The basic goals of social engineering are the same as hacking in general to gain unauthorized access
to systems or collect information in order to commit fraud, network intrusion, industrial espionage,
identity theft, or to simply disrupt the system or network.
You can see different classifications for social engineering attacks here.
We classify these attacks into three groups.
Physical social engineering attacks in this type of social engineering attack, the attacker tries to
gather information by being physically present in the social engineering environment if it's possible.
They also observe the people using their persuasion skills or some tools to collect data.
Social engineering by phone calling the victim, the attacker usually tries to collect some critical
information about the victim.
In addition, the attacker can try to deceive the victim to visit a malicious website or install a malicious
piece of software as well.
Computer aided social engineering attacks.
Now, most cases, this type of social engineering attack is performed as a phishing attack.
Phishing is typically carried out by email spoofs or instant messaging.
It often directs users to enter personal information at a fake Web site.
Now, the look and feel of that Web site are identical to the legitimate one.
And the only difference is the Eurail of the Web site that they're visiting.
Just like all of the hacking or pen testing types, the steps of the social engineering attacks are
reconnaissance, scanning, exploitation.
And post exploitation.
In reconnaissance steps, you trying to collect everything which will help you to perform a successful
attack?
Here are some examples of the information you collect.
Information about the people who are related to the target company employees, employers, subcontractors,
shareholders, clients, etc., security measures of the company, so you can look for the evasion techniques.
Which Internet browser is used mostly, what is the most common version of that browser, if you know
this, you can prepare your malicious websites to work with that browser.
Like Internet browsers, you should be better in collecting the versions of the programs widely used
inside the company versions of the Java runtime environment, PDF, reader office tools, etc..
Company sensitive data, if you know the name of the director of the Human Resources Department, you
can prepare a phishing email as if it was sent by the director.
Exploitation step is the attack time.
Call the victims if you can redirect the victims phones to call you.
Prepare websites to use the vulnerabilities of the browser widely used in the target company and force
the victim to visit the website, prepare malware and force the victim to open it, send the malware
as an attachment to a phishing email or in an instant message or in a promotion CD-ROM distributed in
the company or in a flash drive as a gift to the victim.
Post exploitation is deep diving, the actions of this step are to see how far you can go inside the
company accessing the most sensitive systems and information, creating back doors for further use,
etc..
In addition to human weakness, system weaknesses are also used in phishing attacks, you can use the
vulnerabilities of Web browsers, Java applications, office documents, Web applications to compromised
the target systems, use some realistic scenarios to get the victims to run the malicious software,
or prepare malicious websites and deceive the victim to visit these websites so you can collect the
sensitive data from the victims.
Of course, there will be some security systems used by the target company, you can use some techniques
and tricks to bypass them.
In general and use of computers of a company are restricted by security systems to reach the ports except
80 and 443, as you know, these two ports of the default ports of the TTP and HTTPS.
For this reason, you should use the ports 80 or ForFour three for connection on the attackers side.
If the target machine is behind a different private network or the target machine's firewall blocks
incoming connection attempts, then you should consider using a reverse connection.
In a reverse connection, the attacker sets up a listener first on his box.
The target machine acts as a client connecting to that listener.
Security devices can realize there's malware inside the attachments of emails in this case, try archiving
the files several times and protect that archive with a password, changing the extension of the file.
For example, let's take a zip file extension and change it to dot zei underscore.
That might be another try to bypass email security measures.
If the email content controller blocks the IP data inside the email body, you might consider using
U.
RL shortness.
To bypass intrusion detection and prevention systems, IPS, IDs, antivirus systems, use custom payloads
instead of existing payloads created by the frameworks like Meeta Spoiled.
And of course, you should encode the payload before embedding it.