In order to test pishing attacks with setoolkit (Social Engineering Toolkit), I installed iRedMail in my local network.
I created two account:
attacker@hackme.clubhacking.org
hackme@hackme.clubhacking.org
The domain name is clubhacking.org
I can send mail without problem.
But when I try to send a pishing attack with setoolkit, I obtain this error:
SMTP AUTH extension not supported by server.
After some search, the problem is maybe I need to use TLS for send mails with setoolkit but I don't find how to do?
This is my option choices with setoolkit:
1) Social-Engineering Attacks
1) Spear-Phishing Attack Vectors
2) Create a FileFormat Payload
1) SET Custom Written DLL Hijacking Attack Vector (RAR, ZIP)
Enter the IP address for the payload (reverse):127.0.0.1
enter preformatted text here
1) Meterpreter Memory Injection (DEFAULT) This will drop a meterpreter payload through PyInjector
enter preformatted text here
PORT of the listener [443]:443
1) Windows Meterpreter Reverse TCP
enter preformatted text here
8. Microsoft PowerPoint 2010
2. Zip File
1. Keep the filename, I don't care.
1. E-Mail Attack Single Email Address
2. One-Time Use Email Template
Subject of the email:test
Send the message as html or plain? 'h' or 'p' [p]:test
Send email to:hackme@hackme.clubhacking.org
2. Use your own server or open relay
From address (ex: moo@example.com):attacker@hackme.clubhacking.org
The FROM NAME user will see:test
Username for open-relay [blank]:attacker
Password for open-relay [blank]:mypassword
SMTP email server address (ex.smtp.youremailserveryouown.com):clubhacking.org
Port number for the SMTP server [25]:25
Flag this message/s as high priority? [yes|no]:no
