<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-smishing-assessments
description: >-
  Design and execute SMS phishing assessments to test resilience against text-based social engineering.
domain: cybersecurity
subdomain: social-engineering
tags:
  - smishing
  - sms-phishing
  - social-engineering
  - mobile-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Conducting Smishing Assessments

## Overview

Design and execute SMS phishing assessments to test resilience against text-based social engineering.

## Prerequisites

| Requirement | Install |
|---|---|
| SMS gateway | Authorized platform |
| Link tracking | URL shortener |
| Python 3.10+ | For agent tooling |

## Key Concepts

Smishing uses SMS to trick targets into clicking malicious links.
Assessments measure click rates, data submission rates, and
reporting behavior across departments.

## Quick Reference

```bash
node agent.js create --campaign package-delivery --template delivery-notice
node agent.js send --campaign package-delivery --targets phones.csv
node agent.js monitor --campaign package-delivery
node agent.js report --campaign package-delivery
```

## Workflow

1. Define scope and authorized numbers
2. Create SMS templates
3. Set up tracking links
4. Send with staggered delivery
5. Monitor click rates
6. Track reporting
7. Compile results

## Verification

- Verify SMS delivery
- Confirm tracking captures clicks
- Validate landing page
- Check real-time metrics
- Verify department analysis

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
