Creando un escenario de pretexting

Curso de Introducción a la Ingeniería Social: Técnicas, Ataques y Pretexting

Introducción a la ingeniería social

Lo que aprenderás sobre ingeniería social

Antecedentes de la ingeniería social

¿Qué son la ingeniería social y las reglas de compromiso?

¿Por qué funciona la ingeniería social?

Datos de la ingeniería social

Metas de la ingeniería social

Principios de la ingeniería social

Principios de la ingeniería social según Kevin Mitnick y Robert Cialdini

Principios de la ingeniería social a detalle

Perfil del ingeniero(a) social

Tipos de ingeniería social

Tipos de ingeniería social: basada en humanos

Tipos de ingeniería social: basada en computadoras

Taxonomía de la ingeniería social: marco de ataque

Taxonomía de los ataques

Ataques de ingeniería social

Ejemplos de ataques de la ingeniería social: Baiting y Phishing

Ejemplos de ataques de ingeniería social: Pretexting, Sextortion, Dumpster Diving, Quid Pro Quo

Ejemplos de ataques de ingeniería social: Vishing, Fake News, Tailgating, Piggybacking

Elicitación

¿Qué es la elicitación y por qué es tan exitosa?

Estrategias y respuestas a la elicitación

Pretexting

Qué es el pretexting y cuál es su proceso

Deepfake

Qué son los Deepfake y sus tipos

Aplicaciones disponibles para crear Deepfake

Relación del Deepfake, la ingeniería social y cómo detectarlos

Herramientas de detección de Deepfake

Retos de los procesos de investigación forense en Deepfake

Construyendo el muro humano y contramedidas

Medidas de prevención, protección y cómo crear una cultura de seguridad

Cómo protegerse y recomendaciones

Proyecto

Creando un escenario de pretexting

You don't have access to this class

Keep learning! Join and start boosting your career

If you already have an account,

Resources

How to start a social engineering exercise?

Exploring the world of social engineering can be an eye-opening experience. As with any project, starting in an orderly fashion is essential. The first crucial step in building a pretext scenario is to identify a potential target. This target can be a person, a business, a company or a web service. Applying what you learned earlier about the people most vulnerable to social engineering can be useful at this stage.

What are the tools for gathering information?

Information gathering is the basis for effective pretexting. Social networks such as Facebook, Twitter or LinkedIn are valuable platforms to obtain data about your selected target. It is advisable to collect images, research tastes, preferences, friends and hobbies of the target. All this is key to set the stage for pretexting. For those interested in a more advanced approach, there are books that offer techniques on how to search open sources, known as OSINT.

How do you organize and use the information you collect?

Once you start collecting information, it is critical to keep it organized. Create a folder or file on your computer where you can save data, screenshots, photographs, among others. This organization will be facilitated by using the template found in Appendix B that will guide you in preparing a report on the search performed and its results.

Follow these steps to organize your information:

Capture all sources of information: record the websites, social networks or other means where you obtained information.
Save screenshots and any relevant documents.
Use the template in Appendix B: Complete the sections with the accumulated information, such as company descriptions and tools used.

How to design an effective pretexting attack?

Having accumulated all the information and knowing the identified vulnerabilities, the next step is to design a pretexting attack. It is essential to follow the recommendations shared above on attack models. Use the template in Appendix A to detail it, making sure to include crucial narrative elements such as an introduction, narrative and closing.

What should be included in the pretexting template?

Organize the pretexting attack using the template in Appendix A, which includes:

Pretext and character name: Define who the character you are playing is.
Character and target demographics: Add details such as gender, age, and residence.
OSINT Results: Add screenshots and any target information.

Also, detail the attack script, beginning with an introduction, followed by the attack narrative and concluded with a compelling close. Incorporating three or four of the security principles into the narrative can help increase its effectiveness.

Why is it important to practice and refine the attack?

Before carrying out a pretexting attack, rehearsing the attack is vital. It is recommended to videotape each attempt, review it and adjust it as necessary. See if the scenario is convincing or if improvements could be made. This practical rehearsal provides the opportunity to refine the attack based on the feedback received.

How can appendices A and B be integrated?

To finalize the project, the effort culminates in two essential documents: the resulting report in appendix B and the detailed pretexting attack in appendix A. These appendices provide a structure for gathering initial information and then outlining and detailing the pretexting attack, thus completing the exercise.

Now you're ready to dive into the world of pretexting! Remember, practice and organization are key to success in these projects. Make the most of your resources and continue to cultivate your skills in this fascinating field.

Contributions 48

Questions 0

Sort by:

Want to see more contributions, questions and answers from the community?

Abhay Rojas