Hacking the Humans
Christopher Hadnagy · 2018
From a malicious social-engineering angle, there are four main vectors: phishing, vishing, SMSiHing, and impersonation. In this chapter, the author discusses how the hacker can use the skills discussed in each of these vectors. The goals of phishing are to deliver malicious payloads that give access to remote attackers; to gather credentials; and to gather other bits of intel for further attacks. Vishing is a mash-up of voice phishing, which is phishing over the phone. Most SMiShing messages are simple, but they're effective and generally geared toward loading malware on the mobile device or stealing credentials. A social-engineering pentester needs to keep in mind that all senses of the target are engaged when it comes to the impersonation vector. The author also discusses the principles of the pentest. Finally, he covers some of the most commonly asked questions he get as a professional social engineering pentester.