Social Engineering & Phishing
Understand and simulate social engineering attacks — spear phishing, pretexting, vishing, and physical attacks — to evaluate human security controls and train employee awareness.
Learning Objectives
- → Explain the psychology behind social engineering attacks
- → Craft convincing spear phishing emails with SET and GoPhish
- → Understand pretexting, vishing, and physical social engineering
- → Set up a credential harvesting campaign for security awareness testing
- → Design effective employee security awareness training
The Human Element
95% of successful cyber attacks involve human error (IBM Security Report)
The weakest link is almost always the human, not the technology.
Social engineering: manipulating people into performing actions
or divulging confidential information.
Key psychological principles used:
- Authority — "This is IT, I need your password now"
- Urgency — "Your account will be suspended in 1 hour"
- Fear — "Legal action unless you verify"
- Reciprocity — "I helped you last week, now help me"
- Social proof — "All your colleagues have already updated"
- Liking — Building rapport before asking
- Scarcity — "Only 10 minutes to respond"
Phishing Types
Phishing — bulk email to many targets
Spear phishing — targeted at specific individual (personalized)
Whaling — targeting executives (CEO fraud)
Vishing — voice phishing (phone calls)
Smishing — SMS phishing
Clone phishing — copy of legitimate email with malicious links
Business Email Compromise (BEC) — pretend to be exec/vendor
Watering hole — compromise website visited by target org
Supply chain — compromise vendor/software used by target
Spear Phishing with GoPhish
# GoPhish — phishing simulation platform (authorized campaigns only!)
# Install:
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-*.zip && ./gophish
# Configure at https://localhost:3333
# Default creds: admin / (printed on first run)
# Steps:
# 1. Sending Profile: SMTP relay (test with mailtrap.io)
# 2. Email Template: clone legitimate email (IT password reset, HR benefits)
# 3. Landing Page: clone target login page
# 4. Users & Groups: import target list (employees with consent)
# 5. Campaign: link all together, set tracking
# Campaign tracks:
# - Email opened (tracking pixel)
# - Link clicked
# - Credentials submitted
# - Email reported as phishing
SET (Social-Engineer Toolkit)
# SET — comprehensive social engineering framework
setoolkit
# 1) Social-Engineering Attacks
# 2) Website Attack Vectors
# 3) Credential Harvester Attack Method
# 4) Web Templates (clone Facebook, Google, custom)
# Credential Harvesting (from msfconsole/set):
# Enter target URL to clone
# SET clones the page and hosts it locally
# Victim submits credentials → captured in clear text
# Redirected to real site
# Spear phishing with SET:
# 1) Social-Engineering Attacks
# 2) Spear-Phishing Attack Vectors
# 3) Perform a Mass Email Attack
# → Configure SMTP, craft email, send
# File-based attack (malicious PDF):
# 1) SET > Spear-Phishing > File format exploits
# Choose: Adobe PDF exploit
# Delivery: email attachment with payload
Pretexting Scenarios
What is pretexting: creating a fabricated scenario (pretext) to
gain trust and extract information or access.
Common pretexts:
1. IT Support: "We need to update your VPN credentials"
2. HR: "Please verify your direct deposit banking info"
3. Vendor: "Your company owes $50,000 — wire to this account"
4. Survey: "Quick 5-minute employee satisfaction survey"
5. New employee: "I just started and need your badge to access the printer room"
6. Delivery: "I have a package, need someone to sign and hold the door"
Key elements of successful pretext:
- Research: know the target's name, role, colleagues
- Credibility: use correct terminology, reference real events
- Reason: give a plausible reason for the request
- Urgency: time pressure prevents careful thinking
Vishing (Voice Phishing)
Vishing techniques:
- Caller ID spoofing: appear as IT helpdesk (202-555-0100)
- Script: "Hi, this is Michael from IT. We've detected unusual activity..."
- Social engineering over phone to:
* Get VPN credentials
* Reset passwords
* Get MFA codes (real-time relay)
* Reveal internal information
Caller ID spoofing tools (for authorized tests):
- SpoofCard, Asterisk PBX, Twilio with Number Masking
Real-time phishing (RTF): attacker calls, victim provides MFA code
to attacker who relays it to the real site simultaneously
Physical Social Engineering
Tailgating: following authorized person through secure door
Piggybacking: same, but with awareness of the intruder
Badge cloning:
- Proxmark3: RFID reader/writer
- Clone HID/EM4100 access cards
- Wave near victim's badge in elevator
Rogue USB drops:
- Leave USB drives in parking lot labeled "Salary Survey Q4"
- USB runs payload when inserted
- Tool: USB Rubber Ducky, Bash Bunny
Dumpster diving:
- Find: printed emails, org charts, system manuals, access codes
- Shred policy is critical
Security Awareness Training
Effective components of security awareness:
1. Simulated phishing campaigns (GoPhish) with immediate training
2. Clear email indicator training:
- Check sender domain (not just display name)
- Hover over links (check actual URL)
- Suspicious urgency = verify via phone/Slack
3. Reporting mechanism: "Report Phishing" button in email client
4. Metrics:
- Click rate (benchmark → reduction over time)
- Report rate (should increase)
- Repeat clickers: additional training
5. Policy: no sharing credentials via phone/email — ever
6. MFA: even phished password is useless without 2nd factor
Set up a phishing simulation (use mailtrap.io for safe email testing): (1) install and configure GoPhish, (2) create an email template cloning an IT password reset email, (3) clone a login page (use your own test site), (4) import a test user group (use your own email addresses), (5) launch campaign, (6) click the link and submit credentials, (7) review GoPhish dashboard for tracking data.
What tracking mechanism does GoPhish use to detect email opens?
Why is spear phishing more successful than mass phishing?
Set up a credential harvesting page: (1) clone the target login page with wget --mirror URL, (2) modify the form action to POST to your server, (3) create a PHP/Python script to capture and log submitted credentials, (4) redirect victim to the real site after capture, (5) test with a test account, (6) verify credentials are captured in log file.
What makes a phishing page believable to victims?
Design a security awareness program: (1) create a phishing simulation campaign plan for a 500-person organization, (2) define target metrics: click rate < 5%, report rate > 30%, (3) design a 'just-in-time' training page shown to clickers, (4) create a one-page cheat sheet for employees: how to identify phishing emails, (5) design the follow-up training for repeat clickers.
What is just-in-time training in phishing simulations?