- Cover image
- Title page
- Copyright
- Foreword
- Acknowledgements
- About the Authors
- About the Technical Editor
- Chapter 1. An Introduction to Social Engineering
- Chapter 2. The Weak Link in the Business Security Chain
- Chapter 3. The Techniques of Manipulation
- Introduction
- Pretexting
- Impersonation
- Baiting
- Pressure and solution
- Leveraging authority
- Reverse social engineering
- Chain of authentication
- Gaining credibility
- From innocuous to sensitive
- Priming and loading
- Social proof
- Framing information
- Emotional states
- Selective attention
- Personality types and models
- Body language
- Summary
- Chapter 4. Short and Long Game Attack Strategies
- Chapter 5. The Social Engineering Engagement
- Introduction
- The business need for social engineering
- Social engineering operational considerations and challenges
- Challenges for the social engineers
- Challenges for the client
- Legislative considerations
- Social engineering frameworks
- Assessment prerequisites
- Key deliverables
- Social engineering team members and skill sets
- Summary
- Chapter 6. Ensuring Value Through Effective Threat Modeling
- Chapter 7. Creating Targeted Scenarios
- Chapter 8. Leveraging Open-Source Intelligence
- Chapter 9. The E-mail Attack Vector
- Introduction
- An introduction to phishing attacks
- Why phishing attacks work
- Spear phishing versus trawling
- Spear phishing
- Real-world phishing examples
- American Express—drive-by-download
- Dr. Atanasoff Gavin—advance fee fraud
- Apple ID scam—credential harvesting
- Nobody falls for this one. Nobody. Ever.
- Active e-mail reconnaissance
- Nondelivery reports
- Out-of-office responses
- The nonexistent meeting
- Impersonating the absent staff member
- Creating plausible e-mail scenarios
- Work experience placements
- Weaponizing the scenario
- The college project
- Weaponizing the scenario
- The recruitment consultant
- Salesperson
- Defending against phishing attacks
- Technological approaches
- Human approaches
- Setting up your own attack
- Spoofed e-mails versus fake domain names
- The SET
- Spear phishing attack vector
- Does this approach really work?
- Malicious Java applets
- Using cloned web sites to harvest credentials
- Is all of this really social engineering?
- Summary
- Chapter 10. The Telephone Attack Vector
- Introduction
- Real-world examples
- Environmental sounds
- The issues with caller ID
- Caller ID spoofing
- Phone system hacks
- Is the contact database up to date?
- Transferring caller ID
- How to figure out if your caller ID shows up
- Summing it up
- Building on the e-mail attack
- Please contact Sarah in my absence
- Who ya gonna call?
- Job enquiries
- Sales calls
- Surveys
- Impersonating staff members
- The help desk
- Employee numbers
- Obtaining key information and access
- Credentials and e-mail access
- Physical access
- The physical access zero day
- Weaponizing your call
- Summary
- Chapter 11. The Physical Attack Vector
- Chapter 12. Supporting an Attack with Technology
- Chapter 13. Writing the Report
- Chapter 14. Creating Hardened Policies and Procedures
- Chapter 15. Staff Awareness and Training Programs
- Chapter 16. Internal Social Engineering Assessments
- Chapter 17. Social Engineering Assessment Cheat Sheet
Social Engineering Penetration Testing
Executing Social Engineering Pen Tests, Assessments and Defense
Gavin Watson
Andrew Mason
Richard Ackroyd
Foreword by Chris Hadnagy
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.