CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool is specifically designed to create fake login pages for phishing campaigns and can be integrated with Metasploit?
⚠ Common exam trap
The CEH exam often tests the distinction between general-purpose tools (like Nmap or Wireshark) and specialized social engineering frameworks, leading candidates to confuse a network attack tool (Ettercap) with a phishing-specific tool like SET.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Social Engineering Toolkit (SET)
The Social Engineering Toolkit (SET) is specifically designed to automate social engineering attacks, including the creation of fake login pages (credential harvesting) for phishing campaigns. It includes a built-in 'Website Attack Vectors' module that can clone legitimate sites and capture submitted credentials, and it offers direct integration with Metasploit to deliver payloads or establish reverse shells upon credential submission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Social Engineering Toolkit (SET)
Why this is correct
The Social Engineering Toolkit (SET) is explicitly designed for various social engineering attacks, including the creation of convincing fake login pages. Its "Web Attack Vectors" module, specifically the "Credential Harvester Attack," allows an attacker to clone legitimate websites, including their login forms. This cloned page then captures any credentials entered by unsuspecting victims, forwarding them to the attacker while often redirecting the user to the actual legitimate site to avoid suspicion.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is a powerful open-source utility primarily used for network discovery and security auditing. It functions by sending raw IP packets to target hosts and then analyzing their responses to determine available hosts, services offered, operating systems running, and firewall status. Nmap's capabilities are focused solely on network reconnaissance and mapping, not on generating or hosting web content such as fake login pages.
- ✗
Wireshark
Why it's wrong here
Wireshark is a widely used network protocol analyzer that allows users to interactively browse and inspect network traffic in real-time or from saved capture files. Its primary function is to capture packets off a network interface and display detailed protocol information, enabling deep analysis of network communications. Wireshark is a diagnostic and analysis tool, completely unrelated to the active creation or deployment of malicious web pages, such as fake login forms.
- ✗
Ettercap
Why it's wrong here
Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks, primarily focusing on ARP poisoning, DNS spoofing, and session hijacking within a local network segment. While Ettercap can intercept and manipulate network traffic, potentially redirecting users or injecting content, it does not possess the functionality to generate or host a fake login page itself. Its role is to facilitate the interception and manipulation of data streams, not to create the web-based phishing content.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.