Social Engineering: The Art of Human Hacking

Cover......Page 1
Title Page......Page 5
Copyright......Page 6
Contents......Page 13
Foreword......Page 15
Preface and Acknowledgments......Page 19
Chapter 1: A Look into the World of Social Engineering......Page 25
  The Layout......Page 27
  What’s Coming Up......Page 29
 Overview of Social Engineering......Page 33
  Social Engineering and Its Place in Society......Page 37
  The Different Types of Social Engineers......Page 40
  The Social Engineering Framework and How to Use It......Page 43
 Summary......Page 45
Chapter 2: Information Gathering......Page 47
  Using BasKet......Page 50
  Using Dradis......Page 52
  Thinking Like a Social Engineer......Page 54
 Sources for Information Gathering......Page 57
  Gathering Information from Websites......Page 58
  Going through the Garbage......Page 63
  Using Profiling Software......Page 66
 Communication Modeling......Page 67
  The Communication Model and Its Roots......Page 69
  Developing a Communication Model......Page 72
 The Power of Communication Models......Page 77
Chapter 3: Elicitation......Page 79
 What Is Elicitation?......Page 80
 The Goals of Elicitation......Page 82
  Preloading......Page 85
  Becoming a Successful Elicitor......Page 90
  Using Intelligent Questions......Page 94
 Mastering Elicitation......Page 98
 Summary......Page 100
Chapter 4: Pretexting: How to Become Anyone......Page 101
 What Is Pretexting?......Page 102
 The Principles and Planning Stages of Pretexting......Page 103
  The More Research You Do, the Better the Chance of Success......Page 104
  Involve Personal Interests to Increase Success......Page 105
  Practice Dialects or Expressions......Page 107
  Using the Phone Should Not Reduce the Effort for the Social Engineer......Page 108
  The Simpler the Pretext, the Better the Chance of Success......Page 110
  The Pretext Should Appear Spontaneous......Page 112
  Provide a Logical Conclusion or Follow-through for the Target......Page 114
  Example 1: Stanley Mark Rifkin......Page 115
  Example 2: Hewlett-Packard......Page 117
  Staying Legal......Page 120
  Additional Pretexting Tools......Page 122
 Summary......Page 123
Chapter 5: Mind Tricks: Psychological Principles Used in Social Engineering......Page 125
  The Senses......Page 127
  The Three Main Modes of Thinking......Page 128
 Microexpressions......Page 133
  Anger......Page 136
  Disgust......Page 138
  Contempt......Page 140
  Fear......Page 142
  Surprise......Page 144
  Sadness......Page 146
  Happiness......Page 149
  Training Yourself to See Microexpressions......Page 151
  How Social Engineers Use Microexpressions......Page 153
  The History of Neurolinguistic Programming......Page 160
  Codes of Neurolinguistic Programming......Page 161
  How to Use NLP as a Social Engineer......Page 162
 Interview and Interrogation......Page 167
  Professional Interrogation Tactics......Page 168
  Gesturing......Page 177
  Arm and Hand Placement......Page 180
  Listening Your Way to Success......Page 181
 Building Instant Rapport......Page 186
  Be Aware of How You Affect People......Page 187
  Keep the Conversation off Yourself......Page 188
  Remember That Empathy Is Key to Rapport......Page 189
  Develop Your Curious Side......Page 190
  Find Ways to Meet People’s Needs......Page 191
  Using Other Rapport-Building Techniques......Page 194
  Testing Rapport......Page 195
 The Human Buffer Overflow......Page 196
 Summary......Page 202
Chapter 6: Influence: The Power of Persuasion......Page 205
  Have a Clear Goal in Mind......Page 206
  Rapport, Rapport, Rapport......Page 207
  Don’t Act Insane—Be Flexible......Page 210
 Influence Tactics......Page 211
  Reciprocation......Page 212
  Obligation......Page 215
  Concession......Page 217
  Scarcity......Page 219
  Authority......Page 223
  Commitment and Consistency......Page 226
  Liking......Page 230
  Consensus or Social Proof......Page 234
  Politics......Page 239
  Using Framing in Everyday Life......Page 240
  Four Types of Frame Alignment......Page 245
  Using Framing as a Social Engineer......Page 251
 Manipulation: Controlling Your Target......Page 257
  To Recall or Not To Recall......Page 259
  Anxiety Cured at Last......Page 261
  You Can’t Make Me Buy That!......Page 262
  Conditioning Targets to Respond Positively......Page 266
  Manipulation Incentives......Page 268
 Manipulation in Social Engineering......Page 272
  Increasing a Target’s Suggestibility......Page 273
  Forcing the Target to Reevaluate......Page 274
  Making the Target Feel Powerless......Page 275
  Intimidating a Target......Page 276
  Using Positive Manipulation......Page 277
 Summary......Page 280
Chapter 7: The Tools of the Social Engineer......Page 283
  Lock Picks......Page 284
  Cameras and Recording Devices......Page 291
  Using a GPS Tracker......Page 295
 Online Information-Gathering Tools......Page 303
  Maltego......Page 304
  SET: Social Engineer Toolkit......Page 307
  Telephone-Based Tools......Page 313
  Password Profilers......Page 316
 Summary......Page 321
Chapter 8: Case Studies: Dissecting the Social Engineer......Page 323
  The Story......Page 324
  Applying the SE Framework to the DMV Hack......Page 327
  The Target......Page 330
  The Story......Page 331
  Applying the SE Framework to the SSA Hack......Page 333
  The Target......Page 334
  The Story......Page 335
  Applying the SE Framework to the Overconfident CEO Hack......Page 340
 Hadnagy Case Study 2: The Theme Park Scandal......Page 341
  The Story......Page 342
  Applying the SE Framework to the Theme Park Hack......Page 345
  The Target......Page 346
  The Story......Page 347
  Applying the SE Framework to Top Secret 1......Page 352
 Top-Secret Case Study 2: Social Engineering a Hacker......Page 353
  The Story......Page 354
  Applying the SE Framework to the Top Secret Case Study 2......Page 360
 Why Case Studies Are Important......Page 361
 Summary......Page 362
Chapter 9: Prevention and Mitigation......Page 363
 Learning to Identify Social Engineering Attacks......Page 364
 Creating a Personal Security Awareness Culture......Page 365
 Being Aware of the Value of the Information You Are Being Asked For......Page 368
 Keeping Software Updated......Page 371
 Learning from Social Engineering Audits......Page 372
  Setting Audit Goals......Page 373
  What Should and Should Not Be Included in an Audit......Page 374
  Choosing the Best Auditor......Page 376
 Concluding Remarks......Page 378
  The Importance of Gathering and Organizing Information......Page 379
  Choose Your Words Carefully......Page 380
  Have a Good Pretext......Page 381
  Practice Reading Expressions......Page 382
  Be Alert to Malicious Tactics......Page 383
  Use Your Fear......Page 384
 Summary......Page 385
Index......Page 387
EULA......Page 407