Questions tagged [social-engineering]
Social engineering is the act of manipulating people into performing actions or divulging confidential information.
178
questions
-1
votes
0answers
59 views
How can I brute-force the email id to reveal the email hidden behind the asterix in an account recovery page? [closed]
I know it is not possible to directly decode the asterisk. But that's when something struck my mind. If the hidden email is to******h@g****.com, and the person's name is Tom Smith, the email could be
...
0
votes
2answers
96 views
Phishing emails - What do I look for?
I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one?
There are some things I know to look for already but I want to get moer ...
0
votes
0answers
32 views
Decreasing The Physical Access Time Required for a Twin Duck Payload [migrated]
I have recently started playing with with the Twin Duck Firmware on the USB Rubber Ducky. I was wondering if anybody could possibly give me some suggestions as to how to decrease the amount of time ...
0
votes
1answer
75 views
Are IPv4 more intuitively hard to track than IPv6?
I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4:
For example, since I configured ...
1
vote
0answers
80 views
Is Social Engineering out of scope unless explicitly requested? [closed]
I've seen some sample "What would you like to be pentested?" page (I can't find or remember the exact source) where Cyber, Physical and Social were asked separately (among other areas like Wifi, ...
12
votes
1answer
428 views
Canadian police mentioned a new line-trapping technique, but what is that?
The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called ...
1
vote
1answer
88 views
What is it called when someone glides through a building's external door behind you? [duplicate]
One form of social engineering is the practice of running up to a building's external door just as an employee is entering. The employee often holds the door open for the intruder, bypassing security ...
0
votes
1answer
139 views
“Harmless” script which downloads malicious script
What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since ...
18
votes
1answer
2k views
How to protect yourself against OSINT?
I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where.
Given this is now ...
2
votes
1answer
104 views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
-2
votes
2answers
154 views
Is it social engineering when you know you are being social engineered? [closed]
More like a philosophical question.
0
votes
0answers
1k views
Meterpreter is failing to load any extension except the core commands
[*] Starting persistent handler(s)...
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https
PAYLOAD => windows/meterpreter/reverse_https
...
2
votes
1answer
102 views
How safe is to have a LinkedIn account where you have published all the important information about yourself?
How safe is it to make your information public? I know that there are many risks from social engineers' side, if you put everything about yourself a hacker will have most of the information about you ...
0
votes
1answer
268 views
is it possible to evil twin a WPA 2 Wifi using one of EAP methods?
the same as fluxion but without the captive portal just like this video
Stealing 802.1x Credentials with Rogue AP & RADIUS server
he was able to get the username and the password of an EAP wifi ...
0
votes
1answer
85 views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
0
votes
1answer
103 views
Tech support agent asked me some questions unrelated to tech support or my problem
About 4 years ago I was having a problem with my Microsoft Windows system so I went to Google and searched "Microsoft tech support phone number" to see the results and got the number from some random ...
6
votes
1answer
869 views
Understanding a Whatsapp account hack (social engineering?)
A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who ...
0
votes
0answers
45 views
What to do after a social engineering attack was used to trick utility services at my hypothetical business? How to close the security hole?
Business Attack Scenario
Standard information that was ubiquitous through my chain-businesses
was exploited by a rogue group of former employees to sabotage. They
considered manipulating all ...
0
votes
2answers
170 views
Could someone commit a social engineering “hack” on a credit card processor to get my credit card number?
Peripherally related to: Is it safe to recycle unshredded credit card receipts?.
From some basic research, it seems as though the SEQ number is internal to the company running the POS software, the ...
2
votes
1answer
135 views
Social engineering testing methodology?
Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)
106
votes
19answers
22k views
Defence methods against tailgating
This is a follow-up question to this one: Roles to play when tailgaiting into a residential building
How do you protect yourself or your company against tailgaters? What is the best answer when you ...
110
votes
6answers
20k views
Roles to play when tailgaiting into a residential building
Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
45
votes
2answers
13k views
Does this mean Target's twitter was successfully attacked?
I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins
I added the hand-drawn red lines so I am not responsible for propagating the apparent scam.
Clicking on the ...
8
votes
3answers
795 views
What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]
I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box:
I know [old password deleted] one of yo...
2
votes
2answers
251 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
2
votes
2answers
236 views
Is single-click phishing possible?
For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no ...
32
votes
7answers
6k views
How do hackers make the victim access an XSS attack URL?
As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user ...
5
votes
2answers
242 views
What is the name for building trust on a platform before pillaging?
What's the common or recognized name for a vulnerability on a platform where someone can build trust and than pillage/exploit that trust for profit or information? It's driving me crazy, and I ...
67
votes
5answers
10k views
Advised to block all traffic to/from specific IP addresses
My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
0
votes
1answer
87 views
Spam identification
We have a spamfilter running that does a very good job at tackling common spammer issues.
From what it catches, I'm assuming it blocks mails based on a few things:
SPF checks
Certain attachment ...
6
votes
1answer
162 views
How can companies verify that a national security letter is real? [closed]
It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it.
There ...
1
vote
1answer
128 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
1
vote
2answers
181 views
How is there a preview for a fake docx file in gmail
I recently got a nasty email containing two files. I didn't open them but did check and realised they were not docx files which was the intent but on gmail in the document preview it shows what looks ...
0
votes
1answer
138 views
Server encryption to prevent access by hoster
A friend told me one of their company servers got recently hacked. The server was super secured software side.
It turned out the attacker called the hoster and used some social engineering skills to ...
7
votes
1answer
341 views
What are good methods of visual security?
What are good methods of visually securing sensitive information that might appear on your screen from the outside world?
An example to illustrate my question would be the following:
You're sat in ...
4
votes
1answer
312 views
Reality Check: Create chaos at an office
An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
3
votes
2answers
103 views
Someone is using similar domain and spamming clients
This is the problem my friend is facing in his office.
Someone is using an almost similar domain as my friend's company (via email). This person is posing as their company and asking them to send ...
4
votes
1answer
48k views
What can be done with the last 4 digits of one's SSN [closed]
If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do?
To avoid the possibility that they could guess the other digits from date/...
0
votes
1answer
297 views
Fake secured WiFi network to harvest password [duplicate]
I'm not finding a lot of information on this topic although it seems so simple, so I assume it isn't possible, but I was wondering if it is possible or not to create a fake acces point that looks like ...
4
votes
2answers
142 views
Amazon 2FA: Compromising the email leads to compromising 2FA, e.g removing the other factor?
I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor.
Due to issues with this phone my second factor basically broke (...
0
votes
2answers
653 views
Conducting Ethical Phishing Attack [closed]
For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
0
votes
1answer
57 views
Seeing SSL requests in unencrypted form from a remote client [closed]
I was wondering how I could be able to see SSL requests in an unencrypted form from remote clients (specifically, my phone).
I heard that you are supposed to use CA certificates, but how would I ...
0
votes
1answer
91 views
How to get the statistics of users opening the attachment in a phishing mail during a social engineering campaign test?
I have to do a social engineering test for a friend's small company. He wants to know how many people opened the mail and then opened the attachment. How can I do that? The file can be anything- pdf,...
2
votes
1answer
148 views
What potential threats lie ahead after the hack of equifax in 2017?
Having that literally every single US resident's information is now exposed to hackers and malicious social engineers. What are some threats that we will inevitable encounter in the coming months or ...
0
votes
3answers
4k views
How to determine IP address of target device or network
I know most exploits over the internet are opportunistic, but assume an aggressor has a specific target, but no physical access to that target. How do you find the target network or device to begin an ...
0
votes
4answers
136 views
What is a good method to authenticate users and make sure they don't give their credentials to someone else?
I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
2
votes
0answers
70 views
Are there any good OSINT feeds related to phone phishing? [closed]
There are lots of feeds related to fraudulent and malicious domains and IPs, but we're seeing more and more social engineering attempts coming in via phone.
When these are reported to us, I'd like to ...
1
vote
3answers
190 views
What precautions/training do companies have against social engineering strategies?
For example, if someone were to call a cell phone provider like T-Mobile, pretending to be another person to get some information, how can T-Mobile verify if it is the actual person? I'm assuming that ...
3
votes
4answers
8k views
Is it dangerous for a scammer to know just your name and birthday? [closed]
Basically, this afternoon, I got a call that I had picked up. The caller asked for (my name) stating that they were from this company associated with my healthcare. The call seemed pretty legit, and ...
1
vote
1answer
103 views
Account hacked on mobile music streaming app - what should I do next
I'm a software developer so aware of basic security issues. I use a popular music streaming service and a few months back signed up for their paid plan as I was enjoying the experience. I use the ...
