conducting-social-engineering-penetration-test

Featured

Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Conducting Social Engineering Penetration Test ## Overview Social engineering penetration testing assesses an organization's human attack surface through controlled simulation of real-world deception techniques. According to Verizon DBIR 2024, the human element is involved in approximately 68% of all breaches, with phishing remaining the dominant initial access vector. This skill covers phishing, vishing (voice phishing), smishing (SMS phishing), and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx. ## When to Use - When conducting security assessments that involve conducting social engineering penetration test - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing ## Prerequisites - Written authorization from senior management (CISO/CTO) - Legal review confirming compliance with local laws (CFAA, GDPR, etc.) - Defined scope: target employee groups, attack types, exclusions - GoPhish server, domain for phishing infrastructure, VPS - OSINT tools: Maltego, theHarvester, LinkedIn scraping tools - Coordination with HR and Legal for employee notification post-test ## Phase 1 — OSINT and Target Profiling ### Employee Reconnaissance ```bash # Email harvesting theHarvester -d targetcorp.com -b all -l 500 -f harvester_results # LinkedIn OSINT (manual + tools) # Gather: nam...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

conducting-social-engineering-pretext-call

Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.

12,642 Updated today
mukul975
AI & Automation Featured

executing-phishing-simulation-campaign

Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.

12,642 Updated today
mukul975
AI & Automation Featured

conducting-spearphishing-simulation-campaign

Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf

12,642 Updated today
mukul975
AI & Automation Featured

conducting-internal-network-penetration-test

Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.

12,642 Updated today
mukul975
AI & Automation Featured

conducting-network-penetration-test

Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.

12,642 Updated today
mukul975