The Social Engineering Toolkit's evolution, goals

Dave Kennedy, creator of social-engineer.org's social engineering toolkit, gives an overview of how the program was created, and how it is always changing to keep pace with crime

By , Senior Editor

April 26, 2012 — CSO —

Social engineering expert, Dave Kennedy, a veteran penetration tester and contributor to social-engineer.com, saw a gap in the tools available for security when it came to evaluating an organizations preparedness for social engineering attacks.

Two years ago, he built the first social-engineering toolkit, a free download on educational resource social-engineer.org.

Kennedy, who is also CSO at security systems vendor Diebold, spoke with CSO about how the toolkit was created and how it can help companies improve their security.


[Check out Kennedy's advice for making the most out of the toolkit in 3 tips for using the Social Engineering Toolkit]


CSO: Tell us about the origins of the social engineering toolkit.
Kennedy: Before I joined Diebold, I was heavy on the exploitation and penetration side of the house. We would perform pen tests for other companies and customers to try and identify weaknesses.

When I joined Diebold, Chris (Hadnagy, founder of social-engineer.com) and I were close to the social engineering aspect of security. We were seeing a big shift in the industry and we felt social engineering was going to be the very next wave of attacks coming on. No one was doing it as part of their pen testing, no one was incorporating it into the services they do or looking at it from that perspective.

From that [observation], the toolkit was born. I spent about two months writing it, initially. And when it became available, it just blew up. People were downloading and using it immediately, so there is obviously a huge interest in it.

Learn more about social engineering tricks and tactics

Besides addressing a need, what was your initial goal in creating it?
Really what it is designed to do is test the effectiveness of your education and awareness program and test the controls you have on your associates and employees. It is designed to make sure you can withstand a social-engineering attack and to see how well you do in one.

The tool is for pen testers, security researchers, folks that want to test how effective their awareness program is working. It does a lot of things, like bypasses antivirus and bypass security technologies. It has a lot of cutting-edge attack vectors so you can simulate a real world attack using different attack vectors. You can do spear phishing, you can do website attacks where it makes a website look legitimate but has a bunch of bad stuff on it. It has a lot of different techniques and is basically an all-encompassing tool for leveraging social engineering in penetration testing.

RESOURCE CENTER