SEC567: Social Engineering for Penetration Testers
Mon, December 4 - Tue, December 5, 2017
- Contents | Additional Info
- Instructor: Dave Shackleford
- 12 CPEs
- Laptop Required
SEC567 is an awesome class. The Capture-the-Human exercise brings it all together.
Everyone talks about social engineering, but no one knows in-depth how to conduct a proper social engineering penetration test. SEC567 exposes you to tools and techniques to execute a social engineering engagement that provides value to executives and others.
SEC567: Social Engineering for Penetration Testers provides the blend of knowledge required to add social engineering skills to your penetration testing portfolio. Successful social engineering utilizes psychological principles and technical techniques to measure your success and manage the risk. SEC567 covers the principles of persuasion and the psychology foundations required to craft effective attacks and bolsters this with many examples of what works from both cyber criminals and the authors experience in engagements. On top of these principles we provide a number of tools (produced in our engagements over the years and now available in the course) and also labs centered around the key technical skills required to measure your social engineering success and report it to your company or client.
You'll learn how to perform recon on targets using a wide variety of sites and tools, create and track phishing campaigns, and develop media payloads that effectively demonstrate compromise scenarios. You'll also learn how to conduct pretexting exercises, and we wrap the course with a fun "Capture the Human" exercise to put what you've learned into practice. This is the perfect course to open up new attack possibilities, to better understand the human vulnerability in attacks and to let you practice snares that have proven themselves in tests time and time again.
Course Syllabus
SEC567.1: Social Engineering Fundamentals, Recon, and Phishing
Dave Shackleford
Mon Dec 4th, 2017
9:00 AM - 5:00 PM
Overview
In day 1 of the course we introduce you to key social engineering concepts, the goals of social engineering and a myriad of reconnaissance tools that will help prepare you for successful campaigns. We complete the day with exercises centered around the most popular and scalable form of social engineering, phishing. Each section includes how to execute the attack, what works and what doesn't and how to report on it to help the organization improve their defenses.
Exercises
- Recon & Profiling - applying the tools
- Tracking Clicks - measuring your SE success
- SET Site Cloning - building a believable phishing site
- Data Logging - building more advanced credential and data theft portals
CPE/CMU Credits: 6
Topics
- Social engineering introduction
- The Psychology of Social Engineering
- Social Engineering Goals
- Setting up for Success
- Targeting and Recon
- Secure & Convincing Phishing
- Tracking Clicks
- Secure Phishing Forms
SEC567.2: Media Drops and Payloads, Pretexting, Physical Testing, and Reporting
Dave Shackleford
Tue Dec 5th, 2017
9:00 AM - 5:00 PM
Overview
In day 2 we build on the principles covered in day 1 of the course to focus heavily on payloads for your social engineering engagements. We will cover how to avoid detection, limit the risk of your payloads causing issues and how to build a bespoke payload that works and looks the part of your selected snare. Following that we will introduce another powerful skill with pretexting and cover how these can be combined to get payloads running. We end the day with a capture the flag where students can apply their new found skills and a section covering the top dos and don'ts in an engagement.
Exercises
- Roll your own payload - limit risk, avoid detection and prove your pentest
- Pretty Payloads - making your payloads look the part
- Pretexting - persuading your way to data
- Capture the Human - blended SE challenge
CPE/CMU Credits: 6
Topics
- USB and Media Drops
- Building a Payload
- Clicks That Work
- Successful Pretexting
- Tailgating and Physical Access
- Social Engineering Reports
- SE: Where it all Fits
- Risky Business
Additional Information
Laptop Required
Security 567: Social Engineering for Penetration Testers course consists of instruction and hands-on sessions. The lab sessions are designed to enable students to implement the concepts and practices in an instructor-led environment. A properly configured laptop is recommended for this course.
There are a few items and pieces of software that you will need to navigate the course successfully:
- A pair of headphones
- A copy of VMWare (Player, Workstation or Fusion are all fine)
- A Windows host (or a Windows VM)
- 15GB of hard drive space
- USB 3.0 Port(s)
- 4 GB of RAM (8GB recommended)
- The ability to connect to the Internet via a wired or wireless connection.
Some labs use a web browser. Those labs have been successfully tested on Windows based systems with Microsoft Internet Explorer, Google Chrome, Firefox, and Opera browsers. On Mac, the browser based labs have been tested with Safari and Google Chrome. The labs will also work with common Linux based browsers. Students with any one of those browsers installed will be able to complete the browser based labs.
By properly preparing, we know that you will have a knowledge rich and enjoyable lab experience.
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.
Who Should Attend
- Staff or consultant penetration testers looking to increase their test breadth and effectiveness
- Security defenders looking to enhance their understanding of attack techniques to improve their defenses
- Staff responsible for security awareness and education campaigns who want to understand how cyber criminals persuade their way through their defenses
Prerequisites
Social engineering for penetration testers does not require existing penetration testing skills, however students with existing skills will be able to apply the course material and enhance other penetration testing disciplines with their newly acquired knowledge.
What You Will Receive
- Course USB with VMWare image ready for the labs
- Prebuilt phishing and data capture examples to customize in the future
- Tools to track your phishing and build reports
- Course books so you can review your techniques after class
This Course Will Prepare You To
- Take on your first social engineering test in your company, or as a consultant.
- Improve your social engineering know how to develop new variations or increase your snare rate.
- Equip you to deal with some of the ethical and risk challenges associated with social engineering engagements.
- Enhance other penetration testing disciplines through understanding human behavior and how to exploit it.
Author Statement
Social Engineering has always been a critical part of the cyber criminals' toolkit and has been at the core of innumerable attacks over the years. Social engineering as a part of penetration testing has become a massive interest of organizations and yet many penetration testers do not have it as a part of their attack toolkit. We are passionate about changing that and opening up a new set of attack possibilities. That being said, this is an area filled with ethical challenges, risks and even legal landmines and we've done our best to share our experiences in the course so people can reap the benefits of our experiences without falling in to the pitfalls we have over the years.
- James Lyne & Dave Shackleford
