+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Social Engineering (https://sinister.li/Forum-Social-Engineering)
+--- Thread: Social Engineering for Beginners (/Thread-Social-Engineering-for-Beginners--28797)
Pages:
1
2
Social Engineering for Beginners - APPLEZ - 07-28-2014
What is "Social Engineering?"
According to the dictionary:
Quote:The application of sociological principles to specific social problems.
The definition more "hacker" related is manipulating humans to get what you want. Even such things as passwords, account numbers, ect.
In order to do that, you might want to provoke certain emotions, such as fear, lust, trust, ect.
This diagram may help:
![[Image: 2jab7yq.png]](http://i49.tinypic.com/2jab7yq.png)
Forms of Social Engineering
Here are some examples:
Impersonation is one of the most common social engineering techniques and it takes many forms. Impersonation can occur in person, over the phone or on-line. There are basically seven scenarios where impersonation is used to create a successful social engineering attack:
The overly helpful help desk. A Social Engineer calls the help desk pretending to be an employee. They claim to have forgotten their password and ask the help desk to reset it or give it to them. The Social Engineer will often know names of employees in the organization he is trying to penetrate, and will have learn as much as possible about the person he is trying to impersonate. Help desks are one of the most frequent targets of social Engineering attempts for a reason. They are trained to be helpful to users and will often give out passwords or other important network information without thoroughly verifying the identity of the caller.
Third-party Authorization. The Social Engineer may have obtained the name of someone in the organization who has the authority to grant access to information. They may call the target and claim that the Superintendent, Mr. Big, requested that information be provided.
This attack is particularly effective if the attacker is aware that Mr. Big is out of town. He may say something like, "I spoke with Mr. Big late last week before he went on vacation and he said that you would be able to provide me with this information in his absence."
Tech Support. The Social Engineer may pretend to be technical support from one of the organization’s software vendors or contractors to gain information. The attacker explains that he is troubleshooting a network problem and has narrowed the problem to a certain computer. He claims to need a user ID and password from that computer to finish tracing the problem. Unless the user has been properly educated in security practices, they will be likely give the “trouble-shooter” the information requested.
source(s): http://www.npdn.org/social_engineering_types
Blackmail and Ewhoring
Here is a simple blackmail scenario and it works!The overly helpful help desk. A Social Engineer calls the help desk pretending to be an employee. They claim to have forgotten their password and ask the help desk to reset it or give it to them. The Social Engineer will often know names of employees in the organization he is trying to penetrate, and will have learn as much as possible about the person he is trying to impersonate. Help desks are one of the most frequent targets of social Engineering attempts for a reason. They are trained to be helpful to users and will often give out passwords or other important network information without thoroughly verifying the identity of the caller.
Third-party Authorization. The Social Engineer may have obtained the name of someone in the organization who has the authority to grant access to information. They may call the target and claim that the Superintendent, Mr. Big, requested that information be provided.
This attack is particularly effective if the attacker is aware that Mr. Big is out of town. He may say something like, "I spoke with Mr. Big late last week before he went on vacation and he said that you would be able to provide me with this information in his absence."
Tech Support. The Social Engineer may pretend to be technical support from one of the organization’s software vendors or contractors to gain information. The attacker explains that he is troubleshooting a network problem and has narrowed the problem to a certain computer. He claims to need a user ID and password from that computer to finish tracing the problem. Unless the user has been properly educated in security practices, they will be likely give the “trouble-shooter” the information requested.
source(s): http://www.npdn.org/social_engineering_types
Blackmail and Ewhoring
Over skype, minecraft, phone, any form of communication.
Www
You can use this method to hack their facebook account. not guaranteed.
IMPORTANT INFO WILL BE IN BOLD
Also always pose a a female. you dont know how powerful lust is
Hacker: hi
victim: hey
hacker: so whats up?
victim: nothing much
hacker: so do you have any pets?
victim: oh yes i have 2 cats. ones name is Vanilla and the other Baby. I love them <3(Security question answers/password???)
hacker: haha i have a cat too. he is fat lol
victim: haha
hacker: so are you single?
victim: yah i broke up with my girlfriend a week ago :/
hacker: oh im sorry
victim: its ok but i feel kinda lonely...
hacker: i feel that way too
victim:
hacker: hey can i have your email? mines blahblah@Gmail.com
victim: sure mines blahblahblahBLAH@yahoo.com
(THIS IS WHERE YOU GO HERE AND LOOK IT UP! http://www.pipl.com/ )
hacker: so yah i was gona ask you something...
victim: yes?
hacker: i was wondering if you wanted to buy some "pictures" from me...
victim: ummm....
hacker: i really like you <3 PROVOKE THE EMOTION OF LUST!!!!!
victim: uh sure ok
Wwwhacker: ok let me upload them <3
victim: kk
Wait a few minutes and say this:
hacker: kk so give me $25 or I will show this conversation to your mother and girlfriend
victim: you dont know who they are you bitch...
hacker: mikalya and allision?
victim: how do you know...
hacker: i have hacked your facebook and I will post this convo if you dont
victim: fuck you ok
hacker: waiting to be sent
victim: sent
hacker: goodbye
THIS IS KINDA ILLEGAL SO USE WITH CARE AND WHITEHAT ONLY!!
fuck the law we dont care
fuck the law we dont care
TIP: might also wanna use proxys and try to keep the victim from callling to cops.
That was only a basic scenario so find an online chat room or find a creative server on minecraft (VERY easy to do this in) and practice. this may not work all the time but it should work most of the time
Liked that tutorial? it took an hour to write. Maybe you can take 15 seconds to click the Thanks button?
Sources:
https://www.google.com/
RE: Social Engineering for Beginners - ImmNinjaxD - 07-28-2014
Nice copy pasta overload (;
Yeah I know you wrote this a while back, still a nice post.
RE: Social Engineering for Beginners - APPLEZ - 07-28-2014
(07-28-2014, 07:34 PM)ImmNinjaxD (⌐■_■) Wrote: Nice copy pasta overload (;
Yeah I know you wrote this a while back, still a nice post.
Yeah, thought I might as well put it here, since I plan on staying and continuing this thread
RE: Social Engineering for Beginners - Oni - 07-28-2014
![[Image: Opso81J.png]](https://i.imgur.com/Opso81J.png)
Lolwut.
RE: Social Engineering for Beginners - MiS - 07-28-2014
@Cressi would probably love this thread as soon as she saw it.
RE: Social Engineering for Beginners - cr33pyguy - 07-28-2014
(07-28-2014, 08:39 PM)MiS Wrote: @Cressi would probably love this thread as soon as she saw it.
yeah she would.
I know I did.
Thanks for the tut OP.
RE: Social Engineering for Beginners - Cressi - 07-28-2014
(07-28-2014, 08:39 PM)MiS Wrote: @Cressi would probably love this thread as soon as she saw it.
I would, and I did indeed ^^
OP, awesome thread; impressive summary. I've been thinking about making something along these lines, but you certainly made it better than I ever would've ^^
RE: Social Engineering for Beginners - GetR34P3D - 07-29-2014
Since @Cressi liked it, I got to try this methode. Hue hue
RE: Social Engineering for Beginners - Cressi - 08-01-2014
(07-29-2014, 02:32 AM)GetR34P3D Wrote: Since @Cressi liked it, I got to try this method. Hue hue
Although it's not really a set method, you should definitely have a go ^^
RE: Social Engineering for Beginners - GetR34P3D - 08-01-2014
(08-01-2014, 03:38 PM)Cressi Wrote: Although it's not really a set method, you should definitely have a go ^^
I've done Ewhoring/blackmailing for two days now (says 3 days, but the first day was just an hour).
I haven't done this full time, just some hours each night.
This is what I made so far: http://i.gyazo.com/b1f6bf6c2604958e51c9712cfd662200.png