WEBVTT

00:00:02.720 --> 00:00:05.730
Let's spend a minute discussing social engineering attacks.

00:00:06.050 --> 00:00:07.740
When you perform social engineering,

00:00:07.950 --> 00:00:10.250
you have a number of attacks at your disposal.

00:00:10.640 --> 00:00:14.370
The most common one that we see is phishing or spearphishing attacks.

00:00:15.040 --> 00:00:17.810
The difference between phishing and spearphishing is that

00:00:17.810 --> 00:00:20.720
spearphishing is a highly targeted form of phishing.

00:00:21.110 --> 00:00:24.320
It involves emails being sent to well‑researched victims.

00:00:24.660 --> 00:00:28.130
These type of emails are very difficult to stop because off

00:00:28.130 --> 00:00:31.880
the bat they look very legitimate, so relying purely on

00:00:31.880 --> 00:00:33.950
technical controls is not enough.

00:00:34.190 --> 00:00:37.350
Then we have different types of website attacks. Now the most

00:00:37.350 --> 00:00:39.760
common website attacks that you would see that relate to

00:00:39.760 --> 00:00:42.680
phishing are credential harvesting attacks.

00:00:43.080 --> 00:00:46.400
We also have attacks such as your HTA, or HTML application

00:00:46.400 --> 00:00:50.130
attack, which relies on a Windows program running a scripting

00:00:50.130 --> 00:00:53.350
language either in a VBScript or JavaScript.

00:00:53.690 --> 00:00:57.650
Another form of an attack that we have is an infectious media attack.

00:00:58.120 --> 00:00:59.010
In this attack,

00:00:59.310 --> 00:01:02.680
you can create infectious media that can rely on the auto‑run

00:01:02.800 --> 00:01:07.010
capability of Windows, and pretty much once this runs,

00:01:07.020 --> 00:01:11.480
it spawns a reverse shell on which the attacker can access the targeted machine.

00:01:11.840 --> 00:01:16.660
While these AP attacks are commonly used where you have public WiFi services

00:01:16.660 --> 00:01:21.280
available, have you ever joined public WiFi and noticed that you can log in

00:01:21.290 --> 00:01:25.880
either using your Gmail account or your Facebook account? Now imagine using a

00:01:25.880 --> 00:01:30.840
malicious WiFi network harvesting those credentials. PowerShell attacks are

00:01:30.840 --> 00:01:32.910
also used with social engineering.

00:01:33.180 --> 00:01:34.380
In this type of attack,

00:01:34.470 --> 00:01:38.740
the attacker tricks the user into running a malicious PowerShell script,

00:01:39.050 --> 00:01:42.570
which then ultimately goes out and downloads malware that can

00:01:42.570 --> 00:01:46.080
be used to remotely control the machine or drop either types of

00:01:46.080 --> 00:01:47.830
malware on the targeted machine.

00:01:48.160 --> 00:01:51.330
The social engineering toolkit enables you to create various types

00:01:51.330 --> 00:01:53.990
of attacks that fall within these categories,

00:01:54.000 --> 00:01:56.250
and it allows you to create a little bit more.