0

I have to do a social engineering test for a friend's small company. He wants to know how many people opened the mail and then opened the attachment. How can I do that? The file can be anything- pdf,excel or doc. We do not want to send any malicious exe files as the aim is to check the awareness only.
Edit 1: Instead of downloading, the statistics to look for is "how many people opened the file?"

  • 3
    You can’t. What you can do is creating a pseudo-malicious file that only connects back as to count for execution. Especially, since saving a file to disk does not constitute a problem with awareness. – Tobi Nary Oct 14 '17 at 16:36
  • tracking pixel? – schroeder Oct 14 '17 at 17:58
  • 1
    this is more easily done with an URL, not an attachment - can you get the attachment to ping a server? – schroeder Oct 14 '17 at 18:00
  • 1
    Opt1, small exe, that posts a web request back to a server, could encode some data in the URL and use the web logs to parse it. Would save server side coding, db, etc. Do you have a server with web logs available? Opt 2, create an exe or even script that drops a marker that it was run in the registry. At the end of the "campaign" check the registry to see if the marker is present. For minimal effort to create an exe, install AutoIt. This basic script could be a starting point: pastebin.com/kGxXDkHq. As it's AutoIt, it would be worth checking that their AV product doesn't detect it. – HelpingHand Oct 15 '17 at 9:00
1

Not really possible but I will give you some alternatives I can think about:

  • Instead of attaching the email send a link and say something like "To open the document click here" and here is a link and then track how many people clicked it.

  • Add a very small white image that will sit on your server and when the email loaded the image will be requested and then count the requests.

  • As said in the comments:

    What you can do is creating a pseudo-malicious file that only connects back as to count for execution. Especially, since saving a file to disk does not constitute a problem with awareness

These are some of the ideas I have on the top of my head.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.