social-engineering

Social Engineering Intelligence Collection Methodology

⛔ In-depth Reference: For phishing email templates, pretexting scripts, credential guessing scripts, and watering hole attack methods, see references/social-engineering-techniques.md

The success rate of social engineering attacks depends on the quality of prior intelligence. This skill focuses on intelligence collection at the personnel and organizational levels, providing ammunition for subsequent phishing/watering hole/credential guessing.

Phase 1: Email Format Discovery

Use http_request or curl to query the Hunter API and search for email addresses associated with the target domain.

Key Objectives：

• Determine the email naming convention (e.g., first.last@, f.last@, flast@）
• Collect a list of known email addresses (for subsequent phishing or password spraying)
• Identify generic email addresses (info@, hr@, support@) — usually shared by multiple people, making them more likely to be compromised

Phase 2: Organizational Information Collection

Use http_request or curl to query the FOFA API and search for assets associated with the target domain, focusing on:

Internal System Exposure：

• OA/ERP systems → leak organizational structure
• VPN entry points → remote work entry points
• Email systems (OWA/Zimbra) → credential attack targets
• HR/recruitment systems → leak position and technology stack information
• Wiki/Confluence → may have unauthenticated knowledge bases

Information Leakage Check：

• Document metadata (author names, internal paths in PDF/Word)
• GitHub/GitLab public repositories (search for organization name or domain)
• Recruitment information leaks the technology stack ("familiar with Spring Boot + MySQL")

Phase 3: Key Personnel Identification

Prioritize identifying the following roles (ranked by social engineering value):

1. IT Administrators — have system privileges, technical emails are easier to forge
2. HR/Administration — accustomed to opening attachments (resumes, contracts, etc.)
3. Finance Personnel — common BEC (Business Email Compromise) targets
4. Executives — CEO/CFO identities can be used for internal phishing
5. New Employees — unfamiliar with internal processes, more likely to be deceived

Phase 4: Social Engineering Attack Options

Based on the collected intelligence, evaluate feasible attack directions:

Attack Type	Prerequisites	Success Rate
Phishing Email	Has email list + email format	High
Password Spraying	Has email list + login entry point	Medium
Watering Hole Attack	Knows websites frequently visited by the target	Medium
Credential Guessing	Has personnel names + email format	Low-Medium
Telephone Social Engineering	Has organizational structure + key personnel	Scenario-dependent

Notes

• Use evidence_save to save key findings (email lists, personnel information) for later use
• Social engineering intelligence has a shelf life; personnel may leave or change positions
• All information sources should be marked with credibility (search engine/official website/inference)

Target selection

• Role ordering: select targets by priority (IT administrators > regular employees)

Password pattern inference

• Common patterns: company name + year (2026), season, and other current time-related
• Note the account lockout policy (lockout), usually locks after 5 attempts