<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-social-engineering-pretexting
description: >-
  Develop social engineering pretexts using OSINT-derived intelligence to
  craft convincing phishing scenarios, vishing scripts, and impersonation
  campaigns for authorized red team engagements.
domain: cybersecurity
subdomain: osint-recon
tags:
  - social-engineering
  - pretexting
  - phishing
  - vishing
  - impersonation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  GoPhish, SET (Social Engineering Toolkit), King Phisher, Evilginx2,
  theHarvester, LinkedIn OSINT, Hunter.io, Twilio API.
metadata:
  mitre-attack:
    - "T1566.001"  # Phishing: Spearphishing Attachment
    - "T1566.002"  # Phishing: Spearphishing Link
    - "T1598"      # Phishing for Information
    - "T1585.001"  # Establish Accounts: Social Media Accounts
---

# Conducting Social Engineering Pretexting

## Overview

Social engineering pretexting constructs believable scenarios to manipulate
targets into divulging information, clicking links, or performing actions.
Effective pretexts are built on thorough OSINT — understanding the target's
role, relationships, communication patterns, and organizational context.
This technique covers pretext development methodology, intelligence gathering
for scenario crafting, and campaign tooling for authorized engagements.

## Prerequisites

- GoPhish for phishing campaign management
- Social Engineering Toolkit (SET) for payload delivery
- theHarvester and CrossLinked for target intelligence
- Evilginx2 for advanced phishing proxying
- Domain and email infrastructure for campaign delivery
- Written authorization (scope document) for all activities

```bash
go install github.com/gophish/gophish@latest
git clone https://github.com/trustedsec/social-engineer-toolkit.git
pip install theHarvester requests
```

## Quick Reference

| Task | Command |
|------|---------|
| Harvest targets | `theHarvester -d target.com -b linkedin,google -l 200` |
| Email format | `curl -s "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=$HUNTER_KEY"` |
| GoPhish start | `./gophish` |
| SET console | `sudo setoolkit` |
| Clone site | `httrack https://target.com/login -O ./clone/ -r2` |
| Domain typo | `dnstwist target.com --registered --format json` |
| Evilginx | `evilginx2 -p ./phishlets/ -t ./redirectors/` |
| Email verify | `curl -s "https://api.hunter.io/v2/email-verifier?email=user@target.com&api_key=$HUNTER_KEY"` |

## Workflow

### Step 1: Target Intelligence Gathering

```bash
# Identify key personnel and roles
theHarvester -d target.com -b linkedin,google,bing -l 500 -f target_intel.json

# Map organizational structure
crosslinked -f '{first}.{last}@target.com' "Target Corporation" -o employees.txt

# Identify email naming convention
curl -s "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=$HUNTER_KEY" \
  | jq '{pattern: .data.pattern, sample: [.data.emails[:5][].value]}'

# Research recent organizational events
# - Press releases, job postings, mergers, compliance deadlines
# - Technology migrations, vendor changes, new tooling
```

### Step 2: Pretext Development

Build scenario based on gathered intelligence:

```markdown
## Pretext Template

**Scenario**: IT Department Password Reset
**Trigger**: Quarterly compliance review (align with real audit cycle)
**Persona**: IT Help Desk (use real team naming conventions)
**Urgency**: "Action required by [date] per compliance policy [real policy name]"
**Technical credibility**: Reference actual tools/systems in use at target
**Call-to-action**: Click link to "verify" credentials via cloned portal

## Pretext Scoring Criteria
- Relevance to target's role: [1-5]
- Organizational context accuracy: [1-5]
- Urgency/authority balance: [1-5]
- Technical plausibility: [1-5]
- Detection resistance: [1-5]
```

### Step 3: Infrastructure Setup

```bash
# Register lookalike domain
dnstwist target.com --registered --format json -o typosquats.json

# Configure GoPhish campaign
curl -X POST "https://localhost:3333/api/campaigns/" \
  -H "Authorization: Bearer $GOPHISH_KEY" \
  -H "Content-Type: application/json" \
  -d @campaign.json

# Clone login portal
httrack "https://target.com/login" -O ./portal_clone/ -r2 +*.css +*.js +*.png

# Setup credential capture
# Configure GoPhish landing page with form capture
```

### Step 4: Campaign Execution

```bash
# Launch phishing campaign via GoPhish API
curl -X POST "https://localhost:3333/api/campaigns/" \
  -H "Authorization: Bearer $GOPHISH_KEY" \
  -d '{
    "name": "Q1 Compliance Review",
    "template": {"name": "IT Password Reset"},
    "page": {"name": "Target Login Clone"},
    "smtp": {"name": "Campaign SMTP"},
    "groups": [{"name": "Target Employees"}],
    "launch_date": "2026-03-20T09:00:00Z"
  }'

# Monitor campaign results
curl -s "https://localhost:3333/api/campaigns/$CAMPAIGN_ID/results" \
  -H "Authorization: Bearer $GOPHISH_KEY" | jq '.results[] | {email, status}'
```

### Step 5: Results Analysis

```bash
node agent.js --domain target.com --campaign-results results.json --output report.json
```

## Detection Opportunities

- Email authentication (SPF/DKIM/DMARC) catches spoofed messages
- URL reputation services flag newly registered domains
- Evilginx2 proxying creates detectable TLS certificate patterns
- Security awareness trained employees report suspicious emails

## Verification

- [ ] Target intelligence sufficient for credible pretext
- [ ] Pretext scenario scores 4+ on all criteria
- [ ] Campaign infrastructure configured and tested
- [ ] Written authorization confirmed before launch
- [ ] Metrics captured: open rate, click rate, credential submission
- [ ] Campaign teardown and reporting completed

## References

- [GoPhish](https://getgophish.com/)
- [Social Engineering Toolkit](https://github.com/trustedsec/social-engineer-toolkit)
- [Evilginx2](https://github.com/kgretzky/evilginx2)
- [dnstwist](https://github.com/elceef/dnstwist)
- [Hunter.io](https://hunter.io/api-documentation)

---
v1.0 | Validated: 2026-03-17
