In this section I will be talking about social engineering also known as non-technical attack in social
engineering.
We are compromising system screw people so let me give you a small example.
Assume that your target is a very secure network whereas a network administrator has implemented all
security appliance and best practice and they have a firewall.
Ideas have same solution so they have all kinds of protection.
We all know that nothing is secured 100 percent but you may spend days or maybe weeks try to compromise
this network or and instead I can just send an email to one of the employees.
With the Lincoln side or a PDA attach and once he opens his BGF or click on the link I compromised the
network.
What do you think is easier especially that people security awareness are very weak so people trust
e-mail blindly.
They never think that e-mail can be fake.
And I'm going to show you on the next lecture that there is a lot of Web site and application and most
of them are free that allow you to send fake e-mail.
So you may receive an e-mail coming from your showing that is coming from your manager.
And actually it's a fake e-mail.
And as people trust e-mail blindly as I just mentioned you know they will follow whatever is inside
this e-mail even mobile number.
Now there is some applications that spoofs a mobile number and the estimates.
So the tools that is available right now for social engineering are quite easy to use and anyone can
manipulate it and they did as I was saying depend on the weak security knowledge that people have.
So I can send them an e-mail just open the e-mail and I can make it very convenient to open and follow
the e-mail by faking the e-mail and showing that it's coming from his manager and so on.
And once it click on the e-mail I get can I can I will compromise Senator the social engineering depend
on mainly two things fake e-mail and fake Web site.
And you're going to see some tools during the sessions that create fake e-mail.
Very convenient.
And you're gonna see another tool that creates a fake Web site and it can be for capturing user name
or password or it can have some payloads that whenever there's a victim open so I compromised his computer
or it can be I mean it has a lot of feature.
So it's a very important from my point of view.
Very important section because the last 10 or 15 years the major hacking incidents that we have been
following was caused because of people not because of technology.
Sunny it was because of people are as a because of people Aramco Saudi Arabia somehow because of people.
So the measure was one was because of people not technology.
So this need to give some attention in any security implementations.
That's why most of the framework right now like ISO twenty seven thousand and one and a different kind
of information security our information security framework they enforce management to give a training
security audience training for all of their employees because they know they know that people are the
weakness in any system not the technology people.
So what would be the topic of this module first lecture.
I'm gonna show you some tools that allow you to spoof e-mail.
So you know just to show you how easy it is to find a tool or a Web site that allow you to fake it and
then you should never trust e-mail blindly.
Okay.
And then we gonna use a amazing tool Intel Linux which is the social engineering tool kit also known
as set.
This tool actually it's in Kelly Linux and was in backtrack before and it was in Jinich track.
But Kelly Linux has some additional features at all.
But before start showing you how to use social engineering and I know that I explained this topic in
different courses before but here I'm going to explain some advanced technique using social engineering
toolkit.
But before I start using it I'm gonna do a lecture to how to fix it.
I mean if you in this tool Kelly Linux by default social engineering or toolkit or set may need some
sitting or may need to be fixed somehow.
So I'm going to the first lecture will be if the set is not working properly how to fix it and then
the upcoming lecture in this section would be different attack using social engineering toolkit.
So let's see how to use social engineering toolkit as a social engineering tool.