Ethical Hacking Social Engineering 1 — Questions and Answers
Question 1: What is 'spear phishing' as opposed to regular phishing?
- Phishing using phone calls
- Targeted phishing aimed at a specific individual using personalized information (Correct answer)
- Mass phishing emails sent to thousands of recipients
- Phishing through SMS messages
Correct answer: Targeted phishing aimed at a specific individual using personalized information
Spear phishing is a targeted attack using personal details about the victim (name, employer, colleagues) to craft convincing emails that appear legitimate.
Question 2: Which social engineering technique involves an attacker calling a target while pretending to be a trusted authority?
- Phishing
- Vishing (Correct answer)
- Smishing
- Baiting
Correct answer: Vishing
Vishing (voice phishing) uses phone calls to deceive targets into revealing sensitive information by impersonating IT support, banks, or government agencies.
Question 3: What is 'pretexting' in social engineering?
- Creating a fake website to capture credentials
- Fabricating a scenario to manipulate a target into divulging information (Correct answer)
- Sending malware via email attachments
- Intercepting phone calls
Correct answer: Fabricating a scenario to manipulate a target into divulging information
Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into providing information or performing actions they otherwise wouldn't.
Question 4: What does the social engineering term 'baiting' refer to?
- Luring victims with promises of a reward or curiosity-inducing item (e.g., infected USB drive) (Correct answer)
- Sending unsolicited emails
- Calling targets under false pretenses
- Shoulder surfing to steal credentials
Correct answer: Luring victims with promises of a reward or curiosity-inducing item (e.g., infected USB drive)
Baiting entices victims with something appealing (a free USB drive, download link) that contains malware, exploiting curiosity or greed to execute the attack.
Question 5: Which framework is commonly used by penetration testers to automate social engineering attacks?
- Nessus
- Social-Engineer Toolkit (SET) (Correct answer)
- Metasploit
- Burp Suite
Correct answer: Social-Engineer Toolkit (SET)
The Social-Engineer Toolkit (SET) is an open-source framework designed to automate social engineering attacks including spear phishing, credential harvesting, and fake websites.
Question 6: What is 'tailgating' in the context of physical social engineering?
- Following an authorized person through a secured door without using credentials (Correct answer)
- Accessing a network by piggybacking on another's Wi-Fi
- Copying an RFID badge from a distance
- Leaving malware on a shared drive
Correct answer: Following an authorized person through a secured door without using credentials
Tailgating (piggybacking) is a physical social engineering technique where an attacker follows an authorized person into a secure area without proper authentication.
Ethical Hacking Social Engineering 1
What is 'spear phishing' as opposed to regular phishing?