[*] Starting credential harvester on http://10.10.10.10:8081/ Since the challenge is self‑contained, we can directly visit the clone from the same VM (or from the attacker machine if you have network access). In a new terminal:
Now we simply (they don’t need to be correct) and click Login . The clone forwards the POST request to the original server and logs the data locally. 7. Capturing the Credentials Setool2 stores harvested credentials in a file under its working directory, usually:
In this particular box the web app is a tiny “login” portal that, when supplied with the , displays the flag. The catch is that we have no valid credentials – we must generate a credential via the Social‑Engineering Toolkit. Use Setool2 Cracked
[+] Choose the IP address for the clone (default = 0.0.0.0): We press to accept 0.0.0.0 (bind to all interfaces). SET then asks for a port – default is 80, but the box already runs a web server on 8080, so we choose 8081 :
Welcome, admin!
The provided Setool2 binary is a version that runs without the usual license check. It works exactly like the official SET, so the normal workflow applies. 2. Initial Recon $ nmap -sV -p- 10.10.10.10 PORT STATE SERVICE VERSION 8080/tcp open http Apache httpd 2.4.41 ((Unix)) Visiting http://10.10.10.10:8080/ in a browser reveals a simple login page:
/opt/setool2/logs/harvested_credentials.txt Open it: [*] Starting credential harvester on http://10
In practice, we may need to try a few guesses. Because the challenge only had a credential, a quick brute‑force (or simple wordlist) works. Setool2 can be instructed to repeat the attack automatically, but for this box a single manual attempt suffices. 8. Retrieving the Flag After the successful login the real server responded with the flag page. Visiting the original URL again (or watching the console output from Setool2) shows: