information on the subject.

Remember, with great power comes great responsibility ;-)