Pretext for a social engineering attack

- The first question you should ask yourself before crafting a social engineering attack is, should I use social engineering? How do I approach attacks in general and decide which ones are best? And there's a lot of different answers, and social engineering may the right answer. Oftentimes, it's easier to trick a human than it is to trick a computer. To carefully construct the right attack means to look at the softest spots, and if you find that the softest spot is the human and you feel better about crafting social engineering attacks, that may mean that you should look there first. We know that most people want to be helpful, so that might be a good way to get your foot in the door, so to speak. On the other hand, if you do a simple scan and you find out that they're running a really old and insecure version of Apache or IIS, that may be the place to go. So you need to ask yourselves those questions. The idea behind social engineering is to try to attack the human, to encourage them to do your dirty work for you, and when that is an easier path, that might be the reason why you want to go in that direction. So how do you build a pretext as the attacker or as the pentester for a social engineering attack? You would encourage victims to do at least part of the work for you. In fact, that's the nature of a social engineering attack. You trick users or encourage users to do your dirty work. You only should resort to technical exploits to carry out what social engineering cannot do, 'cause again, social engineering can be a lot easier. It can be less intensive. You want to build a storyline that sounds plausible and encourages victims to not only respond, but also to participate. Make them part of the story. Make them part of the solution. Social engineering all depends on three things, urgency and need, and the consequences of inaction. If these building blocks seem to fit in line with your environment and your skillset, then a social engineering attack may be the best place to start.