Performing Social Engineering

When to Use

• Phishing campaign execution
• Credential harvesting operations
• Social engineering assessments
• Red team engagements
• Security awareness testing

When NOT to Use

• Any campaign without written authorization and a defined scope — stop
• Technical exploitation after a click — use the relevant post-exploitation skill
• Analyzing a phishing email you received — use analyzing-phishing-emails (headers, links, attachments); analyzing-malware for a detonated payload

Phishing Infrastructure