Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)

1 Answer 1


I'm assuming by methodology you are looking for a social engineering framework. At a really high level, you'd follow the same sort of steps that you would with any other attack.

  1. Pick a target
  2. Study the target
  3. Identify vulnerabilities
  4. Create plan to exploit identified vulnerabilities
  5. Execute the plan
  6. Walk out unscathed

Much like a technical hack, there may be many hops from entry to final destination within a company. A remote attacker might need to know Linux, macOS, Windows, and a few scripting languages to make it through the barriers. A social engineer needs the ability to build trust and think on their feet as they iterate through their targets, especially in live environments (say pentesting a bank).

For some good, free, social engineering information I highly recommend digging through social-engineer.org. They not only run their own seminars but frequently work with DefCon to create the social engineering village. A good place to start is here:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .