Sometimes social engineering and physical intrusion of a company is part of a
larger scope of work, often referred to as red teaming.
This is a larger sophisticated attack simulation.
As part of these styles of assessment, it is often required to infiltrate
equipment and even other colleagues into a target site.
Here are a few examples of assets I have infiltrated into clients.
Both of these devices are based on Raspberry Pi, a small
form factor computer that have Wi‑Fi access points and are
easy to plug into target networks.
These can be used by yourself or your colleagues to
remotely access the target network.
Remember to ensure that only you have access to these devices. Ensure strong
passwords and certificate‑based logins are implemented or you may accidentally
invite criminals directly into the client's network.
Exfiltration of data and assets can also be part of the scoped work.
Depending on the item or the data, this can range from very easy through
two incredibly tough. Remember to stay in scope and to remove only those
items that have been agreed with the client and those that will not
cause a business impact.