Saltar al contenido principal

Social engineering — Hands-on lab

You build your own campaign in the lab. A new pretext, a new angle. Three possible variations — you pick one. At the end, an aggregated report + a separate HR-only list.

Budget: 3 h.

Deliverable: ~/labs/semaine-06/rapport/phishing.md (aggregated) + ~/labs/semaine-06/drh-prive/nominatif.md (encrypted folder, contents not shared without authorization).

Strict frame

You send no email to a real address. The lab uses boutique-eclair.local with 5 fictional accounts — that is the only setting for this lab.

Prerequisites​

  • Gophish installed and working in the lab (see the walkthrough).
  • Lab mail server (10.10.10.40) with 5 fictional accounts.
  • Typosquatted domain (.local) resolvable in the lab.

Step 1 — Choose the pretext (10 min)​

Take one of the three variations. Each brings a different angle.

Variation A — The fake IT support​

  • Fabricated context: the company is migrating to Microsoft 365. Employees must "re-authenticate" their account.
  • Levers: authority (IT) + urgency + social proof.
  • Landing page: clone of the Microsoft 365 login page (school 1 with capture, or school 2 with awareness).

Variation B — The event invitation​

  • Fabricated context: the CEO invites all employees to a "quarterly review" over video call, RSVP required.
  • Levers: authority (CEO) + reciprocity ("welcome drinks provided") + scarcity ("limited seats").
  • Landing page: a registration form asking for name, position, email, password (school 1) or just a redirect (school 2).

Variation C — The fake invoice​

  • Fabricated context: a regular supplier sends an invoice to download.
  • Targets: accountant + admin assistant (spear targeting).
  • Levers: authority (known supplier) + consistency ("as usual").
  • Landing page: a PDF (school 1: the PDF runs a macro in the lab) or a tracker (school 2).

Document your choice at the top of the report:

## Chosen variation: <A/B/C>
## Reason: <in one sentence>

Step 2 — Prepare the artifacts (60 min)​

2.1. Domain​

Generate several candidates:

dnstwist -f json boutique-eclair.ca | jq -r '.[] | .domain' > candidats.txt
head candidats.txt

Choose the one that fits the pretext:

  • Variation A: boutique-eclair-support.local or boutique-eclair-o365.local.
  • Variation B: boutique-eclair-events.local or boutique-eclair-video.local.
  • Variation C: <supplier-name>-billing.local.

Add it to the /etc/hosts of the target mail server.

2.2. Email​

Write your email. Constraints:

  • 150 to 250 words maximum.
  • At least 3 levers stacked (no more than 4).
  • A realistic signature — reuse a name and signature seen in OSINT (for the demo, make one up).
  • A single link.
  • No attachment (except variation C, if allowed by your lab RoE).

Save it in ~/labs/semaine-06/mail-source.html.

2.3. Landing page​

School 2 is mandatory for this lab — you do not capture a password. The landing page contains only an empty form that:

  1. Counts the submission.
  2. Redirects to sensibilisation.html.

Adapt the awareness page to your pretext:

<h1>You were just caught by a simulation</h1>
<p>The clues that should have alerted you:</p>
<ul>
  <li>The sender domain: ...</li>
  <li>The lever used: ...</li>
  <li>The unusual wording: ...</li>
</ul>
<p>This email did not come from <b>boutique-eclair.ca</b>.</p>

Save sensibilisation.html on the Gophish server.

Step 3 — Configure Gophish (30 min)​

Recreate, in the interface:

  • Sending Profile: Lab-SMTP-<your-variation>.
  • Email Template: name <Variation>-<short-subject>.
  • Landing Page: Import Site if you clone, or static HTML.
  • Group: reuse Lab-cibles-5 or create a new CSV with different names.
  • Campaign: Semaine 6 - Atelier - <Variation>.

Do not launch yet.

Step 4 — Simulate the behaviors and launch (30 min)​

Assign five behaviors to the five targets. Write them in ~/labs/semaine-06/plan-simulation.md before launching:

| Target | Simulated behavior |
| ------ | ------------------ |
| Alice | opens + clicks                 |
| Bob   | opens + ignores                |
| Carla | does nothing                   |
| David | opens + clicks + submits       |
| Emma  | reports immediately            |

Launch the campaign, then reproduce each behavior in the Roundcube webmail (as in the walkthrough).

Step 5 — Analyze (30 min)​

Wait 15 minutes. Open the Gophish dashboard. Pull down:

  • Aggregated metrics (5 figures: sent, opened, clicked, submitted, reported).
  • Full timeline (exported to CSV).

Compare:

  • The click rate against what is expected (25-45% on average in untargeted campaigns).
  • The submission rate (school 2: always < the click rate).
  • The time to report — was Emma fast?

Step 6 — Write the two deliverables (30 min)​

Deliverable 1 — rapport/phishing.md (aggregated, shareable)​

Fixed structure:

# Phishing campaign — Aggregated report — <date>

## 1. Objective
## 2. Frame (authorization, window, scoped targets)
## 3. Pretext used (2-3 lines)
## 4. Aggregated results (table of the 5 metrics)
## 5. Analysis (3-5 short paragraphs)
## 6. Recommendations (3 items maximum)
## 7. Appendices (paths to the artifacts)

No individual names. None.

Deliverable 2 — drh-prive/nominatif.md (HR-restricted)​

# Nominative list — CONFIDENTIAL HR — <date>

This list is intended for HR alone, to organize
individual training. It may not be shared.

| Name | Behavior | Recommended follow-up |
| --- | --- | --- |
| Alice Martin | Opened + clicked | 5-min reminder |
| David Poulin | Opened + clicked + submitted | 30-min individual training |
| Emma Kadri  | Reported immediately     | Well done, recognize it |
| Bob Nguyen  | Opened + ignored         | Nothing to report |
| Carla Ross  | No action                | Nothing to report |

This file goes into an encrypted folder (~/labs/semaine-06/drh-prive/ with an age or a gpg on top) and is not in the main report.

Self-assessment checklist​

  • One variation chosen and justified.
  • A typosquatted domain consistent with the pretext.
  • An email of 150-250 words with at least 3 levers.
  • A school-2 landing page (no real password capture).
  • An awareness page adapted to the pretext.
  • A Gophish campaign launched, 5 emails sent.
  • Five simulated behaviors covering: click, submit, report, ignore.
  • An aggregated report with no individual name.
  • A separate nominative list, marked confidential HR.
  • Three concrete recommendations in the aggregated report.

Optional extension — Vishing as a script​

If you still have energy: write a 2-page vishing script for the same target. Goal: obtain a password over the phone by posing as IT support.

Script structure:

  1. Opening: name, department, friendly tone.
  2. Pretext: "We see an issue on your account."
  3. Reciprocity lever: "I'm helping you fix it."
  4. Ask: "Can you confirm the code you are about to receive?"
  5. Exit routes: a response if the employee resists, a response if the employee offers to hang up and call back.

You call no one. You write, you rehearse it out loud with a peer. That is the exercise.

What usually gets you stuck​

SymptomCauseFix
Gophish does not sendSMTP misconfiguredTest swaks on the command line.
The email lands in spam in RoundcubeSPF not configuredIn the lab, ignore it. In production, configure it.
The landing page does not displayURL unreachableCheck that Gophish listens on 0.0.0.0:80.
The tracker does not count opensRoundcube blocks imagesEnable image loading in the webmail.
Emma's report does not come throughNo webhookNormal in the lab. In production, configure it on the SOC side.

What you take away from this lab​

  • The discipline of preparing an end-to-end campaign, with artifacts and a frame.
  • The reflex to separate the aggregated and the nominative.
  • The habit of not humiliating — the nominative stays with HR.
  • A Gophish template you can replay on any future engagement.

After this lab and the quiz, module 6 ends with the submission of Assignment 1 — the full reconnaissance from weeks 3-5. See the course index for the details.