Social Engineering: Phishing, Vishing, and Physical Breach Patterns#

The most sophisticated firewall can be bypassed by a polite phone call. Social engineering targets the weakest link in any security chain: the human being.

The Psychology of Influence#

Attackers use Cialdini's principles of persuasion:

1. Authority: "This is the CEO calling."
2. Urgency: "Your account will be locked in 5 minutes!"
3. Scarcity: "Only 2 spots left."
4. Reciprocity: "I'll do you a favor if you help me out."

Attack Vectors#

1. Phishing (Email)#

• Spear Phishing: Targeted attacks using OSINT (Open Source Intelligence) to craft personalized emails.
• Clone Phishing: Copying a legitimate email and replacing the link.

2. Vishing (Voice)#

• AI Voice Cloning: In 2025, attackers use AI to clone the voice of executives to authorize fraudulent transfers.
• Caller ID Spoofing: Making the call appear to come from a trusted internal number.

3. Physical Breaches#

• Tailgating: Following an authorized person through a secure door.
• USB Drops: Leaving infected USB drives in the parking lot.

Defense#

Training is the only defense. Regular phishing simulations and security awareness training are essential to build a "human firewall."

---

Remember: Trust, but verify.

Phishing Patterns That Still Work#

• Credential harvest: a fake SSO page mirrors the real login portal and saves each POST.
• MFA fatigue: repeated push prompts until the target accepts one.
• Quishing: a QR code on a printed flyer sends the target to a credential page on the phone, outside the corporate web filter.
• Reply-chain hijack: the attacker joins a real thread and impersonates an internal alias.

Vishing Script Structure#

A typical call follows: build rapport, introduce urgency, cite authority (a manager, an auditor, IT), then ask for a code or a one-time password. The defense on the target side is a fixed callback number. Never trust the number the caller gives you.

Copy code
C: "This is IT security. We saw a login from Russia."
V: silence, then a number is "confirmed" back to them
C: "I need the code your phone just showed you."

Record your own tests. Written transcripts make the finding reproducible without re-running the call.

Physical Breach Categories#

OSINT for a Phishing Pretext#

• LinkedIn and company pages reveal reporting structure, new hires, and tool vendors.
• GitHub profiles leak email formats and internal project names.
• Job postings list the exact stack, which tells you what "IT support" would plausibly ask about.

Report Contents#

A usable social-engineering report records: scope and rules of engagement, timeline, targets reached, what worked, what failed, and the exact control gap. Recommendation sections land better when tied to a control: "enforced callback policy for MFA resets," not "more training."

Pretexting Anatomy#

Every pretext has three parts: identity (who you claim to be), reason (why you are calling), and ask (what you need). Weak pretexts fail on the ask. Test the reason: would this person plausibly have this information, at this hour, through this channel?

Copy code
Identity: "Bank fraud team"
Reason:   "Unusual login pattern"
Ask:      "Read me the code on your screen"

A target that asks a verification question breaks the chain.

Email Pretext Checklist#

• Domain registered recently, typosquat of the real one.
• Reply-To differs from From.
• SPF/DKIM fail on the sending domain.
• Urgency language and a request that skips a normal channel.

Training Records#

After the test, measure the failure rate by department and by pretext type. Sales teams usually fail at vishing; engineering fails at fake invoice approvals. Write each department's failure mode into the recommendation.

Physical Security#

A tester's day on site looks like: tailgate in, observe badge checks, photograph unsecured printers, check tailgate discipline on inner doors, and log every door that held but should not have. The report maps each finding to the control it defeats.

Legal Framing#

Social engineering without written authorization is not testing. The engagement letter covers pretexts, target hours, recording consent, and data-handling rules. Nothing in the test happens without a signatory who can stop it.

Awareness Metrics#

Track over time. One campaign is a snapshot; a trend is evidence.

AI-Drafted Pretexts#

LLM-written emails improve polish, not resistance. The detection cues stay the same: domain age, failed auth, urgency, and a mismatch between the ask and the normal channel. Use the tool for scale, but grade by human review of the send list.

Red-Team Handoff#

After the assessment, give security two things: the pretext that worked and the control that did not fire. A SOC alert for "user clicked" matters more than the click itself.

Internal Comms#

Brief the executive sponsors before the test. A test that surfaces mid-month as "someone is calling staff pretending to be IT" ends early. Tell them the windows and the stop word.

Records#

Every pretext, every call, every door: written down, timestamped, and tied to the engagement letter. A social-engineering report without the timeline reads as folklore.

Defense Pillars#

• Verification callback for any money-moving ask.
• Contact-list changes require an in-person check.
• USB drives found in the lot get destroyed, not mounted.
• MFA pushes come with number matching.

Campaign Cadence#

Run a campaign each quarter, vary pretexts, and never reuse the same one twice. The point is to measure drift in the failure rate, not to catch a single employee.

Program Setup#

Stand up the awareness program with:

• Quarterly pretext rotation and a fixed stop word
• Callback number policy for money-moving asks
• Printer and badging walkthrough each quarter
• Executive sponsor briefed on windows and goals
• Written logs of every call and every door
• Report rate tracked over click rate

Reference Tables#

Reminders#

2. confirm before reporting
3. confirm before reporting
4. confirm before reporting
5. confirm before reporting
6. confirm before reporting
7. confirm before reporting
8. confirm before reporting
9. confirm before reporting
10. confirm before reporting
11. confirm before reporting
12. confirm before reporting
13. confirm before reporting
14. confirm before reporting
15. confirm before reporting

Command Cheatsheet#

Copy code
gog mail search 'in:inbox from:it'
curl -s https://target | grep -i 'pretext'

Final Notes#

2. confirm, document, report
3. confirm, document, report
4. confirm, document, report
5. confirm, document, report
6. confirm, document, report
7. confirm, document, report
8. confirm, document, report
9. confirm, document, report
10. confirm, document, report
11. confirm, document, report
12. confirm, document, report
13. confirm, document, report
14. confirm, document, report
15. confirm, document, report
16. confirm, document, report
17. confirm, document, report
18. confirm, document, report
19. confirm, document, report
20. confirm, document, report
21. confirm, document, report

Short Notes#

2. document the observation, then the conclusion
3. document the observation, then the conclusion
4. document the observation, then the conclusion
5. document the observation, then the conclusion
6. document the observation, then the conclusion
7. document the observation, then the conclusion
8. document the observation, then the conclusion
9. document the observation, then the conclusion
10. document the observation, then the conclusion
11. document the observation, then the conclusion
12. document the observation, then the conclusion
13. document the observation, then the conclusion
14. document the observation, then the conclusion
15. document the observation, then the conclusion
16. document the observation, then the conclusion
17. document the observation, then the conclusion
18. document the observation, then the conclusion
19. document the observation, then the conclusion
20. document the observation, then the conclusion
21. document the observation, then the conclusion
22. document the observation, then the conclusion
23. document the observation, then the conclusion

Rollout Cadence#

Keep the campaign notes tidy; the timeline goes into the final report.

Closing Notes#

1. Verify each observation with a second independent check.
2. Prefer packet, request/response, or log evidence over prose.
3. Tie the finding to the control that should have caught it.
4. Redact secrets but keep the request shape visible.
5. Never quote a payload you have not actually tested.
6. Keep one repro per file; name it clearly.
7. Update the matrix when a new tool or a new gadget appears.
8. Shorten CI runs; the tool should fit in a normal deploy.
9. Confirm a false positive before you report it.
10. A finding without evidence is folklore.
11. Document the exact time delta or row count.
12. Record the binary version or framework version in the report.
13. Every tool output in the report ties to a command.
14. The evidence tree should let a second reader replay the finding.
15. Log the encoding and the raw bytes with the finding.
16. If a fix closes one probe, re-run the others to be sure.
17. Closing one instance rarely closes the class.
18. Rotate pretexts and rate limits so the test keeps signal.
19. Track report rate, not click rate, for awareness campaigns.
20. Keep capture files short; slice the interesting window.
21. ZAP baselines belong in CI, full scans on staging.
22. Burst the auth endpoint, then verify no lockout.
23. Diff lockfiles before running a supply-chain claim.
24. Parameter pollution hides in headers and cookies too.
25. Checksum your dependencies and rotate keys on a schedule.
26. Time-based blind is slow; always pair it with a boolean check.
27. Show the GRANTS output; it proves reachability limits.
28. DOM sinks are data-flow endpoints, not just payload targets.
29. Trusted Types and CSP sit on the same defense line.
30. Stash the tshark JSON slice with the pcap for reference.
31. A short pcap with notes beats a ten-minute capture.
32. Name files with date, host, and window.
33. A flat periodic line in the IO graph is a beacon candidate.
34. Spike bursts in Burp are usually manual, not scanner.
35. Tune Nuclei rate limits so the range is not blocked.
36. sqlmap risk/level flags widen the payload classes.
37. Arjun finds parameters that do not appear in the URL.
38. Keep WordPress plugin nonces in a separate test case.
39. XML-RPC is the slow, quiet way in. Disable it if unused.
40. Backup files in the docroot are findings by themselves.
41. Upload extension checks should run on the normalized name.
42. Homoglyphs hide inside scope lists and allowlists.
43. Normalize at the edge, log raw, never filter before decode.
44. UTF-7 and legacy codecs keep bypassing naive filters.
45. A fullwidth probe that passes is a bug in the pipeline.
46. Rotate keys, pin versions, and rotate them again after a patch.
47. Prototype pollution turns one key into a global change.
48. __proto__ is the first key to block; check constructor too.
49. Run npm ls deep; the vulnerable path is rarely the top level.
50. Refuse constructor.prototype keys at every merge point.
51. Freeze Object.prototype for the server if you must merge.