<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-social-engineering-penetration-test
description: >-
  Human-layer attack simulation including phishing campaigns, pretexting, vishing, physical tailgating assessments, and security awareness measurement to evaluate organizational resilience against social engineering threats.
domain: cybersecurity
subdomain: security-testing
tags:
  - social-engineering
  - phishing
  - vishing
  - pretexting
  - awareness
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1534", "T1598", "T1656"]
  tools: ["gophish", "evilginx2", "set", "modlishka", "king-phisher"]
---

# Performing Social Engineering Penetration Test

## Overview

Social engineering penetration testing evaluates human security controls through simulated attacks. This includes phishing email campaigns, voice phishing (vishing), pretexting scenarios, and physical social engineering to measure susceptibility and validate security awareness training.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `gophish` | Security tooling |
| `evilginx2` | Security tooling |
| `set` | Security tooling |
| `modlishka` | Security tooling |
| `king-phisher` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Campaign Planning

```bash
# Social engineering campaign scope
cat <<'EOF'
SOCIAL ENGINEERING ENGAGEMENT
==============================
Type:           Phishing simulation
Target Group:   All employees (500 users)
Pretext:        IT password reset notification
Duration:       2 weeks active, 1 week monitoring
Success Metric: Click rate, credential submission rate
Exclusions:     C-suite (separate campaign), contractors

CAMPAIGN PHASES:
1. OSINT on target organization
2. Pretext development and review
3. Infrastructure setup (domains, email)
4. Template creation and testing
5. Phishing deployment (waves)
6. Monitoring and data collection
7. Reporting and awareness debrief
EOF
```

### Step 2: Infrastructure Setup

```bash
# GoPhish phishing platform setup
# Domain registration (similar to target)
# SSL certificate provisioning
# Email sending infrastructure

# GoPhish campaign configuration
cat <<'EOF'
GOPHISH SETUP CHECKLIST
========================
[ ] Sending profile (SMTP configuration)
[ ] Landing page (credential capture or redirect)
[ ] Email template (pretext-aligned)
[ ] User groups (imported from scope)
[ ] Campaign scheduled with sending rate limits
[ ] Tracking enabled (open, click, submit)
EOF

# DNS records for sending domain
# SPF: v=spf1 ip4:SENDING_IP ~all
# DKIM: configured via sending platform
# DMARC: v=DMARC1; p=none (for deliverability)
```

### Step 3: Phishing Execution

```bash
# GoPhish API — launch campaign
curl -X POST https://gophish-server/api/campaigns/ \
  -H "Authorization: Bearer $GOPHISH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Q1 Password Reset",
    "template": {"name": "IT Password Reset"},
    "page": {"name": "Credential Capture"},
    "smtp": {"name": "Sending Profile"},
    "groups": [{"name": "All Employees"}],
    "send_by_date": "2024-02-15T17:00:00Z"
  }'

# Monitor campaign results
curl -s https://gophish-server/api/campaigns/$CAMPAIGN_ID/results \
  -H "Authorization: Bearer $GOPHISH_API_KEY" | jq '.stats'
```

### Step 4: Results Analysis

```bash
# Campaign metrics analysis
cat <<'EOF'
PHISHING CAMPAIGN RESULTS
===========================
Emails Sent:           500
Emails Opened:         312 (62.4%)
Links Clicked:         89  (17.8%)
Credentials Submitted: 34  (6.8%)
Reports to IT:         12  (2.4%)

BY DEPARTMENT:
  Finance:    22% click rate
  Marketing:  19% click rate
  Engineering: 8% click rate
  HR:         15% click rate
  Executive:  N/A (excluded)

RECOMMENDATIONS:
1. Targeted awareness training for Finance dept
2. Implement email banner for external senders
3. Simplify phishing report button workflow
4. Schedule quarterly phishing simulations
EOF
```

## Detection

```yaml
title: Social Engineering Penetration Test Detection
id: adc9c7ee-b8f0-4794-90b8-a161af9b0e10
status: experimental
description: Detects suspicious activity related to performing social engineering penetration test techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*social*"
  condition: selection
level: medium
tags:
  - attack.t1566
  - attack.t1534
  - attack.t1598
  - attack.t1656
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Social Engineering Penetration Test Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1566, T1534, T1598, T1656 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
