Practical Social Engineering: A Primer for the Ethical Hacker

Description

Social engineering is an attack technique that leverages psychology, deception, and publicly available information to breach the defenses of a human target in order to gain access to an asset. Social engineering is key to the effectiveness of any computer security professional.Readers learn how to leverage human psychology and publicly available information to attack a target. The book includes sections on how to evade detection, spear phish, generate reports, and protect victims to ensure their well-being. Readers learn how to collect information about a target and how to exploit that information to make their attacks more effective. They also learn how to defend themselves or their workplace against social engineering attacks. Case studies throughout offer poignant examples such as how the author was able to piece together the details of a person's life simply by gathering details from an overheard restaurant conversation. Gray walks readers through the sometimes difficult decision making process that every ethical social engineer must go through when implementing a phishing engagement including how to decide whether to do things manually or use automated tools; even how to set up their web server and built other technical tools necessary to succeed. PART I: THE BASICS 1: WHAT IS SOCIAL ENGINEERING? 2: ETHICAL CONSIDERATIONS IN SOCIAL ENGINEERING PART II: OFFENSIVE SOCIAL ENGINEERING 3: PREPARING FOR AN ATTACK 4: GATHERING BUSINESS OSINT 5: SOCIAL MEDIA AND PUBLIC DOCUMENTS 6: GATHERING OSINT ABOUT PEOPLE 7: PHISHING 8: CLONING A LANDING PAGE 9: DETECTION, MEASUREMENT, AND REPORTING PART III: DEFENDING AGAINST SOCIAL ENGINEERING 10: PROACTIVE DEFENSE TECHNIQUES 11: TECHNICAL EMAIL CONTROLS 12: PRODUCING THREAT INTELLIGENCE A: SCOPING WORKSHEET B: REPORTING TEMPLATE C: INFORMATION-GATHERING WORKSHEET D: PRETEXTING SAMPLE E: EXERCISES TO IMPROVE YOUR SOCIAL ENGINEERING