LoopyLuci Social Engineering and Phishing
Performing social engineering assessments — from phishing campaign setup through pretexting, vishing, physical security testing, and awareness training.
When to Use
- Testing employee security awareness
- Simulating phishing attacks for assessments
- Pretexting for physical access tests
- Building security awareness training
- Measuring organizational resilience to social engineering
Social Engineering Techniques
SOCIAL_ENG_TYPES = {
'phishing': 'Email-based — malicious link or attachment, credential harvesting, malware delivery',
'spear_phishing': 'Targeted phishing with OSINT-gathered personalization (name, role, interests)',
'whaling': 'Executive-targeted phishing (CEO, CFO, board) — high-value, careful pretext',
'vishing': 'Voice phishing — phone calls impersonating IT support, vendor, or executive',
'smishing': 'SMS phishing — text messages with urgent requests, fake package delivery',
'pretexting': 'Create fabricated scenario to extract information or gain access',
'tailgating': 'Follow authorized person through secured door (social compliance)',
}
class PhishingCampaign:
"""Manage phishing simulation campaigns."""
def __init__(self, name: str, target_list: List[str]):
self.name = name
self.targets = target_list
self.emails_sent = 0
self.clicks = 0
self.credentials_submitted = 0
def calculate_risk_score(self) -> Dict:
click_rate = self.clicks / max(self.emails_sent, 1) * 100
cred_rate = self.credentials_submitted / max(self.emails_sent, 1) * 100
return {
'click_rate': round(click_rate, 1),
'credential_rate': round(cred_rate, 1),
'risk_level': 'high' if click_rate > 20 else 'medium' if click_rate > 10 else 'low',
}
Verification Checklist
- Written authorization from target organization
- Phishing framework chosen (Gophish, SET, Modlishka)
- Landing page mirrors legitimate login (credential harvesting)
- Email headers configured (SPF, DKIM to improve deliverability)
- Tracking pixel/redirect for click measurement
- Campaign targets defined with opt-out list
- Pretexting scenario documented
- Vishing script prepared (if voice calls in scope)
- Physical testing methods defined (tailgating, badge cloning)
- Debrief with client after campaign (findings, recommendations)
- Sensitive data discarded after engagement