Results 1 to 8 of 8

Thread: Where is SET saving its cloned/imported sites to?

  1. #1
    Junior Member L21ZIFER's Avatar
    Join Date
    Nov 2011
    Posts
    47

    Post Where is SET saving its cloned/imported sites to?

    It often happens that SET somehow is not cloning every file of a target site
    and so it doesn't look legit in the testing.

    Where is SET saving its cloned sites to?
    I checked the www dir but it remains untouched.

    So?

  2. #2
    Senior Member LHYX1's Avatar
    Join Date
    Sep 2010
    Location
    Belgium
    Posts
    127

    Default Re: Where is SET saving its cloned/imported sites to?

    /pentest/exploits/set/src/program_junk/web_clone should be it

    I found it after searching the cloner.py script in the /pentest/exploits/set/src/webattack/web_clone/ directory
    (\ /)
    ( . .)
    c(")(")

    This is bunny.
    Copy and paste bunny into your signature to help him gain world domination.

  3. #3
    Junior Member L21ZIFER's Avatar
    Join Date
    Nov 2011
    Posts
    47

    Default Re: Where is SET saving its cloned/imported sites to?

    You're a Belgian gladiator!

  4. #4
    Just burned his ISO
    Join Date
    Dec 2011
    Posts
    6

    Default Re : Where is SET saving its cloned/imported sites to?

    Anyone know how does it validate publisher (lets say on "Microsoft") rather than "Unknown" :/?

  5. #5
    Senior Member LHYX1's Avatar
    Join Date
    Sep 2010
    Location
    Belgium
    Posts
    127

    Default Re: Where is SET saving its cloned/imported sites to?

    @Maris I think this is impossible unless you buy a real certificate.
    proof: http://www.sslshopper.com/java-code-...tificates.html
    Home made certificates will always have Unknown as publisher.
    Most users will click yes even if the publisher is unknown. They will certainly click yes if the alert keeps popping up
    I think you can find a statistics report somewhere what percentage of users is going to click yes.
    Last edited by LHYX1; 04-10-2012 at 07:51 AM.
    (\ /)
    ( . .)
    c(")(")

    This is bunny.
    Copy and paste bunny into your signature to help him gain world domination.

  6. #6
    Just burned his ISO
    Join Date
    Dec 2011
    Posts
    6

    Default Re : Where is SET saving its cloned/imported sites to?

    Well the point of it is creating a personal ceritficate(i bet there's a way to avoid it) anyway i dont think the guy who coded set paid for the certificate. By the way, are you familiar with java?

  7. #7
    Just burned his ISO
    Join Date
    Dec 2011
    Posts
    6

    Default Re: Where is SET saving its cloned/imported sites to?

    Quote Originally Posted by LHYX1 View Post
    @Maris I think this is impossible unless you buy a real certificate.
    proof: http://www.sslshopper.com/java-code-...tificates.html
    Home made certificates will always have Unknown as publisher.
    Most users will click yes even if the publisher is unknown. They will certainly click yes if the alert keeps popping up
    I think you can find a statistics report somewhere what percentage of users is going to click yes.
    Arghh finally on English. I accidentally clicked somewhere French and I couldn't find even my head in all that mess . Anyway I fooled myself lol haven't used SET for a long time so I imagined it uses a certificate lolz xD, yeah no way to get the unknown field changed otherwise than paying. I just don't get, what's the point of selfmade certificates(except for those applets who need them for applet permissions like saving and such)?

    Mods sorry for any inconvenience i caused with these double posts, just couldn't find anything in French

  8. #8
    Senior Member LHYX1's Avatar
    Join Date
    Sep 2010
    Location
    Belgium
    Posts
    127

    Default Re: Where is SET saving its cloned/imported sites to?

    Your applet needs to be signed in order to write to the client machine and
    the java applet of set writes an exe file to the client machine so you need a certificate
    You can read trough the code. There's a Java.java file somewhere in the set folder.
    (\ /)
    ( . .)
    c(")(")

    This is bunny.
    Copy and paste bunny into your signature to help him gain world domination.

Similar Threads

  1. Replies: 1
    Last Post: 01-14-2010, 05:58 AM
  2. I can't open sites
    By krastavichki in forum OLD BackTrack 4 (pre) Final
    Replies: 3
    Last Post: 07-14-2009, 10:17 AM
  3. Some Good Sites
    By 1shot_1kill in forum OLD Newbie Area
    Replies: 1
    Last Post: 12-08-2008, 03:38 AM
  4. malware sites
    By somanyholes in forum OLD Newbie Area
    Replies: 4
    Last Post: 06-27-2008, 06:51 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •