pentest-social

name	pentest-social
description	Social engineering pentest methodology — phishing strategy, pretexting, vishing scenario, awareness training advisory. No live phishing operation. Triggers on social engineering, phishing, vishing, pretext, awareness, OSINT-driven pretext, GoPhish, Evilginx, phishing simulation.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-social","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents social-engineer (advisory side)"}

pentest-social

Social engineering strategy and awareness training advisory. NO live phishing campaign operation — this skill only does scenario design, target-list scoping, and debrief planning.

Triggers

• "phishing scenario"
• "social engineering plan"
• "pretext idea"
• "vishing scenario"
• "awareness training"
• "gophish setup for a phish simulation"

Engagement Discipline Boundaries

1. Proof of authorization required — written client permission, an in-scope user list
2. HR + Legal approval — employee targeting is coordinated with HR + Legal
3. Employee psychological impact — misuse ends the engagement
4. Plan a debrief — post-engagement training material for every target
5. Targeting third parties — forbidden (the client provides them)

Phishing Scenario Types

Type	Example	Impact Measure
Mass phish	"Your password is expiring" (generic)	Awareness baseline
Spear phish	Personalized (role + name from LinkedIn)	Target role-specific test
Whaling	C-level target	High-risk target defense
Smishing	Over SMS	Mobile vector
Vishing	Phone (impersonate IT support)	Human verification procedure
Watering hole	Clone of a site the user visits often	Supply chain
QR phish	Physical QR sticker	Hybrid attack

Pretext Design (Authorized Engagement)

A good pretext = believable + urgency + hard to verify + typical action

Examples:

1. IT Support Pretext
   - "Your Office365 account is locked, please verify via this link"
   - Believable: common daily email
   - Urgency: no account access
   - Action: link click + cred input

2. Vendor Invoice Pretext
   - "Payment for invoice number X is pending"
   - Believable: finance/procurement related
   - Urgency: due date passed
   - Action: open the attachment (XLSX macro)

3. Internal HR Pretext
   - "New performance review system - please log in"
   - Believable: internal process
   - Hard to verify: HR system change
   - Action: cred input

GoPhish Campaign Setup (Setup-Only, No Run)

# config.yml example
admin_server:
  listen_url: 127.0.0.1:3333
  use_tls: true
phish_server:
  listen_url: 0.0.0.0:80
  use_tls: false

Setup steps (the user runs manually):

1. Prepare GoPhish + landing page
2. Sending profile (engagement domain, SPF/DKIM/DMARC test)
3. Target list (the list the client provides)
4. Template + landing page (clone of the client brand)
5. Campaign scheduling (working hours)

This skill does not run any GoPhish command. Only the setup checklist + scenario writing.

Evilginx (Setup-Only)

• Reverse proxy for MFA bypass (within an authorized pentest)
• Setup: phishlet configuration, custom landing page
• Before use: WRITTEN client approval for the MFA-bypass simulation

Vishing (Phone) Scenario

## Vishing Scenario — "IT Helpdesk MFA Reset"

### Preparation
- OSINT: IT team names from LinkedIn
- Social media: organization structure
- Burner phone number + spoofing legal framework (within an authorized pentest)

### Scenario
- "Hi [target name], this is [IT team member name]. There's an issue with our MFA system,
  could you read me your confirmation code so I can reset your account?"
- Prepare for pushback questions:
  - "Where did you get my number" -> "Helpdesk inventory"
  - "Will the director approve" -> "It's urgent, so I skipped that"

### Line
- Keep the conversation under 90 seconds
- Urgency through halting phrasing
- Not asking for creds, asking for the MFA code (push-approval bypass)

Debrief / Training Plan

After the engagement ends:

1. Aggregate stats: how many clicked, how many gave creds, how many reported
2. Feedback — no individual report (shame + retaliation); role-based aggregate
3. Training: phishing signs, verification procedures, reporting path
4. Test cadence: baseline every 3 months, annual mass campaign

Out-of-Scope

• Live campaign operation (the client does it, or an authorized pentest firm)
• Targeting third parties
• Individual reporting that could become grounds for firing an employee
• Any targeting without HR/Legal approval