0

I have to do a social engineering test for a friend's small company. He wants to know how many people opened the mail and then opened the attachment. How can I do that? The file can be anything- pdf,excel or doc. We do not want to send any malicious exe files as the aim is to check the awareness only.
Edit 1: Instead of downloading, the statistics to look for is "how many people opened the file?"

4
  • 3
    You can’t. What you can do is creating a pseudo-malicious file that only connects back as to count for execution. Especially, since saving a file to disk does not constitute a problem with awareness.
    – Tobi Nary
    Commented Oct 14, 2017 at 16:36
  • tracking pixel?
    – schroeder
    Commented Oct 14, 2017 at 17:58
  • 1
    this is more easily done with an URL, not an attachment - can you get the attachment to ping a server?
    – schroeder
    Commented Oct 14, 2017 at 18:00
  • 1
    Opt1, small exe, that posts a web request back to a server, could encode some data in the URL and use the web logs to parse it. Would save server side coding, db, etc. Do you have a server with web logs available? Opt 2, create an exe or even script that drops a marker that it was run in the registry. At the end of the "campaign" check the registry to see if the marker is present. For minimal effort to create an exe, install AutoIt. This basic script could be a starting point: pastebin.com/kGxXDkHq. As it's AutoIt, it would be worth checking that their AV product doesn't detect it. Commented Oct 15, 2017 at 9:00

1 Answer 1

1

Not really possible but I will give you some alternatives I can think about:

  • Instead of attaching the email send a link and say something like "To open the document click here" and here is a link and then track how many people clicked it.

  • Add a very small white image that will sit on your server and when the email loaded the image will be requested and then count the requests.

  • As said in the comments:

    What you can do is creating a pseudo-malicious file that only connects back as to count for execution. Especially, since saving a file to disk does not constitute a problem with awareness

These are some of the ideas I have on the top of my head.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .