Social Engineering is the art of manipulating humans to disclose sensitive information. Humans are usually the weakest link in the security chain and can easily be tricked into giving information.
That is why social engineering exploits the human tendency to trust. Social engineers usually appear respectable and trustworthy, and use flattery, flirtation, friendliness and conformity in order to persuade a target to disclose information. Most social engineers ask for small bits of information and assemble them together to gain a better knowledge of the company and effectively infiltrate it.
When someone proves being helpful, people instantly trust that person. This is heavily exploited by social engineers. Such an example is offering to fix and optimize an employee 's computer while stealthily installing malware on their machine. Public information about the company helps greatly in a social engineering penetration test. If a social engineer was to introduce himself as one of the employees of the company whose information he found using web searches, they might appear as if they 're employed in the company and fool the door guards. Pretending to have lost the key code and asking a friendly employee to let you in might also work.
Some of the most popular social engineering techniques:
• Pretexting
Pretexting is a form of social engineering where the social engineer comes up with an elaborate lie to seem convincing and confident when manipulating an individual to obtain