‫Social engineering attacks by phone is also called a phishing with the word is a combination of voice
‫and phishing.
‫Viking attacks are highly effective.
‫If you've done your homework and have all the relevant information and you already know where you get
‫the information in the first place.
‫This is where the information gathering phase comes into play.
‫You need to have a realistic scenario first.
‫Before you call the victim, you have to be very well prepared.
‫Who are you?
‫Where are you calling from?
‫What's your expertise?
‫What's the subject?
‫What do you want from the victim?
‫The more you prepare, the more the victim will trust you.
‫There are some tricks to being more realistic.
‫For example, if you're in the role of a call centre staff, it's better to have a background voice
‫as if some of the staff are talking with other customers or clients.
‫It's a very effective way to frighten the victim.
‫Your computer is blocking a million dollar transaction to the company.
‫We have to fix it immediately.
‫Have you recently visited websites that you should not have visited?
‫Here, then, is the real world social engineering test that we performed in one of our pen tests.
‫According to the scenario, we are an I.T. department staff and want to make sure if all the employees
‫got the critical security update of the corporate email service, the critical points of the attack
‫are as follows First, introduce yourself as one of the personnel from the IT department, now an information
‫gathering and reconnaissance phase.
‫If you found the real names working in the IT department, use one of these names, but prepare yourself.
‫The victim may know the person whose name you're using.
‫If you don't know anyone in the IT department, choose a common name.
‫What's the most common name in that country?
‫Second, make the victim nervous about his or her mistake.
‫Well, it's critical and security are important.
‫You should have got the update up to now, but you haven't third gain the trust of the victim.
‫Don't share any information with me or anyone else.
‫Security is important.
‫Give the IP address of your malicious website because you share the URL on the phone.
‫Don't try to find a URL similar to the company's web mail service.
‫IP is good, but it's not understandable since the victim manages the steps him or herself.
‫He or she has no doubt that the operation is secure.
‫The victim visits our Web site, which looks like the Web mail service of the company that downloads
‫our backdoor as the security patch.
‫The success rate of this test was.
‫90 percent.
‫In this course, you learned.
‫The terminologies and definitions of social engineering, basic social engineering techniques.
‫Social engineering types and the steps of the social engineering tests.
‫How to bypass security measures.
‫How to create malware.
‫How to create custom payloads to use inside the malware, how to embed the malicious code into the documents.
‫The social engineering toolkit.
‫And social engineering via phone, also known as phishing.