Chapter 14: Performing Client-Side Attacks – Social Engineering

While many cybersecurity professionals focus on implementing security appliances and solutions to prevent cyberattacks and threats, they often lack focus on protecting the minds of employees. The human mind does not have cybersecurity solutions to protect it from psychological manipulation, and this creates the most vulnerable aspect within any organization. Threat actors and penetration testers often trick employees into performing an action or revealing confidential information that helps perform a cyberattack and compromise an organization.

During this chapter, you will learn the fundamentals and key concepts that are used by threat actors during their penetration testing exercises to trick and manipulate their targets into revealing sensitive information and even performing a task. You will also discover the characteristics of various types of social engineering attacks and how to develop an awareness of...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following software requirement:

• Kali Linux 2021.2 – https://www.kali.org/get-kali/

Fundamentals of social engineering

Organizations invest a lot into their cybersecurity solutions, from security appliances to applications and developing cybersecurity teams of professionals to defend and safeguard the assets within their company. Threat actors have realized many organizations are already implementing Defense in Depth (DiD), which provides a multi-layered approach to implementing security solutions to reduce the attack surface of the organization and its assets. With a DiD approach, organizations do not rely on a single layer of protection, whether it's using a Next-Generation Firewall (NGFW) to filter network traffic between their internal network and the internet or even using some type of endpoint-based protection to mitigate threats on host systems.

Using a multi-layered approach ensures an organization has security solutions to protect their wireless networks, web-based traffic, and email-based traffic, actively monitoring traffic flows with Deep Packet...

Types of social engineering

While social engineering focuses on psychologically hacking the human mind, there are various types of social engineering attacks, such as traditional human-based, computer-based, and even mobile-based attacks. During this section, you will discover the fundamentals and characteristics of each type of social engineering attack.

Human-based

In human-based social engineering, the threat actor or penetration tester usually pretends to be someone with authority, such as a person who is important within the organization. This means the threat actor can attempt to impersonate a director or senior member of staff and request a password change on the victim's user account. An easy form of impersonation that usually gets a user to trust you quickly is posing as technical support. Imagine calling an employee while you're pretending to be an IT person from the organization's helpdesk team and requesting the user to provide their user account details...

Defending against social engineering

Defending against a social engineering attack is really important to any organization. While many organizations implement cybersecurity awareness training, it's not always performed frequently to ensure employees are aware of the latest cyberattacks and threats. Cybersecurity user awareness training should be done each month to ensure all employees develop a critical-thinking mindset to identify and flag various types of social engineering attacks.

The following are additional techniques to help defend against social engineering attacks:

• Threat actors use methods such as impersonation and tailgating (following someone into a secure area) to gain entry to an organization's compound. To prevent such attacks, organizations should implement ID badges for all members of staff, token-based or biometric systems for authentication, and continuous employee and security guard training for security awareness.
• Sometimes, threat actors...

Planning for each type of social engineering attack

The primary objective of a social engineering attack is to either obtain confidential information from the victim or manipulate them into performing an action to help you compromise the target system or organization. However, to get started with any type of attack, a lot of research must be done to find out how the target functions; as an aspiring penetration tester, you need to find answers to questions such as the following:

• Does the target organization outsource its IT services?
• Does the target have a help desk?
• Who are the high-profile employees?
• What is the email address format used by the organization?
• What are the email addresses of the employees?

In addition to conducting research, when performing social engineering, you must be able to strategize quickly and read the victim's emotions regarding how they react to you.

As a penetration tester, it's good to develop the following skills...

Exploring social engineering tools and techniques

In this section, you will explore how to perform various types of social engineering attacks using an open source application known as SET within Kali Linux. You will learn how to create a phishing website to perform credential harvesting and generate a malicious payload that can be placed on a USB flash drive or an optical disk.

Important Note

All the techniques used in the following sections are to demonstrate a proof of concept strictly for educational purposes only. Do not use such techniques and tools for illegal purposes.

Creating a phishing website

In this exercise, you will learn how to create a phishing website to mimic the appearance of a legitimate website to trick victims into providing their user credentials. To get started with this hands-on exercise, please use the following instructions:

1. Power on Kali Linux and ensure there's an internet connection available.
2. Open the terminal and initialize...

Summary

During the course of this chapter, you have learned the fundamentals and key concepts of social engineering and how penetration testers can hack the human mind to obtain sensitive information. Furthermore, you have discovered various types of social engineering attacks and have explored various techniques to mitigate such types of threats. Lastly, you have explored various features of SET on Kali Linux to assist you in setting up various types of social engineering attacks.

I hope this chapter has been informative for you and is helpful in your journey as an aspiring penetration tester, learning how to simulate real-world cyberattacks to discover security vulnerabilities and perform exploitation using Kali Linux. In the next Chapter 15, Understanding Website Application Security, you will be discovering web application vulnerabilities and exploitation.

Further reading

To learn more about the topics covered in this chapter, you can refer to the following links:

• Social Engineering – https://www.imperva.com/learn/application-security/social-engineering-attack/
• Avoiding Social Engineering and Phishing Attacks – https://us-cert.cisa.gov/ncas/tips/ST04-014