Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Is it legal or illegal to use the cloning site option within the social engineer toolkit (SET) or any other tool that clones websites? I was under the impression that if performing a social engineer exercise with a signed document from a client, I would be legally allowed to clone their site (with their approval), but what if I wanted to clone a site such as Microsoft or Google for the test? Would Microsoft or Google or whoever have the authority to sue me for something, such as copyright infringement?

share|improve this question
1  
If you have the permission to clone a website, then you have permission, just get that permission in writting. What purpose does it serve to clone Microsoft's or Google's websites? – Ramhound Oct 26 '11 at 12:20
1  
Specifically, is the client Microsoft or Google? – Rory Alsop♦ Oct 26 '11 at 12:22
The client is not Microsoft or Google. The purpose is to trick an end user into clicking on something. For example a link to a fake patch or a fake pdf attachment. It's one way of testing the end users awareness and see if training has been effective. – Pentest Oct 26 '11 at 13:48
@Pentest - You have to view this question and your own statements in another light. You make it clear you want to clone a website in order to trick users. – Ramhound Oct 27 '11 at 12:33

1 Answer

up vote 3 down vote

I am not a lawyer, but I would be very careful about cloning as there are some major issues you should think about:

  • Does the client own every part of the website?
  • Does the client own all copyright on documents and logos on the website?
  • Has the hosting company agreed to this work?
  • Does the client's contract with their host/ISP allow for this usage?

Also, if you place your cloned site on the Internet you may fall foul of various laws on misrepresentation, and as you can't limit who may try to access the site, you should be aware of international laws in this area.

What is it you are trying to do that requires a clone of the site? In many years of managing social engineering engagements I have never needed to use this technique as there should be easier ways to get access or information.

share|improve this answer
I'm looking for some new avenues into social engineering. Strictly from a testing point, I have enjoyed using SET, but am having some issues with actually using it in a real world scenario as cloning a website may become illegal. As of now, I would like to either send an email with some attachment, email with a link to a site I set up, and perform a live test on-site and see what I can gain access to (all with approval). Not sure how to use SET or any other social engineering tool without becoming illegal. – Pentest Oct 26 '11 at 12:35
1  
@Pentest - Do not do anything without approval. It sounds like you are trying to cross into a really gray area. I strongly suggest you stick to trying attack website that the company themselfs have cloned, so private and personal customer data is not at risk, you accessing something you shouldn't would not be kosher with me. – Ramhound Oct 26 '11 at 12:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.