martes, 30 de abril de 2013

Social Engineering Framework

This is a work in progress, but we feel it will contain and DOES contain some of the hottest, newest and most innovative information on the scene today.

CAUTION: This knowledge is NOT intended to teach you how to trick people, lie to others, or gain valuable items of others. Trying to use this information without the proper practice and without proper professionalism will usually backfire.


PART I: GENERAL DISCUSSION

I. Social Engineering Defined
II. Categories of Social Engineers
A. Hackers
B. Penetration Testers
C. Spies or Espionage
D. Identity Thieves
E. Disgruntled Employees
F. Information Brokers
G. Scam Artists
H. Executive Recruiters
I. Sales People
J. Governments
K. Everyday People
III. Why Attackers Might Use Social Engineering
IV. Typical Goals
V. The Attack Cycle
VI. Common Attacks
A. Customer Service
B. Tech Support
C. Delivery Person
D. Phone
VII. Real World Examples
A. Con Men
B. Phishing
C. Politicians
D. Crime Victims

PART II: INFORMATION GATHERING

I. How to Gather Information
A. Research
B. Dumpster Diving
II. Sources
A. Traditional
B. Non-Traditional
III. Communication Models

PART III: ELICITATION

I. Definition
II. Goals
III. Preloading
IV. Becoming a Successful Elicitor

PART IV: PRETEXTING

I. Definition
II. Principles and Planning
III. Successful Pretexting

PART V: PSYCHOLOGICAL PRINCIPLES

I. Modes of Thinking
II. Eye Cues
III. Micro-Expressions
IV. Neuro-Linguistic Programming (NLP)
A. Voice in NLP
V. The Human Buffer Overflow
VI. Interview and Interrogation
VII. Instant Rapport

PART VI: INFLUENCING OTHERS

I. Influence Tactics
A. Reciprocation
1. Obligation
2. Concession
B. Scarcity
C. Authority
D. Commitment and Consistency
E. Liking
F. Consensus or Social Proof
II. Framing
III. Manipulation of Incentives

PART VII: SOCIAL ENGINEERING TOOLS

I. Physical
A. Lock Picking and Shims
B. Cameras
C. GPS Tracker
D. Pen Recorder
E. RF Bug Kits
II. Computer Based
A. Maltego
B. Maltego Mesh
C. Social Engineer Toolkit (SET)
D. Common User Passwords Profiler (CUPP)
E. Who's Your Daddy Password Profiler (WYD)
III. Phone
A. Caller ID Spoofing

PART VIII: SOCIAL ENGINEERING EXTRAS AND RESOURCES

I. Social-Engineer.org In The Media
II. Fox News: Chris Hadnagy
III. Social Engineering Books
IV. Social Engineering Media Archives