Computing | Computer Security | Linux Security | Industrial Control Systems Security | Penetration Testing | Exploitation | Social Engineering | Metasploit | wifi-penetration
Internet Exploitation & Social Engineering
Social Engieering Technical
- phishing
- vishing - voice phishing
- spamming
- spear phising - uniquely identified target
- whaling - spear phishing VIPs
- spoofing IP and Mac
Social Engieering Non-Technical
- Tail gaiting - Silent Entry on the priveledge of another
- Piggy backing - Noisy (convincing) access
- Baiting - for example: USB Dumper
- War Chalking - a way of communicating information with code
- Dumpster Diving
- Rubber Hose Attacks
MAC Spoofing
- Hide Identity
- Privelage Escalation
Tools
- Crazy Call
- EMKEI
- use telnet to talk a server
- hping3 - ip packet level spoofing
- Just Proxy VPN
- tor browser
- macchanger -r & -m
The plain idea
Most break-ins do not pick a lock; they talk their way through the door. Social engineering is hacking people rather than machines: tricking someone into clicking, telling, or letting you in. My lists above sort the tricks into the technical (phishing, vishing, spoofing) and the non-technical, physical ones (tailgating, dumpster diving, baiting with a dropped USB stick). Different methods, one target: human trust.
Why it matters
You can spend a fortune on firewalls and patched servers, and one convincing email undoes all of it. Year after year the breach reports say the same thing: the overwhelming majority of incidents begin with a human, a clicked link, a reused password, a helpful receptionist who held the door. It is the cheapest attack to run and the hardest to patch, because the vulnerability is us.
An everyday analogy: the con artist at the gate
A castle can have the thickest walls in the land, but if a stranger in a convincing uniform tells the gatekeeper “the king sent me, hurry”, and the gate opens, the walls never mattered. Social engineering is confidence trickery with a keyboard. The attacker rarely fights the defences; they persuade someone to switch them off.
A worked example: anatomy of a phishing attack
- Reconnaissance. The attacker reads your company’s website and LinkedIn to learn names, roles and the finance manager’s boss.
- Pretext. They register a look-alike domain (
yourcompany-billing.com) and spoof the CEO’s display name, the IP/MAC and email spoofing in my notes. - Hook. An urgent email: “I’m in a meeting, please pay this invoice today.” Urgency plus authority switches off careful thought.
- Payload. A link to a fake login page (harvesting the password) or an attachment carrying malware, which is where this connects to exploitation.
- Spear phishing / whaling narrow this to one named person or a VIP, making it far more convincing.
A 2026 update
The game has changed in two ways. First, multi-factor authentication is now the single best defence, so attackers evolved “MFA fatigue” (spamming approval prompts until someone taps yes) and real-time phishing kits that relay your one-time code. Phishing-resistant passkeys/FIDO2 are the answer to those. Second, AI has made the attacks frighteningly good: flawless grammar in any language, cloned voices for vishing, and deepfake video calls impersonating executives. The old tell-tale signs, bad spelling, clumsy logos, are gone. The durable defences are human and procedural: verify unusual requests through a second channel, never approve an MFA prompt you did not start, and treat urgency itself as a warning sign.
Common misconceptions
- “Only gullible people fall for it.” Targeted attacks fool careful, senior people routinely; urgency and authority bypass expertise.
- “Spam filters handle it.” They catch the crude mass campaigns; the dangerous ones are tailored to you and slip through.
- “It’s a technology problem.” It is mostly a training and process problem. Verification habits beat software here.
How it connects
- Exploitation: social engineering is usually how the payload gets its first foothold.
- DNS Poisoning: another route to fake sites.
- Encryption and passkeys: the tools that limit the damage of stolen credentials.
- Security Program: where user awareness training lives.
The truth revealed: the weakest link in security has always had a pulse, which is why the best attackers study people, not just protocols.