The primary objective of a social engineering attack is to either obtain confidential information from the victim or manipulate them into performing an action to help them compromise the target system or organization. However, to get started with any type of attack, a lot of research must be done to find out how the target functions; an attacker needs to find answers to questions such as the following:
- Does the target organization outsource their IT services?
- Does the target have a help desk?
In addition to conducting this research, when performing social engineering, you must be able to strategize quickly and read the victim's emotions regarding how they react to you.
As a social engineer, it's good to develop the following skills:
- Be creative during conversations
- Have good communication skills, both in person and over the telephone
- Good interpersonal skills
- Have a talkative and friendly nature
These skills will help you be a people person, that is, someone who is friendly and engages with others. This characteristic is beneficial as it will help you gauge the victim's mood and responses better during live communication, whether that's over a telephone call or during an in-person conversation. It's sort of a psychological skill set that allows you to read someone and manipulate their behavior to get them to react in a certain way or reveal confidential information.
Next, we will demonstrate how to use various social engineering tools.