REAL Social Engineering with Michael Allen

Students will get hands-on practice gathering information, planning communications, building technical assets, and launching social engineering campaigns. Throughout the class they will learn influence, deception, and forgery techniques critical to overcoming the human element of security. In a live lab environment, students will gain experience sending phishing emails and capturing targets’ actions, both manually and by using popular frameworks such as Gophish. Finally, after completing this course, students will also understand how to design and conduct social engineering penetration tests in a way that provides maximum value to the organizations they serve.

REAL Social Engineering is 100% focused on skills used by real penetration testers in the real world. All of the material taught in class aims to be:

• Rapid – Social engineering attacks during penetration tests and red team exercises typically occur during a single interaction with the target. A single email message, phone call, or conversation is often all the tester gets to convince their target. Therefore, we must focus on techniques that work as rapidly as possible. 
• Effective – Every bit of material taught in REAL Social Engineering has been tested and proven to work over-and-over again on real penetration tests and red team exercises.  
• Actionable – Students will be able to immediately take action on the skills they learn in class, so they are ready to begin executing their own social engineering penetration tests immediately after class is over on the final day.
• Learnable – The truth is that many of us in the infosec world are not the most social people on the planet (myself included 😅), but that’s okay! The skills shared in REAL Social Engineering can be learned and put to use by anyone, regardless of your social comfort level. And none of the exercises in class require you to talk to strangers or do any unnecessarily uncomfortable things like that.

Both hands-on exercises and instructor presentation are used to teach and reinforce the lessons learned in class.

During the lab exercises, students will get experience:

• Conducting reconnaissance of real people and organizations, to support social engineering attacks.
• Using influence and deception techniques to design their own social engineering ruses.
• Building and executing phishing campaigns – both manually (without any special “hacking” tools) and with industry standard tools like Gophish.
• Maintaining stealth by identifying and eliminating attack indicators in tools used.
• Executing credential harvesting and downloadable payload attacks.
• Analyzing document metadata for reconnaissance.
• QR-code phishing.
• Identifying an organization’s operating systems, software, and third-party services through Open Source Intelligence (OSINT) found online.
• Planning and executing a social engineering conversation via voice or text in an AI-simulated environment.
• Rapidly forging complex, digital assets that are indistinguishable from the real thing.
• Creatively solving problems to overcome challenges faced during modern penetration tests.

Instructor presentation will also cover:

• Social engineering attacks conducted over email (phishing), phone calls (vishing), text messages (SMiShing), in person, and others.
• Case studies of real social engineering attacks on penetration tests and red team exercises.
• Practical application of influence techniques in penetration testing scenarios.
• Conversation mapping and deliberate communication.
• Deception techniques.
• Forgery of physical assets and ID badges.
• Social engineering penetration test methodologies for access- versus metrics-focused testing.
• Assessing actions, channels, and targets to identify effective attack paths.
• Designing and creating effective ruses.
• Best practices for deploying and running phishing infrastructure.
• Use of phone services for social engineering, including mass text messages, burner numbers, and spoofing.
• Open-Source Intelligence (OSINT) gathering methodology and sources.
• Email security and defensive controls.
• Passive versus active reconnaissance.
• Analyzing test results to deliver meaningful findings.
• Maximizing value to the organization when penetration testing.
• And much more!

Syllabus

REAL Social Engineering

I. Class introduction

1. Instructor bio
2. Class overview and schedule

II. Intro to Social Engineering

1. What is Social Engineering?
2. Key concepts
3. Overview of influence techniques
4. Components of a social engineering attack
5. Defining project goals

• Metrics versus access
• Testing systems versus testing people

III. Leading Social Engineering Projects

1. Setting expectations
2. Testing scientifically
3. Customer communications
4. Conversation Mapping

IV. Metrics tracking

1. What are metrics and what do we track?
2. How does metric tracking work?
3. Manual metric tracking
4. Deploying Gophish
5. Capturing metrics with Gophish

V. Reconnaissance of Organizations

1. Active versus passive reconnaissance
2. Reconnaissance goals
3. Tools and techniques for reconnaissance of organizations

VI. Threat Modeling and Ruse Planning

1. Procedure assessment
2. Identifying vulnerabilities in security awareness training
3. Action, Channel, Target assessment and selection
4. Action selection and planning
5. Channel selection and planning

• How to assess channels for suitability
• Phone & SMS

1. Number obfuscation and spoofing
2. Sending mass SMS messages

• Email

1. Email defenses
2. Overcoming email defenses

• Unconventional channels

1. Beginning to plan your ruse

• Emotional hijacking

1. Targets

• Assessment of targets

VII. Reconnaissance of individuals

1. Bulk recon versus individual recon
2. Gathering email addresses
3. Identifying phone numbers
4. Methodology for reconnaissance of individuals
5. Identifying passwords, security question answers, etc.

VIII. Ruse creation

1. Questions to guide ruse creation
2. Finding ways to cheat
3. Payload files

IX. Forgery and Asset Creation

1. Forgery key concepts
2. Common methods of duplication
3. Mimicking real email messages
4. QR codes
5. Controlling the execution environment
6. Duplicating and modifying complex websites
7. Frustrating investigation
8. Creating physical assets

X. Pre-attack testing

1. The importance of testing in advance
2. Testing process

XI. Attack execution

1. Live deception techniques
2. Planning excuses and outs
3. Vishing-specific techniques
4. Body language
5. How to cheat at vishing
6. Execution of in-person social engineering
7. Reporting and after-action review
   1. What to report
   2. Making recommendations actionable
   3. Adding value by identifying other vulnerabilities

XII. Conclusion

Red Team Summit (March 20th – March 21st, 2025)

• March 20th – 9:00 AM to 6:00 PM EST
• March 21st – 9:00 AM to 6:00 PM EST

Who Should Take This Course?

• Current or aspiring penetration testers who want to learn how to lead and execute social engineering projects
• Information security professionals seeking to setup regular phishing exercises within own organizations
• Anyone with an interest in cyber security

Student Requirements / Prerequisites

Basic familiarity with information security concepts is all that is required to follow along with the presentation and course material. 

To complete the lab exercises, students should know how to install and run a VMware virtual machine on the computer they use for class. The virtual machine image will be provided for download a week or two before class begins, and students will need to download and install the virtual machine on their computer before coming to class.

System Requirements

Students will need to have a computer that meets the following requirements to complete the lab exercises in class:

• A modern, 64-bit PC or Mac laptop or desktop computer. This includes Mac computers with “M” series Apple silicon processors. 
• VMware Workstation Pro or Fusion virtualization software installed on the computer.
  • Both of these products are free for download by creating a free account on Broadcom.com.
• User permissions to install and run an Ubuntu Linux virtual machine in the VMware virtualization platform. 
• The following minimum hardware resources are required to run the virtual machine:
  • 70 GB of available hard disk space 
  • 8 GB of RAM 
• If taking the online class: High-speed Internet sufficient for participating in a video conference/webinar.

Students will also need a free or paid account on ChatGPT.com to participate in one of the lab exercises. 

• It is recommended that students download and install the ChatGPT app on their mobile phone, so they can interact with the chat bot using voice during the lab exercise.