Social engineering — Concepts

Every technical vulnerability in the world is worth less than one employee who clicks. Social engineering is the art of getting what you want from a person — a password, a file, an action — without a technical exploit. It is also the module where ethics stops being theoretical.

The module where you can do real harm

A badly run campaign can cause a burnout, a breakdown of trust in the company, a legal complaint from an employee. This is not a scan that fails; it is a person crying at the office. This whole week runs under a written mandate signed by management, with a safeguard in place for the people targeted.

What you will be able to do after this lesson

• Name the six levers of influence (Cialdini) and know how to combine two or three.
• Tell the attack types apart: phishing, spear-phishing, whaling, vishing, smishing, baiting, pretexting, tailgating.
• Design a credible scenario without crossing the red lines.
• Understand why SET (Social Engineer Toolkit) and evilginx exist, and when to use each.
• Plan a post-click procedure that protects the employee and informs the client.
• Write a report that humiliates no one.

---

1. Why it works: your brain against you

The human brain processes about 11 million bits of information per second. Consciousness handles 40. The rest goes through shortcuts — cognitive biases. A skilled attacker routes their request through a shortcut, before consciousness gets involved.

The six levers were formalized by Robert Cialdini in 1984 in Influence. They still work.

Lever	How it sounds	Why it lands
Authority	"Management is asking."	The brain obeys authority figures quickly.
Urgency	"It must be approved before 5 p.m."	Under stress, the prefrontal cortex (the rational part) checks out.
Reciprocity	"We got you a free coffee, could you..."	A gift received triggers a need to give back.
Social proof	"Your colleagues have already replied."	We follow the group to avoid being wrong.
Scarcity	"Last spot, only 12 hours left."	What is rare is seen as valuable.
Liking / consistency	"We met at the conference, remember?"	We help those we like more readily.

A good scenario combines two or three. One is amateurish. Five is suspicious.

Example of a well-built stack:

Subject: [URGENT] New HR policy — sign before 5 p.m. today

Hi Marie,

Management (Authority) is asking us to have a new HR policy signed before end of day (Urgency). I already had 34 out of 42 colleagues (Social proof) approve it this morning; if you could do the same it would be a huge relief for the team (Liking).

Please use the link below, authentication is done with your usual account:

https://portail-rh-eclair.com/signature/2026-04

Best regards, Sophie Tremblay, HR

Authority + urgency + social proof + liking. Four levers. A typosquatted domain (portail-rh-eclair.com instead of boutique-eclair.ca). Few people resist.

---

2. The eight attack families

Not just phishing. Each family has its cost, its success rate, its risks.

Name	Channel	Targeting	Cost	Detection
Phishing	Mass email	Broad	Low	Anti-spam filters
Spear-phishing	Targeted email	1-10 people	Medium	Individual vigilance
Whaling	Email aimed at executives	1-3 people	High	Filters + vigilance
Vishing	Phone	Targeted	Medium (but scales poorly)	No automatic filter
Smishing	SMS	Broad	Low	Carrier filter (weak)
Baiting	Booby-trapped physical media	Opportunistic	Low	Vigilance
Pretexting	Invented pretext (physical + phone)	Targeted	Medium	Training
Tailgating	Following someone into a secure area	Opportunistic	Low	Physical controls

On a classic pentest: phishing + spear-phishing. The rest requires either a red team or a separate physical operation.

---

3. Phishing in detail

A serious phishing campaign is five artifacts:

1. The pretext (the scenario, the levers used).
2. The domain (typosquatted, homograph, or lookalike).
3. The email (HTML, tracking, headers).
4. The landing page (cloned portal that steals creds, or just a tracker).
5. The feedback (count of clicks, submissions, reports).

3.1. The domain

Three spelling techniques:

• Typosquatting: boutlque-eclair.ca (lowercase l instead of i).
• Unicode homograph: boutique-eclаir.ca (Cyrillic 'a' instead of the Latin 'a').
• Combosquatting: boutique-eclair-support.com, boutique-eclair-rh.com.

Engagement tip: buy the domain ~48 h before the campaign. Configure SPF, DKIM, DMARC for that domain, otherwise the client's filter will drop you before anyone reads it.

Tools:

• dnstwist — generates typosquatting/homograph variants for a given domain.
• evilurl — specialized in Unicode characters.

dnstwist -f json boutique-eclair.ca | jq '.[] | select(.dns_a != null) | .domain'

You will see the domains already registered (a potential pre-existing hostile typosquat).

3.2. Writing the email

Three rules:

• A single subject. "New HR policy", not "New HR policy + expense reports + schedules".
• A single link. Multiplying links lowers the click rate (paradox: it scatters attention).
• A realistic signature, copied from a real internal signature (gathered through OSINT).

Do not add deliberate spelling mistakes — the myth that "hackers make them to filter out the naive" applies to mass fraud campaigns, not a targeted pentest. An email with mistakes gets caught too fast by vigilant employees and by the anti-spam.

3.3. The cloned portal (credential harvester)

Two approaches:

Approach 1 — Static cloning (SET / Gophish). You copy the client's login page, you replace the form's action="" with your server. Simple, works for standard HTTP.

Approach 2 — Reverse proxy (evilginx2, Modlishka). You run a transparent proxy between the real portal and the victim. The email contains the URL of your proxy. The victim types their password and their MFA code. Your proxy relays and records the session cookies — so it bypasses MFA. This is the modern technique.

Caution: evilginx2 must be handled with care. On a client pentest, actually capturing passwords and cookies is very intrusive — many RoEs forbid it, preferring a simple credential harvester that redirects to an awareness page without storing the password.

3.4. The landing page — two schools

School 1 — Credential theft. If the RoE allows it, you capture. Each captured credential is tagged and encrypted, and the employee is sent to a page that says "this was a simulation, your password was not used, go change it as a precaution".

School 2 — Simple tracker. You only record the click (URL, IP, User-Agent, time), never showing a form. Enough to measure a click rate with no ethical risk.

On 90% of engagements, choose school 2. It gives 80% of the information for 10% of the risk.

3.5. The feedback: what we measure

• Open rate — % of emails opened (pixel tracking).
• Click rate — % who clicked the link.
• Submission rate (school 1 only) — % who gave their password.
• Report rate — % who reported the email to the SOC.

The best indicator for the client is not the click rate — it is the report rate. A report rate above 30% says the training works. At 0%, the company does not know how to protect itself.

---

4. Vishing and pretexting

Often out of scope on a classic pentest, essential in red team work.

Vishing: you call an employee, you pose as IT / HR / the CEO. You ask for something false.

Pretexting: you build a complete pretext — a resume sent in, a supplier visiting, a telecom technician. Often physical and phone combined.

Example vishing scenario:

"Hello, this is Antoine from IT support. We see an issue on your account; you will receive an email in a minute to approve an MFA change. Please confirm the code you receive, it is for verification."

Levers: authority (IT support) + urgency + reciprocity ("I'm helping you"). Works in a majority of cases without dedicated training.

On a pentest, prepare a complete 2-page script. Every question anticipated. An exit route if the employee resists.

---

5. Baiting — physical

A booby-trapped USB left in the parking lot, the cafeteria, the restrooms. An employee picks it up, plugs it in, a payload runs (auto-run is disabled today, but a well-named .lnk shortcut does the job).

Reference statistic (2016 Google study): 48% of USB drives left in a university parking lot were picked up and plugged in.

Tool: Hak5's Rubber Ducky (a USB HID that poses as a keyboard and types commands at machine speed).

Ethical frame: baiting requires an explicit physical mandate. The target must cover "objects left on the premises" in the RoE.

---

6. The ethical red line — non-negotiable

The pentester is an attacker under mandate. They are not a torturer. The six rules below are not up for discussion:

1. No campaign without a written mandate signed by management. The HR contact knows the schedule.
2. No dangerous emotional levers:
   • Bereavement ("your loved one").
   • Health ("your medical results").
   • Family situation ("divorce", "children").
3. No engineering against vulnerable people: on sick leave, in a probation period, an intern under 18.
4. No real storage of passwords. If you capture them, they are hashed on the fly and never stored in clear text.
5. Mandatory debriefing: phished people receive an awareness page with no stigma. The report names no individual.
6. A withdrawal window. If an employee reports the email, do not send it again. An employee who reports is a trained employee.

A pentester who breaks one of these rules is not "more offensive", they are irresponsible. They will not be called back.

---

7. The tools

Tool	What it does	When to use it
SET (Social Engineer Toolkit)	Console menu, classic scenarios (credential harvester, booby-trapped PDF).	Teaching lab. In production, outdated.
Gophish	Web platform, campaign orchestration, statistics.	Structured client engagements.
King Phisher	Similar to Gophish, older but robust.	Alternative.
evilginx2	MFA-bypass reverse proxy.	Red team engagements with a permissive RoE.
Modlishka	Same idea, lighter.	Same.
BeEF (Browser Exploitation Framework)	JS hook injected into the victim's browser, control panel.	Demonstrating post-click impact in training.
Rubber Ducky / Bash Bunny	HID device for physical attacks.	Scoped baiting.
dnstwist / evilurl	Generating lookalike domains.	Campaign preparation.

The standard duo today: Gophish for orchestration + evilginx2 for MFA bypass if authorized.

---

8. What the client will ask you to measure

• Click rate by department, tenure bracket, channel (office / remote).
• Time to report — how long between the send and the first report to the SOC.
• Filter effectiveness — how many emails were blocked by the anti-phishing before delivery.
• Post-click behavior — how many went on to enter their credentials, how many closed the page.

The report must answer these four questions with charts. A single line "45% clicked" with no context is useless.

---

9. The mistakes that do harm

• Naming the clickers in the report. Forbidden. Always aggregated.
• Using a real HR document in the email. The client will complain that you stole their intellectual property.
• Targeting the CEO without their prior agreement. Even if they are a natural whaling target, you need their opt-in.
• Sending 8 waves. Three maximum. After that, you measure nothing anymore, you just annoy.
• Not planning an awareness page. The employee who clicks feels betrayed. The program dies.
• Sending outside business hours. An email at 11 p.m. reaches employees at rest, not your real target.

---

10. What to remember

• Social engineering exploits cognitive shortcuts, not stupidity. No one is immune.
• Six levers, to combine two or three at a time.
• Eight families of attack, but phishing and spear-phishing dominate in a pentest.
• The real indicator: the report rate, not the click rate.
• Six ethical rules, non-negotiable. You follow them or you change careers.
• A phishing report humiliates no one.

Next lesson: we build a complete campaign in an isolated lab — Gophish, a simulated domain, a well-written email, a page that redirects to awareness.