Social Engineering

Cover......Page 1
Title Page......Page 5
Copyright......Page 6
About the Technical Editor......Page 9
Credits......Page 11
Acknowledgments......Page 13
Contents......Page 17
Foreword......Page 21
Preface......Page 23
1 A Look into the New World of Professional Social Engineering......Page 25
 What Has Changed?......Page 26
 Why Should You Read This Book?......Page 28
 An Overview of Social Engineering......Page 30
  OSINT......Page 35
  Reporting......Page 36
 What’s in This Book?......Page 38
 Summary......Page 39
 A Real-World Example of Collecting OSINT......Page 41
  Observational Skills......Page 46
  Technical Open Source Intelligence......Page 56
  Two Other Things......Page 76
  IntelTechniques......Page 83
  Maltego: The Granddaddy of Them All......Page 84
 Summary......Page 85
3 Profiling People Through Communication......Page 87
 The Approach......Page 90
 Enter the DISC......Page 92
  What Is DISC?......Page 93
  To Know Thyself Is the Beginning of Wisdom......Page 95
 Summary......Page 104
4 Becoming Anyone You Want to Be......Page 107
 The Principles of Pretexting......Page 108
  Principle One: Thinking Through Your Goals......Page 109
  Principle Two: Understanding Reality vs. Fiction......Page 111
  Principle Three: Knowing How Far to Go......Page 112
  Principle Four: Avoiding Short-Term Memory Loss......Page 115
  Principle Five: Getting Support for Pretexting......Page 118
  Principle Six: Executing the Pretext......Page 119
 Summary......Page 122
5 I Know How to Make You Like Me......Page 125
 The Tribe Mentality......Page 127
 Building Rapport as a Social Engineer......Page 129
  The Moral Molecule......Page 130
  The 10 Principles of Building Rapport......Page 131
  Read......Page 144
 Summary......Page 145
6 Under the Influence......Page 147
  Reciprocity in Action......Page 149
  Using Reciprocity as a Social Engineer......Page 151
  Obligation in Action......Page 152
  Using Obligation as a Social Engineer......Page 154
  Concession in Action......Page 155
  Using Concession as a Social Engineer......Page 157
 Principle Four: Scarcity......Page 158
  Using Scarcity as a Social Engineer......Page 159
 Principle Five: Authority......Page 161
  Authority in Action......Page 163
  Using Authority as a Social Engineer......Page 164
  Consistency and Commitment in Action......Page 166
  Using Commitment and Consistency as a Social Engineer......Page 168
 Principle Seven: Liking......Page 170
  Using Liking as a Social Engineer......Page 171
 Principle Eight: Social Proof......Page 172
  Using Social Proof as a Social Engineer......Page 173
  Manipulation in Action......Page 175
  Principles of Manipulation......Page 177
 Summary......Page 180
7 Building Your Artwork......Page 181
 The Dynamic Rules of Framing......Page 183
  Rule 1: Everything You Say Evokes the Frame......Page 186
  Rule 2: Words T hat Are Defined with the Frame Evoke the Frame......Page 188
  Rule 3: Negating the Frame......Page 189
  Rule 4: Causing the Target to T hink About the Frame Reinforces the Frame......Page 190
  Ego Appeals......Page 192
  Mutual Interest......Page 194
  Deliberate False Statement......Page 196
  Having Knowledge......Page 198
  The Use of Questions......Page 201
 Summary......Page 206
8 I Can See What You Didn’t Say......Page 207
 Nonverbals Are Essential......Page 208
 All Your Baselines Belong to Us......Page 211
  Be Careful of Misconceptions......Page 214
  Know the Basic Rules......Page 218
 Understand the Basics of Nonverbals......Page 220
  Anger......Page 222
  Disgust......Page 225
  Contempt......Page 227
  Fear......Page 229
  Surprise......Page 231
  Sadness......Page 235
  Happiness......Page 239
 Summary......Page 244
9 Hacking the Humans......Page 247
 An Equal Opportunity Victimizer......Page 248
 The Principles of the Pentest......Page 249
  Be Judicious with Pretexts......Page 252
  Educational Phishing......Page 253
  Pentest Phishing......Page 254
  Spear Phishing......Page 255
  Phishing Summary......Page 256
  Credential Harvesting......Page 257
  Vishing for OSINT......Page 259
  Vishing for Full Compromise......Page 260
  Vishing Summary......Page 263
 SMiShing......Page 264
 Impersonation......Page 265
  Planning an Impersonation Pentest......Page 266
  Considerations of Sanitization......Page 268
  Equipment Procurement......Page 269
 Reporting......Page 270
  Professionalism......Page 271
  Mitigation......Page 272
  Next Steps......Page 273
  How Can I Get a Job Being a Social Engineer?......Page 274
  How Do I Get My Clients to Do SE Stuff?......Page 275
  How Much Should I Charge?......Page 277
 Summary......Page 278
10 Do You Have a M.A.P.P.?......Page 281
 Step 1: Learn to Identify Social Engineering Attacks......Page 283
  Take the Thinking out of the Policy......Page 285
  Remove the Ability for Empathy Bypasses......Page 286
  Make Policies Realistic and Actionable......Page 287
 Step 3: Perform Regular Real-World Checkups......Page 288
 Step 4: Implement Applicable Security-Awareness Programs......Page 290
 Tie It All Together......Page 291
 Gotta Keep ’Em Updated......Page 292
 Let the Mistakes of Your Peers Be Your Teacher......Page 294
 Create a Security Awareness Culture......Page 295
 Summary......Page 298
 Soft Skills for Becoming an Social Engineer......Page 301
  Extroverted......Page 302
  It Really Works!......Page 303
 Technical Skills......Page 304
 Education......Page 305
  Get Hired by a Pentest Company......Page 307
 The Future of Social Engineering......Page 308
Index......Page 311
EULA......Page 322