Social Engineering Training Course

Course attendees will learn about:

The Threat - You will gain an understanding of the techniques used by social engineers in the planning stages of an attack. We introduce you to key social engineering concepts, the goals of social engineering, and warn you about the tool’s attackers use to gain intelligence on your organisation. You will see real-time interactive demonstrations centred around the most popular and scalable forms of social engineering.

The Attack – You will explore and engage in the social engineering attacks used by the attackers and will learn how exposed you and your organisation may be to this every day common and significant threat.  This interactive training balances practical lectures and discussions to understand the ‘Social Engineering Attack Cycle’, with multiple interesting exercises and demonstrations that highlight weaknesses within organisations; weaknesses from employees which result in information security breaches.

Defend, Prevent, Deter – Social Engineering remains a high threat to organisations regarding information security breaches.  You will explore the options available, and the controls needed to minimise risk and diminish the threat to your organisation. This will culminate in an interactive War Gaming session, where you will formulate a plan of defence to take back to your organisation and use immediately. You will see what works, and what doesn't, and how to report on it to help the organization improve their defences and increase your snare rate. The course will equip you to deal with some of the ethical and risk challenges associated with social engineering engagements, understanding human behaviour, and how to defend against it.

Social Engineering Fundamentals

• What is Social Engineering
• Who conducts Social Engineering?
• Why is Social Engineering so successful?
• Ethics and Law
• Psychology of the Social Engineer
• Hacker vs Organisation    Team Exercise / Discussion

The Reconnaissance Phase (Open Source Intelligence)    OSINT Tools

•    Maltego
•    Shodan
•    Buscador
•    Google Alerts
•    Google Dorks
•    The Harvester
•    Metagoofil
•    Recon-NG
•    Have I been pawned

Cyber Kill Chain

• Looking for vulnerabilities
• The Social Engineering Attack Cycle    Information Gathering
• Build Relationships and Rapport
• Exploitation
• Execution and covering your tracks (TOR)

The art of Phishing, (don’t get hooked!) - Technical    Phishing Tools 

•    Phishing (SET, NGROK)
•    SMShing,
•    Spear Phishing,
•    Whale Phishing,
•    Vishing

Spoofing Email – Demonstrations (Interactive)
•    Emkei
•    Anonymailer

The art of Phishing - Phishing – (Physical) (Interactive)
•    Listening Devices and Bugs
•    USB Drop (Ducky USB)
•    Dumpster diving
•    Pre-Texting
•    Tailgating
•    Shoulder Surfing
•    Lock Picking
•    Impersonation
•    Mobile phone recording

The art of Phishing – (Telephone)    Telephone Phishing

•    Pre-Texting
•    Impersonation

Credential Harvesting
Finding your organisations leaked credentials and the dark web    Credential Harvesting demonstrations

•    Have I been Pawned
•    Username and password harvesting
•    Password Re-use
•    Password cracking
•    Hashing/Cracking Hash
•    Dictionary/Brute Forcing
•    Darknet

Network (Packet) Sniffing – Open Networks (coffee shops etc.)    Network Tools

•    Wireshark
•    Network Miner

Mobile Device Exploitation – (Hacking Mobile Devices)

•    Mobile Phone
•    Probe Requests
•    Fake AP/SSID/Rogue Access Point
•    Rogue Network Devices
•    Fake Iframe/Portal – Username and Password Capture
•    De-authing Clients
•    Untrusted APK (Gaining remote access to mobile phone - data, SMS, camera, photos etc.)
•    Session Hijacking/Cookie Stealing

Privilege Escalation    
Vulnerability Assessing Your Systems

•    Nessus
•    CVE
•    Virus Total
•    Malware Testing

Prevention
Educating the workforce    What can an organisation do to defend itself?
Practical tips and advice on implementation
Incident/Breach Management    Containment, Isolation and Managing Incidents
War Gaming Scenario    Team exercise and presentation
Final Questions, Discussion    
Networking and Close