The Social-Engineer Toolkit (SET) v4.3 has been released today! This version is over two solid months of development and has over 60 new features, additions, fixes, and enhancements. Most notably is the new payload selection called “Multi-pyInjector”. Multi-pyInjector allows you to inject as many payloads as you want to into memory and select them all through the Social-Engineer Toolkit. In a number of situations where egress filtering may be stringent, the last thing you want is to get shut down by outbound connections. With the Multi-pyInjector technique, you can have native Metasploit payloads be directly inserted into memory realtime and without the need of touching the hard-disk.

In addition to the Multi-pyInjector, there is now a new configuration option called TRACK_EMAIL_ADDRESSES. When this is turned on, SET will automatically insert additional fields in the query string parameter of an email web attack. Say you are sending emails to 300 people and want to track the users that click the link. SET will automatically track the links and what they input on the website. This way, when doing social-engineer attacks you can track the users that click on the emails all through the SET interface. Note that this attack currently requires Apache, as the code written out is custom PHP. In later versions, we will be writing it so that it works within the SET HTTP server. When you turn TRACK_EMAIL_ADDRESSES to ON, SET will automatically located Apache and move all the appropriate files for you.

Next, in the previous version when generating alphanumeric shellcode or straight shellcode, SET would utilize Metasploit (msfvenom) to create the shellcode on each instance which caused a significant amount of time. In 4.3, the shellcode is dynamically patched and already generated. This cuts down on load times for generation and into SET by about 90 percent. If you watched the video above, you’ll notice that when you select your payloads and the generation of them takes less than a second. This is due to the new patching method in place in the SET core libraries.

There are way to many things to run through that’s new in this version. Optimized and faster loaded Java Applet, newly encrypted payloads, code cleanup, and more. Enjoy this version of SET brought to you by TrustedSec!

Download Social-Engineer Toolkit v4.3 "Turbulence"