Skip to main content

Week 6 — Social engineering

Learning objectives​

  • Understand the psychological levers exploited by an attacker.
  • Build a realistic phishing campaign, within an authorized framework.
  • Use SET (Social Engineer Toolkit) and BeEF (Browser Exploitation Framework) without crossing the red line.

The six influence levers​

Social engineering leans on cognitive mechanisms identified by Cialdini:

  • Authority ("Management is asking for it").
  • Urgency ("Within 30 minutes").
  • Reciprocity ("We offered you X, can you...").
  • Social proof ("Your colleagues have already signed off").
  • Scarcity ("Last chance").
  • Liking / consistency.

An effective scenario combines two or three, never one alone.

The ethical framework — Non-negotiable​

  • No campaign without a written mandate signed by management.
  • No message targeting a person's health, bereavement or family situation.
  • Mandatory debrief for people who were phished, without individual stigma.
  • Data collected is deleted at the end of the mandate, upon request.

SET and BeEF​

  • SET automates classic scenarios: portal cloning, booby-trapped PDF, credential harvester vector. Useful in a lab, to be handled with care against real staff.
  • BeEF injects a JavaScript hook browser-side to explore what an attacker can do after a click. Serves to demonstrate impact, not to spy.
# Start BeEF locally (lab only).
sudo beef-xss

Lab 1 — Due this week​

Deliverable expected, based on the reconnaissance started in week 4:

  • Map of the lab network (hosts, services, versions).
  • Three prioritized vulnerabilities with justification (CVSS + EPSS + KEV).
  • An attack plan for each, without exploitation yet.

Format: Markdown or PDF, about 6 to 10 pages. Submit through the virtual classroom.