3.6. SOCIAL ENGINEERING & HUMAN EXPLOITATION
While most
breaches are technical in nature,
many begin with a
human mistake. Social engineering
manipulates human psychology to gain access to systems, data, or physical spaces.
3.6.1. Phishing Attacks
Phishing is the most common social engineering method.
Tricking someone into clicking a link, opening an attachment, or entering credentials.
[table]
[tr][td]
Method[/td][td]
Description[/td][/tr]
[tr][td]Email Phishing[/td][td]Fake login pages, invoice scams, password resets[/td][/tr]
[tr][td]Spear Phishing[/td][td]Personalized attack on a specific individual[/td][/tr]
[tr][td]Smishing[/td][td]SMS-based phishing[/td][/tr]
[tr][td]Vishing[/td][td]Voice calls (impersonating tech support, HR, etc.)[/td][/tr]
[/table]
Tools & Frameworks:
Email Templates & Lures: - Fake password reset alerts - Job offer files with macros - “Unusual login detected” notices
3.6.2. Pretexting & Impersonation
Creating a believable identity to
trick a victim into revealing information or performing an action.
Examples: - Pretending to be IT support: “We need your credentials to reset your VPN.” - Acting as HR: “We need your tax ID to update payroll.” - Impersonating coworkers via spoofed email accounts
Skills Required: - OSINT (Open Source Intelligence) - Confidence and improvisation - Understanding corporate structure and lingo
Training Resources:
3.6.3. Baiting & USB Drops
Leaving malware-laced USBs or QR codes in public spaces, hoping someone interacts with them.
Examples: - USBs labeled “2024 Salaries” - QR codes offering free drinks on posters - Files disguised as internal documents (Project_Roadmap.docx)
3.6.4. Physical Social Engineering
[table]
[tr][td]
Method[/td][td]
Description[/td][/tr]
[tr][td]Tailgating[/td][td]Following authorized individuals into secure locations without a badge.[/td][/tr]
[tr][td]Dumpster Diving[/td][td]Retrieving sensitive documents from trash bins or recycling.[/td][/tr]
[tr][td]Shoulder Surfing[/td][td]Observing a victim type their password or PIN.[/td][/tr]
[tr][td]Lock Picking[/td][td]Accessing server rooms or offices via basic physical bypass techniques.[/td][/tr]
[/table]
Tools for Practice:
3.6.5. OSINT for Targeting Victims
Open-source intelligence is used to profile and craft believable attacks
Tools & Techniques:
Targets: - Work email formats (john.doe@company.com) - Employee names from LinkedIn - Social media vacation announcements (for pretext)
The human is often the weakest link.
![[Image: Ontwerp-zonder-titel-23.png]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fi.postimg.cc%2FWprtDCdh%2FOntwerp-zonder-titel-23.png)