Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 29 guests and 1 member online
You are here:
Home
Columns
Hadnagy
[Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
EH-Net
May 23, 2013, 12:53:48 AM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Columns
>
Hadnagy
(Moderator:
don
) >
[Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
Pages: [
1
]
Go Down
« previous
next »
Print
Author
Topic: [Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer (Read 3767 times)
0 Members and 1 Guest are viewing this topic.
don
Editor-In-Chief
Administrator
Hero Member
Offline
Posts: 4167
Editor-In-Chief
[Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
«
on:
February 24, 2012, 01:07:41 PM »
In our continuing series of articles on making you a better head hacker, he's some great advice on where to get skills that won't be taught in a tech manual.
Your homework this month is to share with us your stories of how your own acting prowess helped you in social engineering... even if not for a pen test.
As an example, I did a lot of acting when in HS and college. I can honestly say that it not only allowed me to pass over the biggest fear most people have, public speaking, but it also gave me the confidence in delivering a written line. These skills help me pretty much every day in my business life as it makes me comfortable speaking, hosting webcasts and making business calls. People often mention that I social engineer my way into getting all of the great Monthly Giveaways here on EH-Net. That's not far from the truth.
Your turn...
Permanent Link:
[Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
Quote
Chris Hadnagy
Social Engineering is a complex beast. It is not simply lying or telling someone a deceitful story to get them to give over their passwords. Social Engineering (SE) is defined, well at least by me, as any act that influences a person to take an action that may or may not be against their best interest. With that definition in mind there are many different principles that influence SE and the skills needed both physically and psychologically.
The concept behind this column is to provide the tools, techniques and direction to the readers that would like to either incorporate more SE into their current work or to become a full-time social engineer. I would like to take this month’s article to talk about at least one of the psychological principles involved in SE that should be considered foundational and required. It makes a huge difference in your ability to be successful.
Have fun with this one,
Don
Logged
CISSP, MCSE, CSTA, Security+ SME
ajohnson
Recruiters
Hero Member
Offline
Posts: 1057
aka dynamik
Re: [Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
«
Reply #1 on:
February 24, 2012, 01:58:38 PM »
One of my personal favorite SE stories was going on-site as a "pest inspector." I met with the client the morning before the engagement, and they candidly told me that they didn't expect me to get into any of the locations because they have such a good security program (it actually indeed turned out to be above average compared to what I usually see). Challenge accepted!
I had an approximate 40-minute drive to the first location, so I had a bit of time to do some scheming. I had already sent fake emails to the local managers informing them of the inspection, which usually goes a long way if they're well done (I bought a similar domain, that used alternate letters, that was virtually indistinguishable from the real one, and I used the ops manager's name, signature, and formatting), but I felt I needed to go a little further for this engagement.
I ended up stopping by a grocery store and picking up a box of pastries for each location. As soon as I went into each location, I told the manager how much we appreciated their business in this economy and how much we valued them as a new customer. Not only did the managers go for it, but I'd randomly see people walking around the facilities with the pastries, and they'd exclaim, "Did you bring these!? Thank you so much!"
I was everyone's best friend and was able to go wherever I wanted, unescorted. It was utter annihilation. I also learned that sensitive information is worth as much as a box of pastries. It reminded me of the study where people shared their passwords in exchange for candy bars.
Like the article says, confidence is key. I don't consider myself to be "smooth" by any stretch of the imagination, but I was able to remain cool and collected despite the butterflies in my stomach going out of control, and that's what sells it.
Logged
WIP: GCFA |
www.infosiege.net
| @infosiege
The day you stop learning is the day you start becoming obsolete.
lorddicranius
Sr. Member
Offline
Posts: 447
Re: [Article]-Look Mom, I`m a Thespian: How to Use Acting Skills as a Social Engineer
«
Reply #2 on:
February 29, 2012, 01:23:46 AM »
I love reading SE stories
I'm thinking about other scenarios where acting comes into play and one scenario that comes to mind is the simple trick of "hey, look!" while you point behind the person you're trying to get to turn around. I can see how actions needs to back up words in this scenario, and can also be accomplished without the use of words. A facial expression to express bewilder instead of just yelling "hey, look!", the slight turning of your head in the direction you want them to look, maybe jutting your head forward just a tad in that direction as well.
Anyway, just some thoughts I thought I'd share
Logged
GSEC, eCPPT, Sec+
Pages: [
1
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
Editor-In-Chief
: Special Xmas Deal: 10% Off eLearnSecurity Courses
(3) by
hekvvddtest
Greetings
: Hello
(6) by
hekvvddtest
Greetings
: Obtain The Scoop On mulberry bags Before You Are Too Late
(13) by
hekvvddtest
Calendar Of Events
: HITBSecConf2013 – Amsterdam
(9) by
hekvvddtest
Special Events
: [Article]-Webcast: Deep Dive into Red Teaming with the Metasploit Framework
(19) by
hekvvddtest
Network Pen Testing
: HackaServer - Anyone tried it?
(4) by
hekvvddtest
Greetings
: Good day ...
(7) by
hekvvddtest
Gates
: Chris Gates' Blog RSA Finalist
(5) by
hekvvddtest
Network Pen Testing
: Ruby on Rails Vulnerabilities / Attacks in BackTrack 5 r3
(1) by
hekvvddtest
General Certification
: nth topic on Career Advice
(9) by
hekvvddtest
General Certification
: Direction
(5) by
hekvvddtest
Hardware
: Discreet Hacking Devices
(8) by
hekvvddtest
Calendar Of Events
: CanSecWest 2013
(5) by
hekvvddtest
Forensics
: Burn Note
(5) by
hekvvddtest
Calendar Of Events
: Cyber Readiness Challenge - Rome
(1) by
hekvvddtest
GCIH - GIAC Certified Incident Handler
: GCIH Free Practice test attempt
(0) by
prats84
GCIH - GIAC Certified Incident Handler
: Passed my GCIH
(0) by
prats84
News Items and General Discussion About EH-Net
: Change is Coming to EH-Net!!
(27) by
don
Greetings
: Hi from the UK
(2) by
n37sh@rk
Network Pen Testing
: AIX Vulnerability Assessments
(2) by
ras76
Tutorials
: Need guidance
(9) by
hanyhasan
Programming
: Finished Python Course in Codecademy now what?
(15) by
hanyhasan
Network Pen Testing
: De-ICE 1.140 released!
(2) by
superkojiman
General Certification
: CPT Practical Submission
(1) by
UNIX
OSCP - Offensive Security Certified Professional
: Failed my first attempt at the OSCP exam
(94) by
azmatt
Tools
: Social-Engineer Toolkit (SET) Version 5.0 “The Wild West” Released
(2) by
m0wgli
Malware
: EICAR?
(3) by
UKSecurityGuy
Advisories
: HTB23154: Multiple Vulnerabilities in Exponent CMS
(0) by
AndyP
Advisories
: HTB23153: Multiple Vulnerabilities in Jojo CMS
(0) by
AndyP
Advisories
: HTB23151: Cross-Site Request Forgery (CSRF) in UMI.CMS
(0) by
AndyP
OSCP - Offensive Security Certified Professional
: Class Scheduled 6/8 - Linux n00b
(7) by
Taemyks
OSCP - Offensive Security Certified Professional
: OSCP exam scheduled
(6) by
gbhat
Incident Response
: LinkedIn Forensics
(0) by
AFENTIS_Forensics
General Certification
: Red Team/Blue Team
(1) by
ajohnson
Career Central
: Starter cert?
(3) by
Grendel
Network Pen Testing
: Beginner Ethical Hacker
(1) by
m0wgli
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
Free Business and Tech Magazines and eBooks
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.