Let all your efforts be directed to something, let [your mind] keep that end in view.

—Seneca

There are four laws of the attacker mindset. They are all heavily interlaced and interdependent. In this chapter, we will look at them and explore how to use them effectively.

Law 1: Start with the End in Mind

Assuming you already have a contract and a contact in place, there's really only one correct place to start an attack—at the end. To start with the end in mind is the first law of AMs. But doing so is material to how the rest of the skills are used, too. You cannot blindly point to information about anyone on anything and then build and execute an attack. You need to know a couple of points to start: who you are attacking and to what end. The “who” is generally solved for you—the client typically approaches you or you will sell your services to them. Either the “what end” is defined by the client—who will know what they wish to protect but want to know how easily it can be accessed or destroyed—or the client will not define their assets as such, asking you to simply penetrate their defenses as deeply as you can.

Given that, there's an almost infinite list of objectives to be achieved for an impossibly large list of businesses the world over, so I won't try to list them all. But most often for a security professional, the items most likely on the list of objectives will be (a) gaining information or (b) gaining access to an asset. So, with those goals in mind, we have our immediate ends in sight.

This phase of the attack is the only one in which your AMs has absolutely no barriers or boundaries. At this point, you aren't particularly concerned with ethics—you're only looking for information or vulnerabilities to use against your target. The attack will later be adjusted for ethics and the after processes will be a direct result of them, but at least for now, your AMs can create, craft, and plan unincumbered, stopping only to consider scope.

Law 2: Gather, Weaponize, and Leverage Information

The true art of the attack doesn't come from being able to act like an attacker—it comes from being able to think like one. For instance, when a company puts out seemingly innocuous information, it's the attacker's mindset—their thoughts, outlook, and approach—that molds it into exploitable intelligence to be used against them. The ordinary reader or listener will simply process the information as intended by the source, and an ordinary person will take the information and search for more of the same if curious; a good attacker will use it as a starting point, exploring a surplus of information through the lens of their objective, disregarding all that cannot be used in a future attack and building on all that can. An attacker only gathers information to build, forward, and execute an attack. Information is the star of the show.

Picking this apart, there is one other thing that is crucial to successfully adopting and maintaining this mindset: the tieback. Similar to the callback in comedy, the tieback is the act of binding information to the needs of the objective. If the information you are sifting through is not beneficial for pretexting or using information against a target; it should be disregarded. There's not a set list of things that do and don't matter—the objective dictates these kinds of things. Intuitively parsing information as it comes to you is a deft skill that cannot be overlooked in the name of both efficiency and AMs sharpness.

Let's look at a simple example to start. If I am gathering information on a single target, with the objective to compile a seemingly legitimate phish, nearly any information becomes valuable and potentially weaponizable. Knowing the make and model of their car is valuable if I want to make them think they have a ticket and send them a link to view all the related information, but I'd have to consider whether a personal message like that would go to their work email account. The name of their child's school is valuable if I want to register for a one-on-one session to discuss the progress their child is making. None of this is valuable if I need to phish them using a professional pretext, as dictated by scope. Their home address is valuable if I want to phish them from HR, citing a mistake in their details. Sometimes you may need to know little else about a person other than the country they live in. For instance, if I know a target lives in the UK, an SMSish from Royal Mail is a solid bet for a click. In the United States, the US Postal Service is a likely candidate to get a click. For a phish, I mainly just need their email address to be factual. I can use almost any other information I come across to build into a phish, taking personal and professional information and tying it back to the objective.

Simply knowing where someone works is a great start to making a tieback—you can check online forums to search for records about the hardware or software the company uses and call when IT is citing issues with it.

For physical jobs, you will need to know the location, and you might want to know the shifts of guards to make getting in and out that much easier—that tieback of that information to the objective is easy. You might also want to look at the entries, exits, underground access points, aerial views, and surveillance spots—you should be able to tie all that back to the objective and work out how to use all that information. The rest will be specific to the location, including terrain, surroundings, staff numbers, likelihood of visitors, and likelihood of unfamiliar people going unnoticed or unchallenged. Most information you come across that exists in part outside of the organization, such as vendor or contractor information, is typically easier to weaponize and leverage.

I once broke into a large warehouse with the help of a very gifted pentester and social engineer who has asked never to be named. Our job was to get inside and access any computer terminal, taking photos as evidence. For this, we needed to know employee shift times and attempted to gain information on the types of locks they used and the type of computers through recon.

No matter the type of job, the same principle applies: you need to gather information, weaponize it, and leverage it.

The weaponization of information in the moment is also a vital skill that cannot be overvalued with regard to an ethical attacker's performance. There's a certain amount of opportunistic ability and situational agility that an EA must be able to apply when executing an attack. It is what I refer to as an attacker's opportunistic aptitude. It's the ability of the EA to see and act on opportunity in the moment, never letting their target(s) know it's haphazard. A level of opportunistic aptitude can be taught, but building it up into a deft skill will fall to the EA themselves. This ability to pivot while maintaining character and to focus on the objective falls under the umbrella of mental agility, specifically, “persuasive performance.” Agile, persuasive performance provided by an EA is the effective exploitation of human weakness through covert adversarial behavior. Bit of a mouthful, but broken down, it means that the attacker mindset, when executed properly, is versatile and adaptable and doesn't falter from the objective.

The critical finding here is that a plethora of information may exist for any one client you get. Your job is to be able to parse that information by applying it to the objective, both prior to the attack and when executing it. To parse information effectively and efficiently, I tend to think of it as a puzzle of sorts: if I can't get the information to fit to the central piece (the objective), I disregard it and move on.

In summation, the weaponization of information that is commonplace to everyone else is the true mark of a security expert with a strong, effective AMs—in both the act of attacking and the planning of it. The information you gather will go into three buckets: (a) useful for recon and building familiarity, (b) useful for pretext, and (c) not useful at all. But I am now getting ahead of myself. We will cover more about information processing in a later chapter, in Chapter 6, “Information Processing: Observation and Thinking Techniques.”

Law 3: Never Break Pretext

Now we move to pretexts. A persuasive performance is crucial in defeating an unwitting target. To be effective under your pretext, two things must be true. The first is that you must be able to play the part of your pretext accordingly—for instance, it would likely be detrimental to most operations for me to show up as a repair technician. I don't know enough about repairs of any kind to pull that off, nor do I easily fit the part of a repair technician. I could go as an inspector from a repair company, though—there to take notes and inspect some items.

With a pretext, you must be able to see clearly what other people think of you and lean into it when beneficial. This self-awareness will allow you to know your shortcomings, and it will allow you to play the parts that suit you. Attacker behavior is not politically correct, and neither are the biases you must play into.

The second thing is that pretexts must be built off of information. You cannot pull a pretext out of thin air and hope for the best. Just knowing that most companies have vendors doesn't give you the vendor pretext card. It certainly doesn't permit it without detailed searches of your target company's specific vendors.

Sure, there are times you will have to go in blind because the information doesn't exist. These are rare and extreme cases. However, inferences can still be made, and you will likely need to employ hardier recon tactics—likely military-level recon. Military-level recon takes into consideration the effects of forces like weather on the target terrain, and determines at what point the enemy can observe them. It also takes into account the target's known recon capabilities, typically things like infrared, thermal, light enhancement, and enlarging capabilities.

Military-level recon also takes into consideration route investigation: an attempt to obtain detailed information of a specified route and all terrain from which the target could influence movement along the route. Most often this is beyond the range of a job, with only the very immediate surroundings of the target environment being investigated. Some jobs, perhaps for government engagements, will require this level of recon.

Military “reconnaissance-in-force” is a deliberate combat operation designed to discover or test the enemy's strength, dispositions, and reactions or to obtain other information.

Whether your job dictates that you direct effort to military-level recon or red-team/social-engineer–level recon, the common thread still remains: information is key. A scrap is not ideal, but it will do. And if you use laws 1 and 2 against that scrap of information, you will end up with more than you started out with.

A pretext is one of the most powerful and unique laws of the four. It exists to serve the others, but the others cannot function without it. Delving back into the world of spies, a good spy could know their desired goal, gather and weaponize information, and attempt to apply that information for the good of the objective. They would immediately be in Guantanamo if they wandered into their target's environment and laid the truth out. Pretexting is important.

Take Adolf Tolkachev. He was a chief engineer at the Soviet Radar Design Bureau, which focused on the development and prototyping of advanced aero-navigational systems. Tolkachev had the highest-level access to Soviet state secrets. He approached a CIA agent in 1977 at a gas station in Moscow and slipped him a note stating that he wanted to become an American spy. The CIA was naturally suspicious of a KGB trap, so they said no to Tolkachev—on multiple occasions. Finally, his attempts met with success and the CIA gave him the codename “Sphere.”

Tolkachev was stable and believable in his role—he fit it perfectly. He remained an engineer, and so the KGB never suspected him of being a spy. Tolkachev used his own devices and procedures to get information to the CIA since he realized many of the procedures provided were simply ineffectual. For example, he modified a civilian camera and used it instead of the camera provided to him for his endeavors. He knew it would not fit his pretext and would actually be a point of potential failure. Through his pretexts, Tolkachev revealed top secret research documents on weapons to be created years into the future, including details such as air-to-air missiles, surface-to-air missiles, and fighter aircraft information. As a source for the CIA, he reported detailed data on new Soviet weapon systems that would not have been available for years, if ever. Tolkachev provided complete documentation before the systems were even fully operational.

Tolkachev never broke character and would have likely never been caught. He used all the laws together and had skills beyond reckoning. He never gave anyone pause for thought. Despite being very careful, he was captured by KGB in 1985 after CIA officer Edward Lee Howard, who defected from the United States to the Soviet Union, outed him.

As ethical attackers, we cannot quite operate like spies. There must be demarcations set that you cannot use your sexuality, looks, or compelling or coercive promises and lies to gain entry—actual network pentesting being the exception to the rule. In all other cases, a pretext whereby you talk with another human must be ethically aboveboard; otherwise, you become unable to teach someone what they should've done in a situation where they failed. As an example, I would likely let someone into a building if they threatened to kill my family. There is no teachable moment there, and we must operate well above that to prove vulnerabilities in an organization's security. It's also ethically wrong and absurd to flirt your way into a building. By nonparticipation in these sorts of actions, you are not ignoring they might work and leaving the client open to that risk. Your job is to get past security defenses and then implement or suggest processes that keep all others out that may try—however they may try. Your pretext doesn't have to be nasty. You prove a better, stronger, more valid point by using more vanilla pretexts, showing that if something as weak as a “new employee” without their card can get through their defenses, anyone can.

Law 4: Every Move Made Benefits the Objective

This is a very straightforward law. You do not deviate from your given course. You cannot switch directions, physically or figuratively for your own personal gain, for your own personal curiosity, or for any other reason. Like a spy, you can apply the first two laws to your mission, but if 3 and 4 are not also applied to the mission, you face an internal conflict and mission failure.

Everything you do has to be for the good of the mission. It might be for the short-term good, like switching pretexts or exiting a building or even a network before it is optimal. This could be so that you appear to be operating like your supposed peers—leaving at the end of the day if you cannot hide in plain sight or actually hide. You might need to switch pretexts depending on where you are in the mission; a network pentester has to disguise their traffic when exfiltrating data, which is likely done differently compared to how they first gained access to the network. In the same way, a physical pentester has to hide their real self the deeper they get into an environment and the longer they are there. They might gain access as a cleaner at night but transform into a nightshift worker when entering the server room. Like Tolkachev, you might modify or even forgo equipment altogether if it will prove to be a distraction from your pretext and so to the good of the objective.

No matter if the gain is for long or short term, you must not do anything just for the sake of doing it. You must at least believe that each step you take will move you in the right direction—the direction of achieving the objective.

Summary

• Working from the end of an attack backward as a way of planning, designing, and executing an attack is paramount to success and one of the best cognitive skills an attacker can have.
• If you are already inclined to act and think this way, it might appear as though there's no other way to perform an attack. However, it is not uncommon for people to only think linearly, asking how to get into something rather than first thinking about where they are going when they enter.
• There are two fundamentals to look at when forming an attack: your objective and what your cover story will be. Let all your efforts be directed to that objective, and let your mind keep that end in view at all times.

There are four rules of the mindset. They must all work together in order to obtain success.