‫The basic goals of social engineering are the same as hacking in general to gain unauthorized access
‫to systems or collect information in order to commit fraud.
‫Network intrusion, industrial espionage, identity theft or to simply disrupt the system or network.
‫You can see different classifications for social engineering attacks.
‫Here we classify these attacks into three groups.
‫Physical social engineering attacks in this type of social engineering attack, the attacker tries to
‫gather information by being physically present in the social engineering environment.
‫If it's possible, they also observe the people using their persuasion skills or some tools to collect
‫data.
‫Social engineering by phone calling the victim, the attacker usually tries to collect some critical
‫information about the victim.
‫In addition, the attacker can try to deceive the victim to visit a malicious website or install a malicious
‫piece of software as well.
‫Computer aided social engineering attacks now in most cases, this type of social engineering attack
‫is performed as a phishing attack.
‫Phishing is typically carried out by email spoofs or instant messaging.
‫It often directs users to enter personal information at a fake website.
‫Now, the look and feel of that website are identical to the legitimate one, and the only difference
‫is the new URL of the website that they're visiting.
‫Just like all of the hacking or pin testing types, the steps of the social engineering attacks are
‫reconnaissance scanning exploitation.
‫And post exploitation.
‫In reconnaissance steps, you trying to collect everything which will help you to perform a successful
‫attack.
‫Here are some examples of the information you collect.
‫Information about the people who are related to the target company, employees, employers, subcontractors,
‫shareholders, clients, etc. security measures of the company, so you can look for the evasion techniques.
‫Which Internet browser is used mostly.
‫What is the most common version of that browser?
‫If you know this, you can prepare your malicious websites to work with that browser.
‫Like internet browsers, you should be better in collecting the versions of the programs widely used
‫inside the company.
‫Versions of the Java runtime environment, PDF reader offers tools, et cetera.
‫Company sensitive data, if you know the name of the director of the human resources department, you
‫can prepare a phishing email as if it was sent by the director.
‫Exploitation step is the attack time.
‫Call the victims if you can redirect the victims phones to call you.
‫Prepare websites to use the vulnerabilities of the browser widely used in the target company and force
‫the victim to visit the website, prepare malware and force the victim to open it, send the malware
‫as an attachment to a phishing email or in an instant message or in a promotion CD rom distributed in
‫the company or in a flash drive as a gift to the victim.
‫Post exploitation is deep diving.
‫The actions of this step are to see how far you can go inside the company.
‫Accessing the most sensitive systems and information.
‫Creating backdoors for further use, etc..
‫In addition to human weakness, system weaknesses are also used in phishing attacks.
‫You can use the vulnerabilities of web browsers, Java applications, office documents, web applications
‫to compromise the target systems use some realistic scenarios to get the victims to run the malicious
‫software or prepare malicious websites and deceive the victim to visit these websites so you can collect
‫the sensitive data from the victim's.
‫Of course, there will be some security systems used by the target company.
‫You can use some techniques and tricks to bypass them.
‫In general and use of computers of a company are restricted by security systems to reach the ports except
‫80 and 443.
‫As you know, these two ports are the default ports of the HTTP and HTTPS.
‫For this reason, you should use the ports 80 or 443 for connection on the attacker's side.
‫If the target machine is behind a different private network or the target machines firewall blocks incoming
‫connection attempts, then you should consider using a reverse connection.
‫In a reverse connection, the attacker sets up a listener first on his box.
‫The target machine acts as a client connecting to that listener.
‫Security devices can realize there's malware inside the attachments of emails in this case, try archiving
‫the file several times and protect that archive with a password changing the extension of the file,
‫for example.
‫Let's take a short zip file extension and change it to Zei underscore.
‫That might be another try to bypass email security measures.
‫If the email content controller blocks the IP data inside the email body, you might consider using
‫you URLs shortness.
‫To bypass intrusion detection and prevention systems, IPS IDs anti-virus systems use custom payloads
‫instead of existing payloads created by the frameworks like Metis spoiled.
‫And of course, you should encode the payload before embedding it.