You're right! I missed a few points.

Here’s the complete and organized summary

of everything in your note while keeping it clear, easy to understand, and relatable
with real-life examples.

Company Reputation and Security Posture

A company’s security breaches don’t just expose sensitive data; they also
damage its reputation. Attackers use publicly available information from past
breaches to gather intel on their targets. They rely on sources like password
dumps, file metadata, archived websites, and public code repositories to
find vulnerabilities and plan attacks.

1. Password Dumps – Why Are They So Valuable?

Main idea: Attackers use leaked usernames and passwords to break into accounts
and escalate their access.

When a website is hacked, attackers often steal login credentials (usernames

and passwords) and share them on the dark web or hacking forums.
These password dumps are goldmines for cybercriminals because many
people reuse passwords across multiple sites.

Tools like h8mail, WhatBreach, and LeakLooker allow attackers to search for
email addresses and passwords from old breaches. These tools often rely on
services like Have I Been Pwned to check if an email was part of a breach.

It’s like finding a master key that opens multiple doors. If someone uses the same
password for their email, social media, and banking, an attacker who finds that
password can access all those accounts.

2. File Metadata – The Hidden Details in Documents and Images

Main idea: Metadata in files can reveal personal details like names, locations, and
device information.

Every file—whether it’s a Word document, Excel sheet, PowerPoint, or an

image—contains hidden details called metadata. This data includes the author’s
name, timestamps, and sometimes GPS coordinates (for images). Attackers
can extract metadata using tools like ExifTool to learn more about their target.

For example, if a hacker finds a company report in a PDF or Word document, they
can check who created it, when, and on which device. If an image is posted
online, its metadata might contain the exact GPS location where it was taken.
It’s like sending someone a photo without realizing your phone automatically
tagged the location. If a hacker finds that image, they now know where you were at
the time.

3. Search Engines and Website Archives – Finding Deleted Information

Main idea: Even if a company deletes sensitive data, attackers can still retrieve it
from cached or archived versions.

Attackers don’t always need hacking tools—they can use Google search tricks
(Google Dorking) to find hidden or sensitive files on websites. Even if a
company deletes important pages, older versions might still be available on:

 Google Cache (temporary saved copies of web pages)

 Wayback Machine (a tool that archives websites over time)

This means an attacker can find old company policies, email addresses,
employee names, or even confidential documents that were once online but
later removed.

It’s like deleting an embarrassing tweet, but someone already took a screenshot
and shared it. Even though you removed it, it’s still accessible somewhere.

4. Public Source Code Repositories – Finding Secrets in Code

Main idea: Attackers search for leaked API keys, passwords, and system
configurations in public code repositories.

Companies and developers accidentally upload sensitive information (like

passwords or API keys) to sites like GitHub. Attackers scan these repositories
looking for:

 Database passwords

 API keys

 Cloud service credentials

Once they find these secrets, they can access company systems or
impersonate legitimate users.

It’s like writing your ATM PIN on a sticky note and accidentally leaving it on a public
bulletin board. Anyone who sees it can now withdraw money from your account.

Why Does This Matter?

When attackers gather leaked passwords, metadata from files, and archived website
data, they can piece together a detailed picture of their target. They can then
use this information to:

 Launch phishing attacks by impersonating employees

 Break into accounts using old passwords

 Discover company infrastructure through leaked metadata

 Find deleted files or policies to understand company operations

The best way to protect against these attacks is to:

Use unique passwords for each site

Check metadata before sharing files online

Be mindful of what you post publicly

Regularly audit public repositories for leaked credentials

Final Thought

Cybersecurity is like locking your doors at night—but in the digital world, you
have to make sure there are no spare keys left lying around, no hidden doors
attackers can find, and no old locks that haven’t been changed.

Understanding how attackers gather information helps you stay one step
ahead in protecting your data and accounts.

2nd note

Strategic Search Engine Analysis (Google Hacking)

Main Idea:

Attackers can use search engines like Google, Bing, and DuckDuckGo to
uncover sensitive information that shouldn’t be publicly available. This technique
is called Google hacking or Google dorking—using advanced search
operators to locate vulnerabilities, leaked files, or sensitive login details.

1. How Google Dorking Works

Google can do more than just find websites—it can scan specific file types,
URLs, and page contents. Attackers use special search operators to filter
results and uncover hidden data.

Here are some powerful Google dork operators:

 filetype: Finds specific file types (e.g., filetype:xls to find Excel files).

 inurl: Looks for keywords within a website’s URL (e.g., inurl:admin).

 link: Searches for links to a specific site (e.g., link:[Link]).

 intitle: Finds pages with specific words in the title (e.g., intitle:"Index of
/etc").

By combining these operators, attackers can extract usernames, passwords,

error logs, and even access restricted directories.

It’s like using a metal detector at a beach—except instead of coins, hackers are
looking for forgotten passwords, exposed databases, or hidden admin panels.

2. Real-Life Example of a Google Dork

If you type this search into Google:

intext:JSESSIONID OR intext:PHPSESSID inurl:[Link] ext:log

It finds session IDs stored in log files, which hackers can use to impersonate
users and gain unauthorized access to websites.

Another powerful dork:

"public $user =" | "public $password = " | "public $secret =" | "public $db =" ext:txt
| ext:log -git

This search looks for publicly exposed credentials (like database passwords)
stored in text or log files.

3. The Google Hacking Database (GHDB)

GHDB is a collection of Google dorks that can be used to find:

Usernames and passwords stored in public files

Sensitive directories and login portals

Vulnerable web servers

Error messages revealing system details

You can check it out here:

Google Hacking Database (GHDB)

It’s like having a cheat sheet for finding security flaws with Google. Many ethical
hackers use GHDB to test their own systems for vulnerabilities.

4. Why This Matters

If a company’s private files, logs, or credentials are accidentally made public,

attackers can easily find and exploit them using Google dorks.

Protect yourself by:

Blocking search engine indexing of sensitive pages

Regularly checking for leaked credentials

Never storing passwords in plaintext

Testing your own site with Google dorks to find and fix vulnerabilities
before attackers do

Cybersecurity is like locking your doors, but Google dorking is a way for
hackers to peek through the windows—so make sure you close those blinds!

3rd Note

Website Archiving & Public Code Repositories

Main Idea:

Hackers can use archived websites and public code repositories to

uncover old security flaws, hidden pages, and source code vulnerabilities.
1. Website Archiving & The Wayback Machine

Many organizations store historical snapshots of websites, the most famous

being the Wayback Machine:

[Link]

This tool lets anyone see past versions of websites, including:

Old login pages that may still work

Retired subdomains that could be reactivated

Removed confidential data (that might still be visible in old snapshots)

It’s like finding an old diary that someone threw away—except hackers are
searching for security weaknesses, not personal memories.

2. Public Source Code Repositories (GitHub & GitLab)

Many companies accidentally leak sensitive information on platforms

like GitHub and GitLab. Attackers search these repositories for:

Hardcoded passwords & API keys

Configuration files with security settings

Source code vulnerabilities that can be exploited

Even if the code itself isn’t vulnerable, it still gives attackers a blueprint of the
company’s technology.

It’s like giving a thief a copy of your house’s floor plan—they’ll know exactly where
the weak spots are!

3. Why This Matters

If companies don’t monitor what’s archived or exposed online, attackers

can dig up past weaknesses and exploit them today.

To stay safe:

Regularly check archived versions of your site for leaked data

 Search GitHub & GitLab for accidental code exposure

Remove outdated subdomains and old login portals

Cybersecurity is like cleaning up your digital footprints—if you leave traces

behind, someone might follow them!

1st note

Alright, let me break it down in a simple and real-life way so it sticks in your mind.

Types of Vulnerability Scans (Simplified)

Vulnerability scanners are like security guards checking a building for weak spots.
Different types of scans serve different purposes, just like how security guards use
different techniques depending on the situation.

1. Unauthenticated Scans – The Outsider's View

Imagine you're walking around a house, trying to see if any windows or doors are
open without entering. That’s what an unauthenticated scan does. It only sees
what’s exposed to the outside world (open ports, visible services) but doesn’t check
inside for hidden issues.

✅ Good for: Seeing how much an outsider (hacker) can access.

❌ Downside: Might miss vulnerabilities inside the system.

2. Authenticated Scans – The Insider's View

Now, imagine you have a key to the house and can go inside to check if the
windows lock properly, if the walls have cracks, or if the alarm system works. This is
an authenticated scan—it logs in to the system with provided credentials and
checks for deeper security issues.

✅ Good for: Getting a full security picture and reducing false positives.

❌ Downside: Needs login credentials (which might be risky if leaked).

3. Discovery Scans – The Recon Mission

Before planning a break-in, burglars first check which houses have open doors,
weak fences, or valuable stuff inside. Discovery scans do the same by identifying
what services are running on a system.

✅ Good for: Mapping out a target before a full security test.

❌ Downside: Doesn’t test for vulnerabilities—just gathers information.

4. Full Scans – The Deep Inspection

This is like hiring a security team to inspect every single corner of a building. Full
scans check everything—open ports, software versions, configurations, known
exploits, etc.

✅ Good for: Finding as many weaknesses as possible.

❌ Downside: Takes a long time and can cause system crashes if not carefully
configured.

---

5. Stealth Scans – The Silent Check

Think of a ninja sneaking into a building without making noise. Stealth scans are
used when you don’t want to alert security systems (Intrusion Prevention Systems,
Firewalls) that you’re scanning.

✅ Good for: Testing security without triggering alerts.

❌ Downside: May miss some vulnerabilities because it avoids aggressive scans.

6. Compliance Scans – The Rule Check

Imagine a restaurant being inspected to see if it follows hygiene laws (e.g., washing
hands, storing food properly). Compliance scans check if a system meets industry
security standards (e.g., HIPAA for healthcare, PCI DSS for credit card security).

✅ Good for: Businesses that must follow security laws.

❌ Downside: Might not find all vulnerabilities—only checks based on rules.

Final Thought:

 If you want to see what hackers can access → Use an unauthenticated scan.

 If you want a full internal check → Use an authenticated scan.

 If you’re just identifying devices & services → Use a discovery scan.

 If you want everything tested → Use a full scan.

 If you don’t want to be noticed → Use a stealth scan.

 If you must follow security rules → Use a compliance scan.

Want me to test you on this?

2nd note

This note highlights six critical challenges you must consider when running a
vulnerability scan. Here’s the refined breakdown of the key points, ensuring clarity
and effectiveness in understanding:

---

Challenges to Consider When Running a Vulnerability Scan

1. Choosing the Best Time for a Scan

Scanning a production network must be done carefully to avoid disrupting critical

services.

Vulnerability scans generate high traffic, potentially overloading the network and
even crashing devices.

The ideal time for scanning is off-peak hours, such as early mornings, when network
usage is minimal.
Pro Tip: If performing a penetration test for a company, follow their timing policies—
they may restrict scans during business hours.

2. Understanding the Protocols in Use

Before scanning, identify the protocols used by the target device.

If both TCP and UDP are in use but you only scan TCP, you may miss vulnerabilities
on UDP services.

A comprehensive scan ensures all potential risks are detected.

3. Considering Network Topology

Scan as close to the target as possible to minimize impact on network devices.

Avoid scanning across a WAN connection—it can strain infrastructure and affect
accuracy.

Firewalls and other network devices can interfere with scan results, leading to
incomplete assessments.

Best Practice: Place the scanner on the same subnet as the target to get the most
accurate results.
4. Handling Bandwidth Limitations

Vulnerability scans generate heavy traffic, which can congest the network.

Scanning over low-bandwidth links (e.g., VPN, WAN) may cause performance issues.

Adjust scanner settings to avoid excessive bandwidth consumption.

Recommendation: Disable Denial-of-Service (DoS) and flooding attacks in

constrained environments.

5. Implementing Query Throttling

Slowing down scan traffic reduces network and device strain.

This can be done by:

Reducing attack threads sent at once.

Narrowing scan scope (e.g., disabling Windows-related scans for a Linux server).

Goal: Maintain effectiveness while avoiding crashes or performance degradation.

6. Managing Fragile Systems & Non-Traditional Assets

Some devices (e.g., printers, IoT devices) may not handle aggressive vulnerability
scans well.

Solutions include:

Exempting fragile devices (though this reduces security).

Throttling scan intensity to prevent crashes.

Balance security with stability by adjusting scan settings appropriately.

---

Key Takeaway

A well-planned vulnerability scan minimizes risks while maximizing security insights.

Consider network traffic, scan timing, protocol coverage, and device limitations to
achieve an effective yet safe scanning process.
3rd Note

3.4 Understanding How to Analyze Vulnerability Scan Results

Overview Reconnaissance is important for understanding our client's assets and

attack surface. However, reconnaissance does not necessarily identify actual
vulnerabilities. We may know the platforms and services that are reachable by
threat actors, but are there known vulnerabilities in those platforms and services?

Vulnerability scans offer an automated way of linking scan information to details of

vulnerabilities that exist for the scan results. With this information, it is possible to
craft exploits that can lead to serious consequences such as data breaches and
service disruptions. With a collection of these vulnerabilities, we can move forward
to actual penetration of the network and assessment of risks that such exploits pose
to Pixel Paradise.

running on a specific version or distribution of Linux. Most vulnerability scanners are

able to correlate multiple pieces of information to make the determination.
However, some Linux operating systems, such as Red Hat, report an older version of
a service that has actually been patched for the specific vulnerability. This is called
backporting. So, as you can see, there is more to it than just running a scan. Of
course, the number-one method of validating a finding from a vulnerability scan is
to exploit the vulnerability, as discussed in many of the upcoming modules.

3.4.2 Sources for Further Investigation of Vulnerabilities The following sections

describe some helpful sources for further investigation of vulnerabilities that you
might find during your scans.

1. US-CERT

The U.S. Computer Emergency Readiness Team (US-CERT) was established to

protect the Internet infrastructure of the United States. The main goal of US-CERT is
to work with public- and private-sector agencies to increase the efficiency of
vulnerability data sharing. The work done by US-CERT is meant to improve the
nation’s cybersecurity posture. US-CERT operates as an entity under the
Department of Homeland Security as part of the National Cybersecurity and
Communications Integration Center (NCCIC). You can access US-CERT resources by
visiting
2. The CERT Division of the Software Engineering Institute of Carnegie
Mellon University

The CERT Division of the Software Engineering Institute of Carnegie Mellon

University is a cybersecurity center whose experts help coordinate vulnerability
disclosures across the industry. CERT researches security vulnerabilities and
contributes to many different cybersecurity efforts in the industry. CERT also
develops and delivers training to many organizations to help them improve their
cybersecurity practices and programs. You can obtain additional information about
CERT at [Link]

3. NIST

The National Institute of Standards and Technology (NIST) is an agency of the U.S.
Department of Commerce. Its core focus is to promote innovation and industrial
competitiveness. NIST is responsible for the creation of the NIST Cybersecurity
Framework (NIST CSF; see [Link] This framework
includes a policy on computer security guidance. Version 1 of the NIST framework
was published in 2014 for the purpose of guiding the security of critical
infrastructure; however, it is commonly used by private industry for guidance in risk
management. In 2018, NIST released version 1.1, which is designed to assist
organizations in assessing the risks they encounter. In general, the framework
outlines the standards and industry best practices that can be used to improve
organizations’ cybersecurity posture. Anyone who is responsible for making
decisions related to cybersecurity in an organization should consult this framework
for guidance on standards and best practices.

4. JPCERT

Similar to the US-CERT, the Japan Computer Emergency Response Team (JPCERT) is
an organization that works with service providers, security vendors, and private-
sector and government agencies to provide incident response capabilities, increase
cybersecurity awareness, conduct research and analysis of security incidents, and
work with other international CERT teams. The JPCERT is responsible for Computer
Security Incident Response Team (CSIRT) activities in the Japanese and Asia Pacific
region. You can access JP-CERT resources by
visiting [Link]
5. CAPEC

The Common Attack Pattern Enumeration and Classification (CAPEC) is a

community-driven effort to catalog the attack patterns seen in the wild so that they
can be used to more efficiently identify active threats. CAPEC, which is maintained
by MITRE, acts as a dictionary of known attacks that have been seen in the real
world.

6. CVE

Common Vulnerabilities and Exposures (CVE) is an effort that reaches across

international cybersecurity communities. It was created in 1999 with the idea of
consolidating cybersecurity tools and databases. A CVE ID is composed of the
letters CVE followed by the year of publication and four or more digits in the
sequence number portion of the ID (for example, CVE-YYYY-NNNN with four digits in
the sequence number, CVE-YYYY-NNNNN with five digits in the sequence number,
CVE-YYYY-NNNNNNN with seven digits in the sequence number, and so on). You can
obtain additional information about CVE at [Link]

7. CWE

Common Weakness Enumeration (CWE), at a high level, is a list of software

weaknesses. The purpose of CWE is to create a common language to describe
software security weaknesses that are the root causes of given vulnerabilities. CWE
provides a common baseline for weakness identification to aid the mitigation
process. You can obtain additional information about CWE at MITRE’s
site: [Link]

8. CVSS

impact on other systems that may be impacted by the vulnerability but do not
contain the vulnerable code. For instance, if a router is susceptible to a DoS
vulnerability and experiences a crash after receiving a crafted packet from the
attacker, the scope is changed, since the devices behind the router will also
experience the denial-of-service condition. FIRST provides additional examples
at [Link]

3.4.4 How to Deal with a Vulnerability As a penetration tester

your goal is to identify weaknesses that can be exploited. As previously discussed,
vulnerability scanning is a method of identifying potential exploits. After you identify
a vulnerability, you need to verify it. There are many ways to determine if a
vulnerability scanner’s findings are valid. The ultimate validation is exploitation.

To determine if a vulnerability is exploitable, you need to first identify an exploit for

a vulnerability. Suppose your vulnerability scanner reports that there is an outdated
version of Apache Struts that is vulnerable to a remotely exploitable
unauthenticated defect. One of the first things you would want to do is to determine
if there is a readily available exploit. Many times, this can be found with an
exploitation framework such as Metasploit. As a general rule, if a vulnerability has a
matching module in Metasploit, it should almost always be considered high severity.
That being said, there are also other methods for finding exploits, and you can
always write your own exploits.

How do you prioritize your findings for the next phase of your penetration test? To
determine the priority, you need to answer a few questions:

 What is the severity of the vulnerability?

 How many systems does the vulnerability apply to?
 How was the vulnerability detected?
 Was the vulnerability found with an automated scanner or manually?
 What is the value of the device on which the vulnerability was found?
 Is this device critical to your business or infrastructure?
 What is the attack vector, and does it apply to your environment?
 Is there a possible workaround or mitigation available?

Answering these questions can help you determine the priority you should assign to
the vulnerabilities found. Standard protocol would have you start with the highest-
severity vulnerabilities that have the greatest likelihood of being exploited. If these
vulnerabilities are actually valid, they might already be compromised. (If at any time
during a penetration test, you find that a system is being actively exploited, you
should report it right away to the system owner.)

Next, you should address any vulnerabilities that are on critical systems, regardless
of the severity level. It is possible that there might be an exploit chain available to
an attacker that would allow a lower-severity vulnerability to become critical. You
need to protect critical systems first. Next, you might want to prioritize based on
how many systems are affected by the finding. If a large number of systems are
affected, then this would raise the priority because many exploits on this
vulnerability would have a higher impact on your environment. These are suggested
guidelines, but when it comes to prioritization of vulnerability management and
mitigation, it really depends on the specific environment.

SOCIAL ENGINEERING

Module 4.1: Pretexting for an Approach and Impersonation

1. Understanding Pretexting and Impersonation

Pretexting is when an attacker creates a false identity or scenario to manipulate

victims into revealing sensitive information. Impersonation is a common technique

where attackers pretend to be someone trustworthy to gain access to information or

systems.
2. The Role of Influence, Interrogation, and Impersonation

Social engineers manipulate human psychology by:

 Influence: Convincing victims that they should trust or obey them.

 Interrogation: Asking questions to gather information subtly.

 Impersonation: Acting as someone else to gain access or trick people.

 Elicitation: Gaining Information Without Directly Asking

Attackers use open-ended questions to learn about the victim’s values, goals, and
work. Closed-ended questions give more control over the conversation and can lead
or stop discussions. Asking too many or too few questions can raise suspicion.

3. Key Observations by Social Engineers

Attackers analyze a victim’s body language and behavior to spot weaknesses:

 Posture and body movements – Nervousness or confidence levels.

 Facial expressions – Blushing, turning pale, or avoiding eye contact.

 Hand and Foot movements – Fidgeting or tapping, which may indicate

nervousness.

 Speech patterns – Hesitations, voice pitch, speed, and tone changes.

4. Impersonation Techniques in Social Engineering

Attackers often pretend to be someone trustworthy to gain access:

 Delivery personnel – Fake UPS, FedEx, or Amazon employees claiming to

have a package.
  IT Support staff – Pretending to help with a “technical issue” to gain access

to a victim’s computer.

 Corporate executives – Using authority to trick employees into sharing

sensitive data.

Example: A hacker dressed as an IT worker offers to fix a victim’s laptop. While

pretending to assist, they insert a malicious USB that installs spyware.

5. Pharming – Impersonating Websites to Steal Data

Pharming is an attack where a victim is redirected to a fake website that looks real,
tricking them into entering sensitive data (like passwords).

Steps in a Pharming Attack:

 A user clicks a real website link (e.g., online banking).

 The hacker redirects them to a fake site by modifying the victim’s DNS
settings.
 The victim enters sensitive data, which is stolen or used to install malware.

Pharming Example:

Omar visits a bank website → Gets redirected to a fake version.

The hacker steals his login details or installs malware on his device.

How to Prevent Pharming:

 Update software and run anti-malware scans.

 Change default router passwords.
 Be cautious when visiting websites and opening emails.

6. Malvertising – Using Ads to Spread Malware

Malvertising is when hackers place fake ads on trusted websites to infect victims.
Clicking on these ads redirects users to malicious sites that install malware.
How to Avoid Malvertising Attacks:

 Use ad-blockers and security tools.

 Avoid clicking on suspicious ads, even on trusted sites.
 Keep browsers and security software updated.

Summary: Key Takeaways

 Social engineers manipulate human psychology to extract sensitive data.

 Elicitation and interrogation help attackers gain information without

suspicion.

 Impersonation is a powerful technique (e.g., fake IT support, fake deliveries).

 Pharming attacks trick users into visiting fake websites to steal their data.

 Malvertising spreads malware through infected ads on legitimate websites.

 Staying cautious, verifying sources, and updating security software are key

defenses.

That’s your structured note for Module 4.1 on Pretexting and Impersonation! Let me
know if you need more details or a simpler explanation of any section. Keep going,
Cyberknight!

4.2 Social Engineering Attacks

Overview
Social engineering attacks exploit the weakest link in security: human users.

Attackers trick victims into revealing sensitive information through emails, phone

calls, in-person deception, or fake websites.

4.2.1 Exploiting Human Behavior

Attackers manipulate victims by leveraging normal user behavior.

Example: An attacker posts a fake job offer to lure a security professional into
revealing sensitive company information during an "interview."

This method avoids traditional hacking and directly gathers intelligence from
the victim.

4.2.2 Email-Based Attacks

1. Phishing

Definition: An attacker tricks a victim into clicking on a fake link or attachment to

steal login credentials or infect their device with malware.

Example: A fake email from "Your Bank" asking you to reset your password.

2. Spear Phishing

Targeted phishing attack designed for a specific person or organization.

Example: A fake email impersonating a coworker, asking for confidential company

files.

3. Whaling

Aimed at high-ranking executives (CEOs, managers). Uses realistic, business-like

messages to steal credentials or install malware.
Example: A fake email from a "law firm" warning about a legal issue, urging the
CEO to open a malicious document.

4.2.3 Vishing (Voice Phishing)

Definition: Attackers use phone calls to trick victims into revealing sensitive
information.

Example: A fake call from "tech support" saying your account is compromised and
asking for your password.

Prevention Tip: Verify caller identities and never share confidential details over
the phone.

4.2.4 SMS Phishing (Smishing)

Definition: Attackers send fake text messages containing malicious links or fake
alerts.

Example: "Your Amazon account has been locked. Click here to verify your identity."

Prevention Tip: Never click on unexpected links in text messages. Instead, visit
the company’s official website directly.

4.2.5 USB Drop Attacks

Defintion: Attackers leave infected USB drives in public places, hoping someone
will plug them in.

Example: A USB labeled “Salary Report 2025” is left in an office parking lot.

Prevention Tip: Never insert unknown USB devices into your computer.

4.2.6 Watering Hole Attacks

Definition: Attackers infect websites commonly visited by a specific group of users.
When users visit the compromised website, malware is secretly installed on their
system.

Example: Hackers infect a popular business forum to target financial executives.

Prevention Tip:

 Use secure browsers and regularly update security software.

 Organizations should scan their websites for vulnerabilities.

Summary of Social Engineering Attacks

General Prevention Tips:

 Think before you click! Verify links before clicking.

 Never share sensitive info over email, text, or phone.

 Enable multi-factor authentication (MFA) for extra security.

 Keep software and security tools updated to prevent malware.

 Use strong passwords and be cautious with unexpected emails.

These notes are now concise, well-structured, and easy to review! Let me know if
you want anything adjusted.

4.3 Physical Attacks

As a penetration tester or red teamer, you might be asked to simulate real-world

physical security threats to test an organization's ability to prevent unauthorized
access to infrastructure, buildings, systems, and employees. This section covers
different types of physical attacks that malicious actors may use to compromise an
organization.

4.3.1 Tailgating & Piggybacking

Tailgating

Tailgating is an attack where an unauthorized person follows an authorized

individual into a restricted area without their consent. The attacker takes advantage
of people’s politeness or security weaknesses, such as doors that do not
automatically lock.

Piggybacking

Piggybacking is similar to tailgating, but with a key difference. The unauthorized

person is given consent to enter by an authorized individual. This could be due to
social engineering or simply an employee holding the door open for someone they
assume has access.

Prevention Methods:
Organizations can prevent tailgating and piggybacking using access control
mechanisms, including:

1. Access Control Vestibules (Mantraps)

A small entry space designed to hold one person at a time. Two doors: The first door
must close before the second will open, ensuring no one can bypass security. Often
used in server rooms and data centers.

2. Multifactor Authentication (MFA)

Multiple security layers can be required, such as: Proximity card + PIN at the first
door. Biometric scan at the second door.

3. Other Preventive Measures

Turnstiles – Allows entry one person at a time.

Double-entry doors – A second door prevents unauthorized access.

Security guards – Monitor and verify identities manually.

4.3.2 Dumpster Diving

Dumpster diving is an attack where a person searches through garbage or recycling
bins to find sensitive information. Attackers look for: Discarded documents
containing usernames, passwords, or financial details. Hard drives or removable
media that may contain confidential data.

Real-World Risk:

Even a shredded document can sometimes be reconstructed. Attackers may also

target electronic waste if old computers and drives are not properly wiped.

Prevention Methods:
1. Secure Document Disposal:

Organizations should keep sensitive documents stored in secure locations until no

longer needed. When disposing of them, use:

 Shredding machines (cross-cut shredders are better than strip-cut).

 Incineration for complete destruction.

 Professional third-party shredding services with proper security protocols.

2. Secure Electronic Disposal:

 Wipe hard drives and USB devices before disposal.

 Use data destruction software to overwrite data securely.

 Physically destroy storage media when necessary.

4.3.3 Shoulder Surfing

Shoulder surfing is a physical attack where an attacker steals information by looking

over a victim’s shoulder. This can occur when:

 The victim is entering passwords or PII on a laptop, phone, or tablet.

 The attacker watches from a close distance in a crowded place.

 The attacker uses binoculars or telescopes to spy from afar.

Small hidden cameras and microphones are used to secretly record a victim's

screen and keystrokes.

Common Target Locations:

Airports, coffee shops, and public transport. Office spaces where employees work on
confidential data.

Prevention Methods:
1. User Awareness & Training:

Employees should be aware of their surroundings when working on sensitive

information. Avoid typing passwords in public places.

2. Use Privacy Screen Filters:

Special polarized screen filters prevent people from seeing a screen unless viewed
directly from the front.

3. Position Screens Strategically:

Angle screens away from public view.

Use cubicle dividers or privacy walls in office environments.

4.3.4 Badge Cloning
Badge cloning is an attack where an attacker duplicates an employee’s access card

to gain unauthorized entry into secure areas. This can be done using:

 RFID Cloning Devices – Attackers use special hardware/software to copy a

badge’s radio frequency signal.

 Social Engineering – Attackers impersonate employees and create fake

badges to gain access.

Example of a Badge Cloning Attack:

1. An attacker steals or borrows an employee’s badge for a few seconds.

2. Using a portable badge reader, they copy the RFID signal.

3. They create a duplicate badge and use it to enter restricted areas.

How Attackers Gather Badge Information:

Social Media Exploitation

Employees posting "first day at work" pictures showing their ID badges.

Attackers extract badge design details from LinkedIn, Twitter, or Instagram.

This helps them create a fake badge for social engineering.

Prevention Methods:

1. Use Secure Badge Technologies:

2. Encrypted RFID or smart card technology to prevent easy cloning.

3. Avoid low-frequency RFID cards that can be easily copied.

2. Employee Awareness & Policies:

Prohibit employees from sharing badge photos online. Train employees to verify
identities before granting access.

3. Additional Security Measures:

 Multifactor authentication (MFA) at entry points.

 Security guards and access logs to monitor who enters.
 Random security checks to verify badge holders.

Conclusion

Physical attacks are a major security risk for organizations. Tailgating, dumpster
diving, shoulder surfing, and badge cloning are some of the most common tactics
used by attackers. Organizations must implement security controls such as access
control vestibules, shredding policies, privacy screens, and secure badge systems to
prevent unauthorized access. Regular security training and awareness programs
can help employees recognize and defend against these threats.

Social Engineering Tools and Methods of Influence

4.4 Social Engineering Tools

Social engineering tools exploit human psychology to manipulate individuals into
revealing sensitive information, clicking malicious links, or performing actions that
benefit an attacker. These tools assist penetration testers in simulating real-world
attacks to evaluate an organization’s security posture.

4.4.2 Social-Engineer Toolkit (SET)

Overview

The Social-Engineer Toolkit (SET) was developed by David Kennedy to assist security
professionals in testing how susceptible users are to social engineering attacks. It is
widely used in penetration testing to simulate attacks that rely on human
manipulation rather than system vulnerabilities.

 Pre-installed on security-focused operating systems like Kali Linux and Parrot

Security.
 Can be installed manually on other Linux distributions and macOS.
 Integrates with third-party tools and frameworks, such as Metasploit, to
create more advanced exploits.

Features of SET

1. Spear Phishing Attack Vector – Automates the process of crafting realistic

phishing emails to trick users into clicking malicious links.

2. Website Attack Vectors – Can clone legitimate websites (e.g., a fake Facebook
or Google login page) to steal user credentials.

3. USB/CD Attack Vector – Allows an attacker to create infected USB drives with
malicious payloads that, when plugged into a computer, give the attacker control
over the system.

4. Wireless Access Point Attack – Can be used to create rogue Wi-Fi networks to
intercept user traffic.

Real-Life Example: Spear Phishing Attack using SET

In 2016, a group of attackers used a phishing attack to compromise the Democratic

National Committee (DNC). They sent emails impersonating Google’s security team,
warning recipients about unauthorized login attempts. Victims clicked on a fake
Google login page created using a tool similar to SET, entered their credentials, and
unknowingly gave attackers access to sensitive emails.

4.4.3 Browser Exploitation Framework (BeEF)

Overview

The Browser Exploitation Framework (BeEF) is a penetration testing tool that

focuses on exploiting web browsers. It is designed to assess the security of client-
side applications by leveraging web-based vulnerabilities such as Cross-Site
Scripting (XSS).

How BeEF Works

1. The attacker injects a malicious JavaScript payload into a vulnerable website.

2. When a victim visits the infected website, the script executes and connects their
browser to the BeEF control panel.

3. The attacker gains access to the victim’s browser and can perform various
actions, such as:

 Stealing cookies and session tokens.

 Capturing keystrokes typed by the victim.
 Redirecting the victim to a fake login page.

Real-Life Example: XSS Attack using BeEF

In 2018, British Airways suffered a major data breach when attackers injected
malicious JavaScript into the airline’s website. This script stole credit card details
from thousands of customers who entered payment information. If BeEF had been
used in penetration testing beforehand, the company might have identified this
vulnerability before it was exploited.

4.4.5 Call Spoofing Tools

Attackers can manipulate phone systems to fake caller ID information, making their
calls appear to come from a trusted source (e.g., a bank, law enforcement, or a
company executive).

Examples of Call Spoofing Tools

1. SpoofApp – A mobile app available on iOS and Android that allows users to
change their caller ID.

2. SpoofCard – An app that not only spoofs phone numbers but also allows users
to:

 Change their voice.

 Record calls.
 Add fake background noise (e.g., making it sound like they are in an office).

3. Asterisk – A VoIP management tool that can also be misused to fake caller ID
information.

Real-Life Example: Call Spoofing Scam

In 2020, an international scam targeted thousands of people by impersonating

Amazon customer service. Attackers used caller ID spoofing tools to make their
phone numbers look like official Amazon support. They told victims their accounts
had been compromised and tricked them into providing credit card details over the
phone.

4.5 Methods of Influence

Social engineers use psychological manipulation to trick victims into making

emotionally-driven decisions. They exploit common behavioral patterns that
influence human thinking and decision-making.

1. Authority

People tend to comply with requests from authoritative figures (e.g., police officers,
company executives, or government officials). Attackers may impersonate authority
figures to pressure victims into revealing confidential information.

Real-Life Example: CEO Fraud (Business Email Compromise)

In 2019, Toyota lost $37 million in a scam where attackers impersonated a high-
ranking executive using a fake email account. Employees, believing they were
following orders, transferred money to fraudulent accounts.

2. Scarcity and Urgency

People tend to act quickly when they believe time is running out or that resources
are limited. Attackers create a sense of urgency to rush victims into making bad
decisions.

Real-Life Example: Fake Tech Support Scams

Victims receive pop-ups or phone calls claiming their computer is infected with
malware and that they must act immediately to prevent data loss. Scammers
convince victims to pay for fake antivirus software or give remote access to their
system.

3. Social Proof

People tend to follow what others are doing, especially in uncertain situations.
Attackers manipulate this by creating fake testimonials, reviews, or “popular” trends
to convince victims to act.

Real-Life Example: Fake Investment Schemes

In the 2022 FTX cryptocurrency collapse, many investors poured money into the
company because of endorsements from celebrities and social media influencers.
Attackers often use fake endorsements to create a false sense of security around
scams.

4. Likeness (Similarity and Affinity)

People are more likely to trust and cooperate with individuals they like or relate to.
Attackers try to establish rapport by mirroring body language, speech patterns, or
interests.
Real-Life Example: Romance Scams

In 2021, online romance scams cost victims over $600 million. Attackers created
fake profiles on dating apps and gained victims’ trust by pretending to share
common interests. Once trust was built, they manipulated victims into sending
money or revealing sensitive information.

5. Fear

Fear triggers emotional responses that make victims act without rational thinking.
Attackers use threats of punishment, loss, or harm to manipulate victims.

Real-Life Example: Ransomware Attacks

In 2021, the Colonial Pipeline ransomware attack caused panic when hackers locked
the company’s critical systems and demanded ransom. The fear of fuel shortages
led the company to pay the attackers $4.4 million in Bitcoin.

Conclusion

Social engineering is a powerful attack method that exploits human psychology

rather than technical vulnerabilities. Tools like SET, BeEF, and call spoofing apps
help attackers execute phishing, credential theft, and impersonation attacks.
Additionally, psychological manipulation techniques such as authority, urgency,
social proof, likeness, and fear make people more likely to fall for scams.

By understanding these tactics and studying real-world examples, individuals and

organizations can better protect themselves against social engineering threats.