Now, we're going to talk about what social engineering has
to do with penetration testing, and how we can work it
into our penetration tests.
We'll cover the purpose, how we can use it
for information gathering, how we can use social engineering
for external access, also how we can use
social engineering to gain physical access to our victim
to our client.
So with penetration testing, we are
trying to find what all the vulnerabilities are.
NIST 801-15 actually talked about how to do a penetration
test and includes a section on social engineering, talks
about using vishing as well as business email compromise,
to test the controls put in place by an organization.
Depending on what regulations they follow,
they need to have certain controls in place.
And well, that's what they're doing
a penetration has to do-- to find out
if their controls work, and if they're in place,
or if they exist at all.
So scope matters.
What you're about to do with social engineering
really edges on what people find acceptable
and what they find to be wrong.
Even if it's not criminal, people won't necessarily
like to know that you're using social engineering
tactics as part of your job, even if you're a good guy.
White hat hackers, gray hat hackers
still don't looked well upon.
What you need to do is make sure that you do all of your actions
within the bounds of your contract within the scope set
out by your client because there are certain things that
are allowed, certain things that are not allowed.
For example, I had a discussion with a penetration tester.
And we had a serious talk of OK, you need access
to this organization.
You can do anything short of kidnapping the CEO.
How are you going to get in?
If that was the scope, if anything was allowed,
it starts to get a little scary.
You start thinking about movies, like Hackers,
and the Ocean's movies, and how do people get in.
And all the things that they--
might make people feel bad, could potentially
hurt people if they're not careful with the scope.
So know what your scope is.
Know what you're allowed to do, and don't go outside of that.
Also, don't do anything that's not right.
What you're trying to do is help them find out
if they have controls in place, not to break into everything
and destroy things, right?
So initially, we can use social engineering
to gather information.
There is a competition at DEFCON in Las
Vegas in the end of the summer.
And social engineering village has been putting this
on for a little while, where they have a competition.
The competitors have to go ahead and gather information
from targets.
And they have a checklist of what information to gather,
and you just make phone calls.
And one of the recent winners back in 2019,
there's a Darknet Diaries.
This is amazing-- talked about how she was able to gather
information by impersonating the company's IT personnel,
and asking for information about their computers by telling
them, hey, we're going to send you a new computer,
and I need to know what computer you have to understand--
to fill up my checklist.
And if you work it right, if you work the backstory,
if you work the connection, the impersonation,
the pretexting properly--
gather a lot of information.
And it's a little scary.
Similarly, if you people from a company, talk, and chat,
and go to coffee at the same place,
maybe you can slide in there and impersonate the new guy that
works in a different or part of the organization, bust
into talking about things.
Maybe their front door is open.
If you just show up during normal business hours looking
like someone who works there, don't actually go to an office.
You hang around in the different coffee spots
and ask people about their day.
Ask people about information about the company.
Be like, oh, yeah, I work over there.
I'm new.
But never-- it's dangerous.
But you could gather a lot of information.
Similarly, out in maybe like the smoke pit.
In the United States, you can't smoke inside.
Usually, there's a designated smoking place outside.
People will take a break.
You can take advantage of them being hurried
because they need to get back to work,
but they really need a smoke.
Feeling like their guards down because they're bright by work.
They're with their buddies there taking a load off,
having a smoke.
You can spark up a conversation like,
you might be able to gather some information about the company,
or you might be able to notice things
about people in the organization by watching their smoke pit,
seeing how people dress, seeing what badges they wear,
seeing how they get in and out of the office.
And maybe the times of days that they come in and out
to take their breaks.
Maybe that's a sign of higher network use at this time.
Maybe it's a sign of they have meetings at this time
because everyone comes out before and after
the big meetings.
All of these can be utilized, especially in the next part.
External access.
Often, a penetration test is going
to be based off of you are external to the organization,
and you need to find a way in.
Now, the company wants to know what they have public-facing
that's vulnerable.
Often, it's going to be male or their website.
Something on a server that's external-facing.
And hopefully, they have a DMZ, a demilitarized zone,
a section of their network that's publicly available,
like their web server or their mail server.
And then the rest is behind a firewall.
So you shouldn't have access to it.
But we want to find other ways in.
If we can send an email with a reverse shell in there
or a downloader for a reverse shell,
maybe we just want information, so
that we can RDP in or get in through maybe one of their SaaS
solutions, like Office 365 or their G Suite account.
All of those might be ways of getting into the organization
through social engineering methods.
Then the last thing I want to cover is physical access.
If a lot of penetration tests, if they are external,
they might want to include a physical security,
physical access in their penetration test.
In which case, you as a penetration tester
need to get into that organization.
Maybe get an attempt to get into their server room.
Maybe attempt to get onto their network
while acting like a criminal.
And this could be making fake badges.
And there's a great story of a hacker that some of you
might know, who has a Proxmox, which is a little card reader.
It's the same thing that they have on right next to the door
for these access badges.
And pretexting, walking up to someone at the smoke pit
and saying, hey, the code reader is malfunctioning.
I got to test it.
Could I read your badge?
Persons out of the smoke pit, they
got to get back into work soon.
They want that door to work, so they're like,
yes, scan my card.
When you scan their card and the door--
you're not part of that.
Door applies to works.
But you now have their code from their card.
Go back to your car.
You make a new card with their code on it,
and you have access just like they had access.
You can get into the building that way.
Rubber duckies, that's right.
There's the company that creates these USBs that
have malware, all different sorts reverse shells,
key scanners, scanners of the machine that
then offload information.
There's several different types, or you can make your own.
But it's a common way of getting access externally.
Penetration testing company I worked with,
they would plan to buy 50 of these for an assessment.
And what you do is you just leave them in the parking lot.
You might leave one by the coffee card.
And you can get the ones that have a little rubber
ducky on them.
Those are obvious.
Maybe you get ones that have the company's logo on them.
Maybe you get ones that say you write something on it,
so that if someone finds it, they're like, oh, I
don't know what this is.
Let me go to my computer and plug it in and find out
what's on it, so then I can help get it to whoever wants it.
Taking advantage of their trust that if they find something,
someone's lost it.
Not that they're attempting to subvert their security
and get in.
You play off of their altruism.
You play off of their trust in not expecting
to be attacked at work.
And in that, gain access to the network.
Another way is impersonating work people.
There is a very current set of TikToks, and reels,
and YouTube videos of people gaining access to companies
just by two guys not even dressed like workers,
necessarily, walking in with ladders.
And nobody saying a thing, walking right through the place
where you're supposed to scan, but they're carrying a ladder.
So like, OK, they're not from here they don't have a card.
But obviously, they know where they're going.
And they got their hands full with the ladder,
so we're just going to let them go.
And there's several of these videos of people,
like watching their another accomplice
videotaping them going in and catching it, and it works.
Your mileage may vary.
But again, playing off of people's trust,
gaining physical access is quite important because often,
the controls that keep people from accessing the network
externally are not in place, if you can walk up
to someone's computer.
They went to the bathroom.
They left their computer unlocked.
If you can just walk up, gain some little information.
Maybe you have a rubber duck.
You just plug it in.
It sends a reverse shell.
You can unplug it, and it's there.
It's in place-- a keylogger.
Maybe you can plug something in.
It launches malware that gathers information
and just offloads it back to your email
and doesn't even need the same place.
You just plug it in.
It does its thing.
You unplug it.
It's done.
There are a few USBs that you can plug in.
There's an ethernet jack.
If you can unplug the Cat 5 out of or an ethernet cable,
out of the back of a computer, plug in this device,
and then plug it back in place.
You don't even have to log in.
It's going to shoot back and interpret the shell to your C2.
And you have now remote access to the machine.
But you do have to get to the back of a machine
and leave it in place and hope no one catches
it, which might be possible.
So all of these are different ways
that you can utilize social engineering in order
to gain access to a network, as part of a penetration
test because you would expect there to be controls
in different places.
Maybe USB policies.
Maybe watching for people who aren't supposed
to be there looking for tags, checking the doors,
having workers check in at the front desk and get escorted,
perhaps, or at least get their own guest badges
while they're there.
All of these things should be in place.
And the people who pay for security,
they want to know if they are in place and if they work.
So it might be part of your penetration test
to find out if that's the case.
We've covered a lot in these lessons.
We're going to play with a few tools and techniques
in order to set up a phishing campaign
and set up a watering hole website so that you
could set up your own social engineering as part of your pen
test.