In this section of the course,
we're going to be focused on the tools
and techniques that enable us
to perform social engineering attacks.
Now, social engineering attacks are a mixture
of psychological tricks used by attackers
to manipulate individuals into revealing confidential
information or to perform actions that may seem harmless,
but could actually have malicious intent.
Understanding these different tactics will be important
for us to be able to protect sensitive personal
and organizational data.
Now this section of the course will be focused on
Domain 4 attacks and exploits,
and we'll specifically be looking at Objective 4.8,
which says that given a scenario, we must be able
to perform social engineering attacks
using the appropriate tools.
So first, we'll kick things off
with a methods of influence lesson.
Here we're going to explore how attackers use persuasive
and manipulative techniques
to exploit human vulnerabilities.
This lesson will really cover the key concepts
like the principles of compliance,
conformity, and obedience.
Second, we'll discuss the different types
of phishing campaigns that are out there.
Here you're going to learn about things like spearfishing,
whaling, and business email compromises
that help you set up and use different tools
to accomplish these different attacks later on.
Following that, we're going to take a look at using
the Social Engineering Toolkit or SET.
Now here we're going to be performing a hands-on demonstration
that'll provide you with practical experience in deploying
various social engineering attacks like phishing,
pretexting, and baiting,
using this powerful framework called
the Social Engineering Toolkit.
Next, we'll perform a demonstration on Gophish.
Now here you're going to be able to design
and simulate phishing attacks using the Gophish software
and be able to understand how bad actors can craft
deceiving messages to get people
to disclose sensitive information to them.
Impersonation tactics will also be looked at,
and we'll be looking at how attackers can assume identities
of trusted individuals or organizations
to acquire unauthorized access inside of your systems.
And then we're going to explore surveillance techniques
and understand the different methods used
to gather pre-attack intelligence, including both physical
and digital surveillance strategies.
Next, we'll take a look at watering hole attacks.
Now, watering hole attacks are a technique
that compromises a commonly used website
to lure unsuspecting users into an attempt to spread malware
or other malicious things throughout their networks.
After that, we're going to do a demo using Evilginx,
which will show you how you can conduct a Man-in-the-middle
or an on-path attack to perform advanced phishing attacks
that can bypass two factor authentications.
Next, we're going to be covering tailgating
and piggybacking techniques,
which involve unauthorized persons
following an authorized person or coaxing a person
to allow them into a restricted area.
And this emphasizes the importance of physical security
to prevent these kind of attacks.
Lastly, we'll be taking a look at BeEF,
the Browser Exploitation Framework,
and we'll do a demo so you can see
how we can exploit a web browser
and hook victims to gather credentials
and further escalate our attacks.
Finally, we're going to take a short quiz to see
what you learned during this section of the course
and review each of those quiz questions fully
so you understand why each answer was right
and why the wrong ones were wrong.
Now, by the end of this section,
you're going to be familiar with a variety of tools
and methods that can aid in the execution
of social engineering attacks,
and each one has its own unique strengths
and weaknesses that you need to be aware of.
So if you're ready to learn all about the art
of manipulation and psychological exploitation,
let's begin our studies in this section of the course
with social engineering attacks.