offensive-social-engineering
Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting methodology (persona creation, authority and urgency psychological triggers, rapport building), vishing (voice phishing via caller ID spoofing, IVR system exploitation, VoIP infrastructure setup with Twilio/Asterisk), smishing (SMS-based phishing, carrier gateway abuse, short code impersonation), physical social engineering (tailgating and piggybacking, RFID badge cloning with Proxmark3, lock picking and bypass, dumpster diving for sensitive documents), USB drop attacks (Rubber Ducky keystroke injection, Bash Bunny multi-vector payloads, O.MG cable covert implants, BadUSB firmware attacks), watering hole attack planning and execution, and OSINT-driven targeting (LinkedIn harvesting, organizational chart reconstruction, employee pattern analysis). Integrates with the Social Engineering Toolkit for attack automation, Proxmark3 for RFID/NFC cloning, USB Rubber Ducky and Bash Bunny for physical payload delivery, and BeEF for browser exploitation. Maps to MITRE ATT&CK T1598 (Phishing for Information), T1566 (Phishing), T1091 (Replication Through Removable Media), and T1189 (Drive-by Compromise). All techniques require explicit written authorization and defined rules of engagement.
git clone --depth 1 https://github.com/SnailSploit/Claude-Red /tmp/offensive-social-engineering && cp -r /tmp/offensive-social-engineering/Skills/social-engineering/offensive-social-engineering ~/.claude/skills/offensive-social-engineeringSKILL.md
# Offensive Social Engineering
Social engineering exploits human trust, authority bias, and procedural gaps rather than technical vulnerabilities. While phishing is the most common vector, a comprehensive red team engagement tests the full spectrum: voice calls, text messages, physical access, and planted devices. You are simulating an adversary who combines OSINT, psychological manipulation, and physical access techniques to breach an organization's defenses at the human layer.
Every technique described here requires explicit written authorization. Physical social engineering carries additional legal considerations -- trespassing, impersonation of officials, and recording laws vary by jurisdiction. Confirm your scope covers each vector before execution.
## Quick Workflow
1. Conduct OSINT to map the target organization's structure, key personnel, physical locations, and communication patterns.
2. Develop personas and pretexts tailored to the engagement objectives (credential theft, physical access, data exfiltration).
3. Prepare infrastructure: VoIP numbers for vishing, SMS gateways for smishing, cloned badges for physical access.
4. Execute attacks in phases -- start with remote vectors (vishing, smishing), escalate to physical if in scope.
5. Document every interaction with timestamps, recordings (where legally permitted), and outcomes.
6. Debrief with the client; provide actionable recommendations for security awareness and procedural improvements.
---
## Pretexting and Psychological Manipulation
Pretexting is the foundation of all social engineering. You construct a believable scenario that gives you a reason to request information or access. The pretext must hold up under casual scrutiny and, for high-value targets, under deliberate verification.
### Persona Development
Build a persona with enough depth to answer follow-up questions. A thin pretext collapses under the first challenge.
```text
Persona Template:
Name: [Realistic for the region and industry]
Role: [IT support, vendor account manager, building inspector]
Organization: [Real vendor the target uses, or plausible third party]
Contact Info: [Burner phone, spoofed email, LinkedIn profile]
Backstory: [Why you are calling/visiting today]
Verification: [What to say if they try to verify your identity]
Fallback: [Graceful exit if the pretext fails]
Example -- IT Support Persona:
Name: Mark Chen
Role: Senior Support Engineer, Contoso IT Services
Backstory: Contoso manages the target's endpoint security.
Calling about a critical vulnerability patch that
requires the user to verify their credentials on
a portal to receive the update.
Verification: "You can check our contract reference CON-2024-0847
with your procurement team."
Fallback: "No problem, I will have your account manager
Sarah reach out to coordinate instead."
```
### Psychological Triggers
Effective social engineering leverages cognitive biases. You apply these deliberately, not randomly.
```text
Authority:
- Impersonate someone with organizational power (CISO, VP, auditor)
- Reference internal projects or systems by name
- Use confident, directive language
Urgency / Scarcity:
- "This must be resolved before end of business today"
- "Your account will be locked if we cannot verify now"
- Artificial deadlines compress the target's decision-making time
Social Proof:
- "I have already confirmed this with your colleague [name]"
- "Everyone in your department has completed this step"
Reciprocity:
- Offer help before making a request ("I fixed that ticket for you")
- Small favors create obligation
Commitment / Consistency:
- Get the target to agree to small requests first
- Escalate to the actual objective after initial compliance
Liking / Rapport:
- Mirror the target's communication style
- Find common ground (shared frustrations, industry knowledge)
- Use their name; reference specifics from OSINT
```
---
## Vishing (Voice Phishing)
Voice calls add a human element that email cannot replicate. The real-time interaction lets you adapt, overcome objections, and build trust dynamically.
### VoIP Infrastructure Setup
Set up a dedicated voice infrastructure that supports caller ID spoofing and call recording.
```bash
# Option 1: Twilio for caller ID manipulation
# Register a Twilio account and purchase a local number
pip install twilio
python3 <<'PYEOF'
from twilio.rest import Client
account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
auth_token = "your_auth_token"
client = Client(account_sid, auth_token)
# Place a call with spoofed caller ID
call = client.calls.create(
to="+1XXXXXXXXXX", # Target number
from_="+1XXXXXXXXXX", # Your Twilio number (displayed)
url="http://your-server.com/twiml/pretext.xml" # TwiML script
)
print(f"Call SID: {call.sid}")
PYEOF
# TwiML script for IVR-style pretext
cat <<'XML' > pretext.xml
<?xml version="1.0" encoding="UTF-8"?>
<Response>
<Say voice="alice">
This is an automated message from your IT security team.
A suspicious login was detected on your account.
Press 1 to verify your identity and secure your account.
</Say>
<Gather numDigits="1" action="/handle-key" method="POST">
<Say>Press 1 now.</Say>
</Gather>
</Response>
XML
```
```bash
# Option 2: Asterisk PBX for full control
# Install Asterisk on a VPS
apt-get install asterisk
# Configure a SIP trunk with a VoIP provider that permits
# caller ID passthrough (check provider TOS for compliance)
# extensions.conf -- route outbound calls with custom CallerID
cat <<'CONF' >> /etc/asterisk/extensions.conf
[outbound-spoof]
exten => _X.,1,Set(CALLERID(num)=2125551234)
exten => _X.,n,Set(CALLERID(name)=TargetCorp IT)
exten => _X.,n,Dial(SIP/trunk/${EXTEN})
exten => _X.,n,Hangup()
CONF
aActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.