Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)

1 Answer 1


I'm assuming by methodology you are looking for a social engineering framework. At a really high level, you'd follow the same sort of steps that you would with any other attack.

  1. Pick a target
  2. Study the target
  3. Identify vulnerabilities
  4. Create plan to exploit identified vulnerabilities
  5. Execute the plan
  6. Walk out unscathed

Much like a technical hack, there may be many hops from entry to final destination within a company. A remote attacker might need to know Linux, macOS, Windows, and a few scripting languages to make it through the barriers. A social engineer needs the ability to build trust and think on their feet as they iterate through their targets, especially in live environments (say pentesting a bank).

For some good, free, social engineering information I highly recommend digging through social-engineer.org. They not only run their own seminars but frequently work with DefCon to create the social engineering village. A good place to start is here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.