<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Social Engineering Assessments

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js scope --vectors email,vishing,physical --targets departments.json` | Define assessment scope |
| `node agent.js pretext --vector vishing --target helpdesk` | Generate pretext for vishing attack |
| `node agent.js execute --plan assessment-plan.json --vector email` | Execute assessment phase |
| `node agent.js report --assessment-id SA-2026-001 --format detailed` | Generate assessment report |

### Examples

```bash
# Primary workflow
node agent.js scope --vectors email,vishing,physical --targets departments.json

# Secondary analysis
node agent.js pretext --vector vishing --target helpdesk

# Generate deliverable
node agent.js execute --plan assessment-plan.json --vector email

# Measure and report
node agent.js report --assessment-id SA-2026-001 --format detailed
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| GoPhish | `gophish-cli --launch` | Email phishing simulation |
| SET | `setoolkit` | Social Engineering Toolkit |
| dnstwist | `dnstwist --registered target.com` | Lookalike domain detection |

## Assessment Vectors

| Vector | Tools | Success Indicator |
|---|---|---|
| Email phishing | GoPhish, custom SMTP | Credential submission |
| Vishing | Spoofed caller ID | Information disclosure |
| Smishing | SMS gateway | Link click / credential |
| Physical | Badge clone, tailgate | Unauthorized access |
| USB drop | Rubber ducky, USB drives | Device execution |
| Pretexting | Custom scenarios | Policy bypass |
