Family Personal DevelopmentLearning Center • Cybersecurity
Authorized isolated environment • fake credentials only

Credential Harvesting in the CYBER.ORG Range

See how a convincing login template can capture credentials—then connect the experience to URL inspection, MFA, password reuse, reporting, and defense.

Non-Negotiable Safety Boundary

Use only an assigned CYBER.ORG Range environment. Use only fake practice credentials. Do not send the page to anyone outside the isolated environment. Do not use real Google, work, banking, or personal credentials.

What You Need

Access to apps.cyber.org, one Kali Linux virtual machine, one Windows 7 virtual machine, and the authorized SEToolkit web-template activity.

A

Open the Range

Launch the two isolated machines.
Setup
Open apps.cyber.org.
Sign in with the credentials provided by the organization granting access.
Open the assigned environment. Do not launch or test a different environment.
Launch both Kali Linux and Windows 7. Wait for both desktops to finish loading.
Keep Kali available as the controlled test system and Windows as the fictional victim system.
Range design: CYBER.ORG describes the Range as cloud-based virtual machines that run in a browser and are closed off from private networks.
B

Find the Kali IP Address

The Windows VM will use this address to reach the practice page.
Kali
Open a terminal in Kali Linux.
Run:
hostname -I
Write down the Kali IP address. It may look similar to 10.0.0.25.
Use the address assigned in your environment—not the example above.
C

Open SEToolkit

Follow the authorized web-template menu path.
Kali
In the Kali terminal, run:
sudo setoolkit
If the terms prompt appears, type y and press Enter.
At the main menu, enter 1 — Social-Engineering Attacks.
Enter 2 — Website Attack Vectors.
Enter 3 — Credential Harvester Attack Method.
Enter 1 — Web Templates.
Verify the displayed POST-back address matches the Kali IP. Press Enter to accept it.
Enter 2 — Google web template.
Leave the terminal open. Look for the message that information will appear as it arrives.
Menu map: 1 → 2 → 3 → 1 → verify IP → 2
Important: This walkthrough uses the built-in practice web template. It does not instruct you to clone or host a live organization’s login page.
D

Open the Practice Page from Windows

Use fake credentials only.
Windows
Switch to the Windows 7 virtual machine.
Open Chrome.
Enter the Kali IP address in the address bar. Example:
http://10.0.0.25
Inspect the address bar. The page may resemble Google, but the URL is only the Kali IP address.
Enter fake practice credentials such as:
explorer@practice.test
PracticeOnly!2026
Select the sign-in button. A redirect may occur, but no real Google authentication took place.
E

Observe the Capture

Return to Kali and connect the result to defense.
Kali
Return to the Kali terminal where SEToolkit is waiting.
Look for GOT A HIT! and the fake username and password displayed in plaintext.
Notice what did not happen: the fake page did not prove identity or sign in to Google. It only captured the submitted values.
Stop the local demonstration with Ctrl+C when finished.
Close or reset the assigned Range environment according to the access provider’s directions.
F

If Something Does Not Work

Use the symptom to locate the missed step.
Troubleshoot
What you seeWhat to check
Windows cannot open the pageConfirm SET is still running, use the current Kali IP, include http:// if needed, and verify both VMs are in the same assigned environment.
The Google template did not appearConfirm the menu path: 1 → 2 → 3 → 1 → verify IP → 2.
No credentials appear in KaliConfirm the fake form was submitted while SET was waiting and Windows used the correct Kali address.
Copy and paste does not workCYBER.ORG documents Ctrl+Alt+Shift for opening the Range side menu; paste there, then paste inside the VM.
The environment restartedRange machines may be nonpersistent. Relaunch and repeat using notes saved outside the VM.
The displayed IP differs from the exampleThat is normal. Always use the IP assigned to the current Kali machine.

Defense Check

Select an answer to reveal the explanation.

Completed: 0 / 4

What is the clearest warning in the simulated Google page?

What credentials belong in this exploration?

Which defense limits damage if one password is captured?

Why must this remain inside the assigned Range?

References

  1. Cyber Innovation Center. (n.d.). Credential harvesting lab: Cybersecurity 701. CYBER.ORG.
  2. CYBER.ORG. (n.d.). CYBER.ORG Range. https://cyber.org/range
  3. TrustedSec. (n.d.). Social-Engineer Toolkit. https://github.com/trustedsec/social-engineer-toolkit