Chap 8 - Exploiting Physical and Social Vulnerabilities

Question 1

Mike wants to enter an organization’s high‐security data center. Which of the following techniques is most likely to stop his tailgating attempt?

A. Security cameras
B. A security vestibule
C. An egress sensor
D. An RFID badge reader

Answer 1

A security vestibule

A security vestibule allows only one individual through at a time, with doors at either end that unlock and open one at a time. It will prevent most piggybacking or tailgating behavior unless employees are willfully negligent.

Question 2

Which of the following technologies is most resistant to badge cloning attacks if implemented properly?

A. Low‐frequency RFID
B. Magstripes
C. Medium‐frequency RFID
D. Smartcards

Answer 2

Smartcards

Most organizations continue to use RFID or magnetic stripe technology for entry access cards, making a penetration tester’s job easier, since both technologies can be cloned. Smartcards are far more difficult to clone if implemented properly.

Question 3

Jen has been contracted to perform a penetration test against Flamingo, Inc. As part of her penetration test, she has been asked to conduct a phishing campaign and to use the results of that campaign to gain access to Flamingo systems and networks. The scope of the penetration test does not include a physical penetration test, so Jen must work entirely remotely.

Jen wants to deploy a malicious website as part of her penetration testing attempt so that she can exploit browsers belonging to employees. What framework is best suited to this?

A. Metasploit
B. BeEF
C. SET
D. OWASP

Answer 3

BeEF

The Browser Exploitation Framework, or BeEF, is specifically designed for this type of attack. Jen can use it to easily deploy browser exploit tools to a malicious website and can then use various phishing and social engineering techniques to get Flamingo employees to visit the site.

Question 4

BeEF

Answer 4

The Browser Exploitation Framework (BeEF) is a penetration testing tool used to exploit web browsers. It allows attackers to hook browsers when users visit a BeEF-enabled site, providing tools to gather browser details, detect settings, execute commands, and potentially exploit browser vulnerabilities​​.

Question 5

SET

Answer 5

The Social Engineering Toolkit (SET) is a menu-driven framework designed for automating social engineering attacks, including spear phishing, website cloning, and infectious media creation. It integrates with tools like Metasploit and is pre-installed in Kali Linux, making it a powerful resource for penetration testers

Question 6

Jen has been contracted to perform a penetration test against Flamingo, Inc. As part of her penetration test, she has been asked to conduct a phishing campaign and to use the results of that campaign to gain access to Flamingo systems and networks. The scope of the penetration test does not include a physical penetration test, so Jen must work entirely remotely.

After attempting to lure employees at Flamingo, Inc., to fall for a phishing campaign, Jen finds that she hasn’t acquired any useful credentials. She decides to try a USB key drop. Which of the following Social‐Engineer Toolkit modules should she select to help her succeed?

A. The website attack vectors module
B. The Infectious Media Generator
C. The Mass Mailer Module
D. The Teensy USB HID attack module

Answer 6

The Infectious Media Generator

Jen should use the infectious media generator tool, which is designed to create thumb drives and other media that can be dropped on‐site for employees to pick up. The Teensy USB HID attack module may be a tempting answer, but it is designed to make a Teensy (a tiny computer much like an Arduino) act like a keyboard or other human interface device rather than to create infected media. Creating a website attack or a mass mailer attack isn’t part of a USB key drop.

Question 7

What are the modules in the SET?

Answer 7

1. Spear-Phishing Attack Vectors
2. Website Attack Vectors
3. Infectious Media Generator
4. Create a Payload and Listener
5. Mass Mailer Attack
6. Teensy USB HID Attack Vector
7. SMS Spoofing Attack Vector
8. Wireless Access Point Attack Vector
9. Third Party Modules
10. Update the Metasploit Framework
11. Update the Social-Engineer Toolkit
12. Help, Credits, and About
13. Exit the Social-Engineer Toolkit

Question 8

Frank receives a message to his cell phone from a phone number that appears to be from the IRS. When he answers, the caller tells him that he has past due taxes and is in legal trouble. What type of social engineering attack has Frank encountered?

A. A spear phishing attack
B. A whaling attack
C. A vishing attack
D. A SMS phishing attack

Answer 8

A vishing attack

Frank has encountered a vishing attack, a type of attack conducted via phone that often relies on a perception of authority and urgency to acquire information from its targets. A spear phishing attack targets specific individuals or groups, and whaling attacks are aimed at VIPs—neither of which are indicated in the question. The attack is via voice, not SMS, ruling that answer out too.

Question 9

Vishing

Answer 9

Vishing, or voice phishing, is a form of social engineering conducted over the phone. It often uses caller ID spoofing to make the calls appear more believable, with the goal of obtaining sensitive information like credentials

Question 10

Cameron sends a phishing email to all of the administrative assistants in a company. What type of phishing attack is he conducting?

A. Whaling
B. Vishing
C. A watering hole attack
D. Spear phishing

Answer 10

Spear phishing

Spear phishing is targeted to specific populations, in this case, administrative assistants. Whaling targets VIPs, vishing is done via phone calls, and a watering hole attack leverages a frequently visited site or application.

Question 11

Spear Phishing

Answer 11

Spear phishing is a targeted phishing attack that aims at specific individuals rather than a broader group, leveraging details about the target to increase the attack’s credibility

the book also says: Spear phishing is targeted to specific populations, in this case, administrative assistants. Whaling targets VIPs, vishing is done via phone calls, and a watering hole attack leverages a frequently visited site or application.

Question 12

Which social engineering motivation technique relies on persuading the target that other people have behaved similarly and thus that they could too?

A. Likeness
B. Fear
C. Social proof
D. Reciprocation

Answer 12

Social proof

Social proof relies on persuading an individual that they can behave in a way similar to what they believe others have. A social proof scenario might involve explaining to the target that sharing passwords was commonly done among employees in a specific circumstance or that it was common practice to let other staff in through a secure door without an ID.

Question 13

Megan wants to clone an ID badge for the company that she is performing a penetration test against. Which of the following types of badge can be cloned without even touching it?

A. Magstripe
B. Smartcard
C. RFID
D. CAC

Answer 13

RFID

RFID badges are wireless and can sometimes be cloned from distances up to a few feet away. Magstripe cards need to be read with a magnetic stripe reader, smartcards provide additional security that make them difficult to clone, and CAC cards are the U.S. government’s smartcard implementation.

Question 14

CAC

Answer 14

CAC stands for Common Access Card, which is the U.S. government’s implementation of a smartcard used for secure access to systems and facilities​

Question 15

Allan wants to gain access to a target company’s premises but discovers that his original idea of jumping the fence probably isn’t practical. His new plan is to pretend to be a delivery person with a box that requires a personal signature from an employee. What technique is he using?

A. Authority
B. Pretexting
C. Social proof
D. Likeness

Answer 15

Pretexting

Allan is using a pretext to gain access to the organization. Claiming to be a delivery person who needs a specific signature may get him past the initial security for the organization. He is not claiming particular authority, providing social proof that others allow him in, or claiming he is similar to the security person or receptionist.

Question 16

Pretexting

Answer 16

Pretexting is a social engineering technique where an attacker creates a fictional situation to gain access to information or facilities, often relying on believability to deceive the target

Question 17

What occurs during a quid pro quo social engineering attempt?

A. The target is offered money.
B. The target is asked for money.
C. The target is made to feel indebted.
D. The penetration tester is made to feel indebted.

Answer 17

The target is made to feel indebted.

A quid pro quo attempt relies on the social engineer offering something of perceived value so that the target will feel indebted to them. The target is then asked to perform an action or otherwise do what the penetration tester wants them to do.

Question 18

quid pro quo attack

Answer 18

A quid pro quo attack in social engineering involves the attacker offering something of perceived value to the target, which creates a sense of indebtedness, prompting the target to perform an action or grant access desired by the attacker

Question 19

Steve inadvertently sets off an alarm and is discovered by a security guard during an on‐site penetration test. What should his first response be?

A. Call the police.
B. Attempt to escape.
C. Provide his pretext.
D. Call his organizational contact.

Answer 19

Provide his pretext.

Once a penetration tester is caught, their first response should be to provide their pretext. A successful social engineering attempt at this point can salvage the penetration test attempt. If that doesn’t work, calling the organizational contact for a “get out of jail free” response may be the only option in a difficult situation.

Question 20

A USB key drop is an example of what type of technique?

A. Physical honeypot
B. A humanitarian exploit
C. Reverse dumpster diving
D. A hybrid attack

Answer 20

Physical honeypot

USB key drops are sometimes referred to as physical honeypots. They tempt staff to plug unknown devices into their computers, which a well‐trained and suspicious staff shouldn’t do. The remaining options were made up for this question.

Question 21

Hybrid attack

Answer 21

A hybrid attack generally refers to a combination of attack methods, often in the context of password cracking (e.g., combining dictionary and brute force techniques).

Question 22

Reverse Dumpster Diving

Answer 22

Reverse dumpster diving involves placing sensitive items, such as documents or media, into trash bins with the intent of being found by attackers or investigators, acting as a lure to bait them into retrieving

Question 23

Susan calls staff at the company she has been contracted to conduct a phishing campaign against, focusing on individuals in the finance department. Over a few days, she persuades an employee to send a wire transfer to an account she has set up after telling the employee that she has let their boss know how talented they are. What motivation technique has she used?

A. Urgency
B. Reciprocation
C. Authority
D. Fear

Answer 23

Reciprocation

Susan is using the concept of reciprocation to persuade the employee that they should perform an action that benefits her, since she has done them a favor.

Question 24

Reciprocation

Answer 24

Reciprocation in social engineering is a psychological principle where the target feels indebted to return a favor after receiving something from the attacker. For instance, the attacker might provide a perceived benefit, such as a helpful file or a compliment, to influence the target to perform a desired actionits a common human tendency to return favors, making it an effective method in social engineering attacks