Attacks and Exploits · Topic 7 of 10
Social Engineering Attacks
Recognise social engineering attack types such as phishing, vishing, tailgating and watering hole, their indicators, the common tools and the defences.
- 4 min
- Phishing is broad, spearphishing is targeted, whaling targets executives.
- Vishing is by phone and smishing is by SMS text.
- Credential harvesting uses a fake login page to capture passwords.
What it is
Social engineering attacks target people rather than software. They use trust, authority, urgency or curiosity to make someone reveal information, grant access or run an action for the attacker.
In an authorised test these exercises measure how staff respond and whether awareness training works. The exam expects you to name each technique from a short description, link it to an indicator, and pick the control that reduces it.
How it works
Message-based attacks
These reach the target through a message and rely on a convincing sender and a sense of urgency.
| Technique | Channel and focus |
|---|---|
| Phishing | Mass email that lures recipients to a fake page or attachment |
| Spearphishing | Phishing tailored to one person using collected (OSINT) details |
| Whaling | Phishing aimed at senior executives, who hold wide authority |
| Vishing | Voice phishing by telephone, often posing as support or a bank |
| Smishing | Phishing by short message service (SMS) text |
Credential harvesting is the common goal: a fake login page captures the username and password a victim enters. Watering hole attacks take a different route, compromising a legitimate site the target group is known to visit so that visitors are attacked indirectly.
Indicators include a mismatched sender domain, a link that points somewhere other than its text, unexpected urgency, and a login page on an address that is not the real service.
In-person and physical tactics
Some social engineering happens face to face or around the site.
| Technique | Idea |
|---|---|
| Impersonation | Posing as IT support, a vendor or an executive to gain cooperation |
| Tailgating | Following an authorised person through a secured door |
| Shoulder surfing | Watching a screen or keypad to read a password or code |
| Eavesdropping | Listening to conversations or calls for useful information |
| Dumpster diving | Searching discarded paper and media for sensitive data |
| Surveillance | Observing a site or person to learn routines and schedules |
Controls for these are mostly procedural and physical: call-back verification of unexpected requests, access control vestibules and badges against tailgating, privacy screens against shoulder surfing, clean-desk and shredding policies against dumpster diving, and staff awareness so an unusual request is challenged.
Tools
The exam lists several frameworks used for approved social engineering exercises. Know the one-line purpose of each.
| Tool | Purpose |
|---|---|
| Social-Engineer Toolkit (SET) | Framework for building approved phishing and pretexting campaigns |
| Gophish | Open-source platform that runs phishing campaigns and tracks clicks and submissions |
| Evilginx | Reverse-proxy phishing framework that shows how a captured session token can bypass non-phishing-resistant multifactor authentication (MFA) |
| Browser Exploitation Framework (BeEF) | Demonstrates the impact of a hooked browser, often to show cross-site scripting (XSS) risk |
theHarvester, Maltego and Recon-ng gather the public information that makes a pretext believable, and they are covered in the reconnaissance chapter.
If a scenario describes a session being used even though MFA was enabled, think token theft through a reverse-proxy phishing page, and the fix is phishing-resistant MFA.
What to remember for the exam
- Phishing is broad, spearphishing is targeted, whaling targets executives.
- Vishing is by phone and smishing is by SMS text.
- Credential harvesting uses a fake login page to capture passwords.
- Watering hole attacks compromise a site the target group visits.
- Tailgating is defeated by vestibules and badges, shoulder surfing by privacy screens.
- Dumpster diving is countered by shredding and media disposal policies.
- Phishing-resistant MFA limits credential and token theft.
- SET, Gophish, Evilginx and BeEF are the named social engineering tools.
Common mistakes
Confusing whaling and spearphishing. Both are targeted, but whaling specifically aims at senior leaders.
Thinking any MFA stops phishing. A reverse-proxy page can relay a session, so phishing-resistant methods matter.
Treating social engineering as purely technical. Many controls are policy, training and physical.
Ignoring in-person tactics. Tailgating and shoulder surfing need no email at all.
Forgetting authorisation. Social engineering tests need explicit scope and limits in the rules of engagement, including how collected data is handled.
Check yourself
What is the difference between vishing and smishing?
Vishing is voice phishing by phone, and smishing is phishing by SMS text message.
Which control best counters tailgating?
An access control vestibule with single-person entry, supported by badges and staff awareness.
Why can a phishing page defeat ordinary MFA?
A reverse-proxy page can capture and replay the session token after the user approves the login.
Topic 7 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.