I take exception to the generally dry and academic nature in which we discuss this topic on here.But what I understand from social engineering is that there is very little that simply reading will teach you (besides a bunch of facts.) I mean yeah, facts are fun, and they make us sound smarter and we can internalize it and make ourselves feel superior that we somehow magically have the ability to socially engineer people simply by reading a few books
I would rather much have a discussion on real events,
In good faith I'll begin.
My various dealings with a client has lead me to many interesting adventures. I am paid to do market research of a kind for this person.
After two weeks of recon on the type of market research he was after, I noticed that the central contact point that would take me inside their organization would be this individual. Lets call him Steven.
I called up and he answered. I already knew he was at reception/scheduling or what ever his position was called. "Steven is that you?" I asked.
"Uh... how can I help you?"
"Steven Wallaby from Metro DC High?" I throw out a fake highschool name.
"Uh no.. this is Steven Gambino" he answers.
"My apologies! You sounded like an old friend of mine!" I continue with a mundane question.
I have his name, his place of employment, and also his name. I start google dorking through spokeo, radaris, and another site I have a membership to. I pick up a few of his profiles and pull up an older myspace profile out of archive.org. I learn that he's into Queens of the Stone Age, and that he liked skateboarding in the past. He's single, but enjoys hiking.
I have an older Win XP machine with a wonderful tool called Virtual Audio Cable. This thing allows me to take the sound output of one program and use it as the sound input of another. I use a cygwin instance along with a few ffmpeg and sox piped commands to pitch shift my voice to sound like a Woman's. Younger 20's, and pipe it direclty into Ekiga VOIP software.
I use a SOCKS proxy that I found open near by the city of the SIP host. And I dial back into Steve's line.
I start talking to Steve. Mind you I put on one of his favorite Q. ot SA's tracks in the background.
"Hello this is... Steve."
"Oh... oh sorry, hold on a second." I lower the volume on the "track" (still being fed in by virtual audio cable).
"Oh hey Steve, this Belinda. Uhm yeah, I'm new at [sub contractor company] and my manager told me to get a hold of you regarding the new sales slips we were suppose to send to you"
"Uh... yeah, we got them last week, how can I help you."
"Oh gosh, Im such a klutz steve! I think I might have sent you the wrong slips meant for another company and I really need to get a copy of them to see if I sent the right ones, I don't know wha to do."
I become a damsel in distress.
"Do... do you think you can help me? Maybe we can meet up and you can show me the slips or something? I just need to verify you guys got the right ones."
"I don't know...."
I interrupt, "look okay I know this is unorthodox, but how about this. You can fax them over and then we can meet up later at maybe.. Applebees, or [Steve's favorite bar and grill], or [complete hole in the wall]?"
"I'm kinda new to this city so it'd be nice to make a friend or two, i mean if I can keep this job" start sniffling a little here.
"Alright. What was that fax #"
"Oh Steve! Thaaaaank you! The # is xxx-yyy-zzzz ext 1337 and where would you like to meet up and is 8ish alright?"
Steve sounds a bit more confident, "Well that grill you mentioned, lets go there possibly?"
"Sounds great! I heard it was a great place... and you know what steve... drinks are on me! here's my cell # text me kay?"
"Uh yeah... sure thing!"
And in the most earnest audio enhanced fake voice that I can muster, "Honestly, thank you Steve, you really did save my hide here.... I owe you sooo much. See you soon."