Module 09: Social Engineering
Scenario
Organizations fall victim to social engineering tactics despite having strong security
policies and solutions in place. This is because social engineering exploits the most
vulnerable link in information system security—employees. Cybercriminals are
increasingly using social engineering techniques to target people’s weaknesses or play
on their good natures.
Social engineering can take many forms, including phishing emails, fake sites, and
impersonation. If the features of these techniques make them an art, the psychological
insights that inform them make them a science.
While non-existent or inadequate defense mechanisms in an organization can
encourage attackers to use various social engineering techniques to target its
employees, the bottom line is that there is no technological defense against social
engineering. Organizations must educate employees on how to recognize and respond
to these attacks, but only constant vigilance will minimize attackers’ chances of
success.
As an expert ethical hacker and penetration tester, you need to assess the
preparedness of your organization or the target of evaluation against social engineering
attacks. It is important to note, however, that social engineering primarily requires soft
skills. The labs in this module therefore demonstrate several techniques that facilitate
or automate certain facets of social engineering attacks.
Objective
The objective of the lab is to use social engineering and related techniques to:
Sniff user/employee credentials such as employee IDs, names, and email
addresses
Obtain employees’ basic personal details and organizational information
Obtain usernames and passwords
Perform phishing
Detect phishing
Overview of Social Engineering
Social engineering is the art of manipulating people to divulge sensitive information that
will be used to perform some kind of malicious action. Because social engineering
targets human weakness, even organizations with strong security policies are
vulnerable to being compromised by attackers. The impact of social engineering attacks
on organizations can include economic losses, damage to goodwill, loss of privacy, risk
of terrorism, lawsuits and arbitration, and temporary or permanent closure.
There are many ways in which companies may be vulnerable to social engineering
attacks. These include:
Insufficient security training
Unregulated access to information
An organizational structure consisting of several units
Non-existent or lacking security policies
Lab Tasks
Ethical hackers or penetration testers use numerous tools and techniques to perform
social engineering tests. The recommended labs that will assist you in learning various
social engineering techniques are:
1. Perform social engineering using various techniques
o Sniff Credentials using the Social-Engineer Toolkit (SET)
o Perform phishing using ShellPhish
2. Detect a phishing attack
o Detect phishing using Netcraft
o Detect phishing using PhishTank
3. Audit organization's security for phishing attacks
o Audit organization's security for phishing attacks using OhPhish
Next: Lab 1: Perform Social...
Live Chat