CoreQ Academy4.8 Given a scenario, perform social engineering attacks using the appropriate tools.
Social engineering tests measure the human layer. They must be explicitly scoped, avoid real harm and treat employees with respect: the goal is training, not blame.
Attack types
- Phishing
- Deceptive emails to get clicks or credentials.
- Vishing
- Voice phishing by phone.
- Whaling
- Phishing aimed at senior leaders.
- Spearphishing
- Highly targeted phishing using personal details.
- Smishing
- Phishing by SMS text message, often a fake delivery or bank alert with a link.
- Dumpster diving
- Searching discarded material for sensitive information.
- Surveillance
- Observing people and premises to learn routines.
- Shoulder surfing
- Watching someone enter passwords or view data.
- Tailgating
- Following someone through a secure door.
- Eavesdropping
- Listening to conversations for information.
- Watering hole
- Compromising a site the target group visits.
- Impersonation
- Pretending to be IT, a vendor or an executive.
- Credential harvesting
- Collecting credentials through fake login pages.
Tools
- Social Engineering Toolkit (SET)
- Framework for phishing, cloned sites and other social engineering tests.
- Gophish
- Open-source phishing simulation platform with tracking and reporting.
- Evilginx
- Reverse-proxy phishing framework that captures session cookies, demonstrating why phishing-resistant MFA (FIDO2) matters.
- theHarvester
- Gathers employee emails and names for target lists.
- Maltego
- Maps relationships between people and organisations.
- Recon-ng
- OSINT framework for building target profiles.
- Browser Exploitation Framework (BeEF)
- Hooks browsers via XSS to demonstrate client-side attack impact.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.8 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.