Ethical Hacking

  1. Social Engineering
    1. Psychological Principles
      1. Influence and Persuasion
        1. Authority Principle
          1. Impersonating Authority Figures
            1. Creating False Authority
            2. Social Proof Principle
              1. Consensus Building
                1. Bandwagon Effect
                2. Commitment and Consistency
                  1. Commitment Escalation
                    1. Consistency Exploitation
                    2. Reciprocity Principle
                      1. Creating Obligation
                        1. Gift and Favor Tactics
                        2. Liking Principle
                          1. Similarity Building
                            1. Compliment Tactics
                            2. Scarcity Principle
                              1. Limited Time Offers
                                1. Exclusive Opportunities
                              2. Cognitive Biases
                                1. Confirmation Bias
                                  1. Anchoring Bias
                                    1. Availability Heuristic
                                      1. Authority Bias
                                      2. Trust Exploitation
                                        1. Trust Building Techniques
                                          1. Trust Transfer Methods
                                            1. Institutional Trust Abuse
                                          2. Human-Based Social Engineering
                                            1. Impersonation Attacks
                                              1. Identity Theft
                                                1. Employee Impersonation
                                                  1. Vendor Impersonation
                                                    1. Authority Figure Impersonation
                                                    2. Pretexting
                                                      1. Scenario Development
                                                        1. Background Research
                                                          1. Conversation Management
                                                          2. Elicitation Techniques
                                                            1. Information Gathering
                                                              1. Casual Conversation Exploitation
                                                                1. Professional Networking Abuse
                                                              2. Physical Social Engineering
                                                                1. Tailgating and Piggybacking
                                                                  1. Physical Access Bypass
                                                                    1. Security Control Circumvention
                                                                    2. Dumpster Diving
                                                                      1. Information Recovery
                                                                        1. Document Analysis
                                                                          1. Digital Media Recovery
                                                                          2. Shoulder Surfing
                                                                            1. Password Observation
                                                                              1. Sensitive Information Capture
                                                                              2. Lock Picking and Bypass
                                                                                1. Physical Security Testing
                                                                                  1. Lock Manipulation Techniques
                                                                                2. Telephone-Based Attacks
                                                                                  1. Vishing (Voice Phishing)
                                                                                    1. Caller ID Spoofing
                                                                                      1. Voice Manipulation
                                                                                        1. Interactive Voice Response Abuse
                                                                                        2. Phone System Exploitation
                                                                                          1. Voicemail Hacking
                                                                                            1. Conference Bridge Abuse
                                                                                              1. PBX System Attacks
                                                                                          2. Technology-Based Social Engineering
                                                                                            1. Email-Based Attacks
                                                                                              1. Phishing Campaigns
                                                                                                1. Mass Phishing
                                                                                                  1. Targeted Phishing
                                                                                                    1. Business Email Compromise
                                                                                                    2. Spear Phishing
                                                                                                      1. Target Research
                                                                                                        1. Personalized Attacks
                                                                                                          1. Executive Targeting
                                                                                                          2. Whaling Attacks
                                                                                                            1. C-Level Executive Targeting
                                                                                                              1. High-Value Target Identification
                                                                                                              2. Email Spoofing
                                                                                                                1. Sender Impersonation
                                                                                                                  1. Domain Spoofing
                                                                                                                    1. Display Name Spoofing
                                                                                                                  2. Web-Based Attacks
                                                                                                                    1. Watering Hole Attacks
                                                                                                                      1. Website Compromise
                                                                                                                        1. Targeted Malware Delivery
                                                                                                                        2. Fake Websites
                                                                                                                          1. Credential Harvesting Sites
                                                                                                                            1. Malware Distribution Sites
                                                                                                                            2. Search Engine Manipulation
                                                                                                                              1. SEO Poisoning
                                                                                                                                1. Malicious Advertisement
                                                                                                                              2. Mobile-Based Attacks
                                                                                                                                1. SMS Phishing (Smishing)
                                                                                                                                  1. Text Message Attacks
                                                                                                                                    1. Mobile Malware Distribution
                                                                                                                                    2. Mobile Application Attacks
                                                                                                                                      1. Fake Application Distribution
                                                                                                                                        1. Application Impersonation
                                                                                                                                      2. Physical Media Attacks
                                                                                                                                        1. USB Baiting
                                                                                                                                          1. Malicious USB Distribution
                                                                                                                                            1. Autorun Exploitation
                                                                                                                                            2. CD/DVD Baiting
                                                                                                                                              1. Physical Media Distribution
                                                                                                                                                1. Social Engineering Payloads
                                                                                                                                            3. Social Engineering Defense
                                                                                                                                              1. Security Awareness Training
                                                                                                                                                1. Phishing Simulation
                                                                                                                                                  1. Social Engineering Recognition
                                                                                                                                                    1. Incident Reporting Procedures
                                                                                                                                                    2. Technical Controls
                                                                                                                                                      1. Email Security Solutions
                                                                                                                                                        1. Web Filtering
                                                                                                                                                          1. Endpoint Protection
                                                                                                                                                          2. Policy and Procedures
                                                                                                                                                            1. Information Handling Policies
                                                                                                                                                              1. Verification Procedures
                                                                                                                                                                1. Incident Response Plans

                                                                                                                                                            Previous

                                                                                                                                                            5. Wireless Network Security

                                                                                                                                                            Go to top

                                                                                                                                                            Next

                                                                                                                                                            7. Mobile Device Security