Dificultad para usar SET dentro de Kali Linux

1

Al configurar un vector de ataque de sitio web, encuentro que Kali no me da la opción de especificar un puerto para recibir información en mi local. Además, no puedo acceder al servicio de escucha que creé porque simplemente obtengo el error "no se puede cargar esta página" cuando intento abrir la dirección IP externa en otra computadora. Mi configuración SET es la siguiente:

set:webattack>3

The first method will allow SET to import a list of pre-defined web
 applications that it can utilize within the attack.

 The second method will completely clone a website of your choosing
 and allow you to utilize the attack vectors within the completely
 same web application you were attempting to clone.

 The third method allows you to import your own website, note that you
 should only have an index.html when using the import website
 functionality.

   1) Web Templates
   2) Site Cloner
   3) Custom Import

  99) Return to Webattack Menu

set:webattack>1
[-] Credential harvester will allow you to utilize the clone capabilities     within SET
[-] to harvest credentials or parameters from a website as well as place them into a report
[-] This option is used for what IP the server will POST to.
[-] If you're using an external IP, use your external IP for this
set:webattack> IP address for the POST back in     Harvester/Tabnabbing:73.196.210.4

  1. Java Required
  2. Google
  3. Facebook
  4. Twitter
  5. Yahoo

set:webattack> Select a template:2

[*] Cloning the website: http://www.google.com
[*] This could take a little bit...

The best way to use this attack is if username and password form
fields are available. Regardless, this captures all POSTs on a website.
[*] Apache is set to ON - everything will be placed in your web root directory of apache.
[*] Files will be written out to the root directory of apache.
[*] ALL files are within your Apache directory since you specified it to ON.
Apache webserver is set to ON. Copying over PHP file to the website.
Please note that all output from the harvester will be found under     apache_dir/harvester_date.txt
Feel free to customize post.php in the /var/www/html directory
[*] All files have been copied to /var/www/html
[*] SET is now listening for incoming credentials. You can control-c out of this and completely exit SET at anytime and still keep the attack going.
[*] All files are located under the Apache web root directory: /var/www/html
[*] All fields captures will be displayed below.
[Credential Harvester is now listening below...]

Como puede ver, no aparece el mensaje "El cosechador de credenciales se está ejecutando en el puerto 80", y no puedo usar el recolector que he creado. Cualquier ayuda es apreciada!

    
pregunta Steve 01.03.2016 - 01:44
fuente

1 respuesta

3

Asegúrese de que su servicio apache2 se esté ejecutando

service apache2 start

Tenga en cuenta que el uso de SET en una máquina virtual puede causar problemas a veces.

Y, finalmente, supongo que en las versiones más nuevas de SET no encontrará el nombre de usuario y la contraseña en el terminal, sino que los encontrará en el directorio www

    
respondido por el HSN 01.03.2016 - 05:49
fuente

Lea otras preguntas en las etiquetas