Posted on by Glenn

[ Certified Ethical Hacker v10 ] :: [ Chapter 12 ] :: Social Engineering

This entry is part 23 of 30 in the series [ Certified Ethical Hacker Training ]

[ Certified Ethical Hacker Training ]

Social Engineering

Social engineering falls into the category of non-technical attacks. Quite bluntly, you’re not likely to see much or any of this on the CEH exam, other than the phishing topics. So we’ll give you targeted lists of words to recognize and topics to know.

Vocabulary

“Rebecca” and “Jessica” are the stereotype names for potential victims.

Fake AV

Rogue Security (a fake AV)

What is the Weakest Link

The user. Always the freakin’ user.

Which User Is Most Dangerous?

This is insider vs. outsider, and the insider is always deadlier.

EC-Council’s Steps of Social Engineering

  1. Research (the usual Reconnaissance steps)
  2. Select a victim
  3. Develop a relationship
  4. Exploit it

Why Social Engineering Works

  • Human nature: our inborn instincts to trust and assist
  • Ignorance that SE even happens
  • Fear of failing to properly serve (customers or clients)
  • Greed: we respond instantly to rewards
  • Moral obligation: how we’ve been trained to behave

Techniques

  • Shoulder surfing
  • Dumpster diving
  • Tailgating
  • Piggybacking
  • Eavesdropping
  • Impersonation (pretexting)
  • Phishing

Phishing

Phishing

Spear phishing

Whaling

Pharming (redirection of web traffic)

Spimming (over IM)

Phishing Prevention

Netcraft Toolbar

PhishTank Toolbar

Sign-in seals

Mobile-Based Attacks

Malicious apps in app stores

Repackaged legitimate apps

Fake security apps (fake AV)

SMS “Smishing” – an IM to call a phone number

Watch a Pro in Action

SET (the Social Engineering Toolkit) is Included in Kali

Loi Liang Yang demonstrates credential harvesting:

And phishing:

https://www.youtube.com/watch?v=sZ8jlQPhbLU

Cybrary’s Free YouTube Course

BeEF Makes Things Simple

The Browser Exploitation Framework consists of a simple web server and a terminal-based tool that supplies you with an example link. There’s nothing else to do but email your best friend a harmless link back to your BeEF server.

https://github.com/beefproject/beef/wiki/Configuration

Check out the NullByte video, and especially note the link to a full tutorial in the Description:

 

Series Navigation<< [ Certified Ethical Hacker v10 ] :: [ Chapter 11 ] :: Cryptography[ Certified Ethical Hacker v10 ] :: [ Chapter 12 ] :: Physical Security >>