[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE426FBSFHY8H43MXN7SPX":3,"skill-same:01M6AE426FBSFHY8H43MXN7SPX":172},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":101,"commitSha":102,"skillDirectory":103,"forksCount":104,"repositoryHtmlUrl":105,"repositoryHomepageUrl":106,"ownerHtmlUrl":107,"ownerBlogUrl":108,"ownerDescription":109,"updatedAt":110,"install":111,"resources":124},"01M6AE426FBSFHY8H43MXN7SPX","conducting-social-engineering-penetration-test",null,"Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"conducting social engineering penetration test","test","engineering","create","SET","attack-surface","security-awareness","social-engineering","red-team","reporting","website","testing","development","training","resilience","official","customer","cybersecurity","security","design","2026-11-10 10:12:30",false,"---\nname: conducting-social-engineering-penetration-test\ndescription: Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- social-engineering\n- phishing\n- vishing\n- pretexting\n- GoPhish\n- SET\n- OSINT\n- security-awareness\n- red-team\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0088\n- AML.T0052\nnist_ai_rmf:\n- GOVERN-6.2\n- MAP-5.2\nnist_csf:\n- ID.RA-01\n- ID.RA-06\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1566\n- T1598\n- T1566.004\n- T1204.001\n- T1589\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - initial-access\n  - resource-development\n  techniques:\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: F1029\n    name: Gather Customer Information\n    tactic: reconnaissance\n    source: f3\n  - id: F1032\n    name: Impersonate Official\n    tactic: initial-access\n    source: f3\n  - id: T1557\n    name: Adversary-in-the-Middle\n    tactic: initial-access\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n---\n\n# Conducting Social Engineering Penetration Test\n\n## Overview\n\nSocial engineering penetration testing assesses an organization's human attack surface through controlled simulation of real-world deception techniques. According to Verizon DBIR 2024, the human element is involved in approximately 68% of all breaches, with phishing remaining the dominant initial access vector. This skill covers phishing, vishing (voice phishing), smishing (SMS phishing), and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting social engineering penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization from senior management (CISO\u002FCTO)\n- Legal review confirming compliance with local laws (CFAA, GDPR, etc.)\n- Defined scope: target employee groups, attack types, exclusions\n- GoPhish server, domain for phishing infrastructure, VPS\n- OSINT tools: Maltego, theHarvester, LinkedIn scraping tools\n- Coordination with HR and Legal for employee notification post-test\n\n## Phase 1 — OSINT and Target Profiling\n\n### Employee Reconnaissance\n\n```bash\n# Email harvesting\ntheHarvester -d targetcorp.com -b all -l 500 -f harvester_results\n\n# LinkedIn OSINT (manual + tools)\n# Gather: names, roles, departments, email format\n# Identify: new hires, IT admins, finance team, executives\n\n# Email format discovery\n# Check: first.last@, flast@, firstl@\n# Verify with: hunter.io, phonebook.cz, email-checker.net\n\n# Social media OSINT\n# Twitter\u002FX: employees posting about work tools\u002Ffrustrations\n# Facebook: corporate event photos, office layout\n# GitHub: employee repos with corporate email addresses\n\n# Domain intelligence\ndig targetcorp.com MX +short\ndig targetcorp.com TXT +short\n# Check for SPF, DKIM, DMARC records\n# Weak DMARC = easier email spoofing\n\n# Check breach databases (authorized)\n# HaveIBeenPwned API for corporate emails\n# Identify employees with compromised credentials\n```\n\n### Target Selection Matrix\n\n| Group | Count | Pretext | Attack Vector |\n|-------|-------|---------|--------------|\n| Finance | 15 | Invoice approval | Phishing (credential harvest) |\n| IT Help Desk | 8 | Password reset | Vishing |\n| Executives | 5 | Board meeting update | Spear phishing |\n| New Hires (\u003C 90 days) | 12 | HR onboarding form | Phishing (payload) |\n| All Employees | 200 | IT security update | Broad phishing |\n\n## Phase 2 — Phishing Campaign\n\n### Infrastructure Setup\n\n```bash\n# Register lookalike domain\n# targetcorp.com -> targetc0rp.com, targetcorp-secure.com, targetcorp.net\n\n# Set up GoPhish server\nsudo apt install gophish\n# Edit config.json for admin and phishing server ports\ngophish\n\n# Configure sending profile in GoPhish\n# SMTP server: mail.attackdomain.com\n# From: it-security@targetcorp-secure.com\n# Headers: proper DKIM\u002FSPF for attack domain\n\n# Create landing page (credential harvesting)\n# Clone legitimate login page (Office 365, Okta, etc.)\n# GoPhish: Import Site -> https:\u002F\u002Flogin.microsoftonline.com\n# Enable: Capture Credentials, Capture Passwords\n# Redirect to real site after capture\n\n# Set up Evilginx for MFA bypass (authorized testing only)\nevilginx2\n: config domain attackdomain.com\n: config ipv4 \u003Cserver_ip>\n: phishlets hostname o365 login.targetcorp-secure.com\n: phishlets enable o365\n: lures create o365\n: lures get-url 0\n```\n\n### GoPhish Campaign Configuration\n\n```json\n{\n  \"campaign\": {\n    \"name\": \"IT Security Update - Q1 2025\",\n    \"template\": {\n      \"name\": \"Mandatory Security Training\",\n      \"subject\": \"Action Required: Complete Security Awareness Training by Friday\",\n      \"html\": \"\u003Chtml>...[branded email with urgency]...\u003C\u002Fhtml>\",\n      \"from\": \"IT Security Team \u003Csecurity@targetcorp-secure.com>\"\n    },\n    \"landing_page\": \"Office 365 Login Clone\",\n    \"sending_profile\": \"Phishing SMTP\",\n    \"groups\": [\"All Employees - Batch 1\"],\n    \"launch_date\": \"2025-03-10T09:00:00Z\",\n    \"send_by_date\": \"2025-03-10T12:00:00Z\"\n  }\n}\n```\n\n### Phishing Email Templates by Pretext\n\n**Template 1 — IT Security Update:**\n```\nSubject: [Action Required] Mandatory Password Reset - Security Incident\nFrom: IT Security \u003Csecurity@targetcorp-secure.com>\n\nDear {FirstName},\n\nOur security team has detected unauthorized access attempts on our systems.\nAs a precautionary measure, all employees must reset their passwords immediately.\n\nPlease click below to reset your password within the next 24 hours:\n\n[Reset Password Now] -> {phishing_url}\n\nFailure to comply may result in temporary account suspension.\n\nThank you,\nIT Security Team\n```\n\n**Template 2 — Finance Invoice:**\n```\nSubject: Invoice #INV-2025-4821 - Approval Required\nFrom: Accounts Payable \u003Cap@targetcorp-secure.com>\n\nHi {FirstName},\n\nPlease review and approve the attached invoice from our vendor.\nAmount: $47,250.00 | Due: March 15, 2025\n\n[View Invoice] -> {phishing_url}\n\nBest regards,\nAccounts Payable\n```\n\n## Phase 3 — Vishing Campaign\n\n### Call Script Template\n\n```\nPretext: IT Help Desk calling about suspicious login\n\nCaller: \"Hi, this is [Name] from the IT Help Desk. Am I speaking with [Target Name]?\"\n\n[Wait for confirmation]\n\nCaller: \"We've detected some unusual login activity on your account from an\nunrecognized location. For your protection, I need to verify your identity\nbefore we can investigate further.\"\n\nCaller: \"Can you confirm your employee ID and the email address associated\nwith your account?\"\n\n[Record responses]\n\nCaller: \"Thank you. I'm going to send you a verification link to confirm\nit's really you. Can you click on it and enter your credentials so we can\nsecure your account?\"\n\n[Send phishing link via email\u002FSMS during call]\n\nCaller: \"Great, I can see you've been verified. Your account is now secured.\nIf you notice any further issues, please call the help desk at [real number].\"\n```\n\n### Vishing Metrics to Track\n\n| Metric | Description |\n|--------|-------------|\n| Call answered | Target picked up the phone |\n| Engaged | Target continued conversation past initial question |\n| Information disclosed | Target provided credentials, employee ID, or PII |\n| Link clicked | Target clicked the verification link |\n| Credentials entered | Target entered credentials on phishing page |\n| Reported | Target reported the call to security |\n\n## Phase 4 — Physical Social Engineering\n\n### Physical Pretexting Scenarios\n\n```\nScenario 1: Delivery Person\n- Arrive with package labeled for executive\n- Request access to deliver personally\n- Attempt to tailgate through secure doors\n- Drop USB drives in common areas\n\nScenario 2: IT Vendor\n- Arrive with vendor badge (printed)\n- Claim scheduled maintenance on network closet\n- Attempt to access server rooms\n- Install rogue wireless AP if access gained\n\nScenario 3: New Employee\n- Arrive claiming first day orientation\n- Request temporary badge\n- Attempt to access restricted areas\n- Photograph sensitive screens\u002Fdocuments\n\nEvidence Collection:\n- Body camera (if legally permitted and authorized)\n- Photographs of accessed areas\n- WiFi probe from rogue AP\n- Notes on which doors\u002Fcheckpoints bypassed\n```\n\n## Phase 5 — Metrics and Analysis\n\n### Campaign Results Dashboard\n\n```\nPhishing Campaign Results:\n├── Emails Sent: 200\n├── Emails Delivered: 195 (97.5%)\n├── Emails Opened: 142 (72.8%)\n├── Links Clicked: 68 (34.9%)\n├── Credentials Submitted: 31 (15.9%)\n├── MFA Bypassed: 8 (4.1%)  [Evilginx]\n├── Reported to SOC: 12 (6.2%)\n└── No Action: 53 (27.2%)\n\nVishing Campaign Results:\n├── Calls Made: 23\n├── Calls Answered: 18 (78.3%)\n├── Engaged in Conversation: 15 (65.2%)\n├── Information Disclosed: 9 (39.1%)\n├── Credentials Provided: 4 (17.4%)\n└── Reported to Security: 2 (8.7%)\n\nPhysical Assessment:\n├── Tailgating Successful: 3\u002F5 attempts\n├── USB Drives Plugged In: 2\u002F10 dropped\n├── Restricted Areas Accessed: 2\u002F4 attempted\n└── Challenged by Employee: 1 time\n```\n\n### Risk Scoring\n\n| Attack Vector | Success Rate | Risk Level | Priority |\n|--------------|-------------|------------|----------|\n| Phishing (credential harvest) | 15.9% | High | P1 |\n| Vishing (info disclosure) | 39.1% | Critical | P1 |\n| Physical tailgating | 60% | High | P2 |\n| USB drop | 20% | Medium | P3 |\n| Spear phishing (exec) | 40% | Critical | P1 |\n\n## Phase 6 — Reporting and Recommendations\n\n### Remediation Priorities\n\n| Priority | Recommendation | Timeline |\n|----------|---------------|----------|\n| P1 | Deploy phishing-resistant MFA (FIDO2\u002FWebAuthn) | 30 days |\n| P1 | Implement targeted security awareness training | 14 days |\n| P1 | Deploy email gateway with URL rewriting | 30 days |\n| P2 | Strengthen physical access controls (mantraps, visitor badges) | 60 days |\n| P2 | Implement security champion program per department | 30 days |\n| P3 | Deploy USB device control policy | 30 days |\n| P3 | Establish phishing reporting button in email client | 14 days |\n\n## Tools Reference\n\n| Tool | Purpose |\n|------|---------|\n| GoPhish | Phishing campaign management platform |\n| Evilginx2 | MFA bypass via reverse proxy phishing |\n| Social Engineer Toolkit (SET) | Social engineering attack framework |\n| Maltego | OSINT and relationship mapping |\n| theHarvester | Email and domain OSINT |\n| King Phisher | Phishing campaign tool |\n| Modlishka | Reverse proxy for credential interception |\n\n## References\n\n- GoPhish: https:\u002F\u002Fgetgophish.com\u002F\n- Evilginx2: https:\u002F\u002Fgithub.com\u002Fkgretzky\u002Fevilginx2\n- Social Engineer Toolkit: https:\u002F\u002Fgithub.com\u002Ftrustedsec\u002Fsocial-engineer-toolkit\n- Verizon DBIR: https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F\n- NIST SP 800-61: Computer Security Incident Handling Guide\n","# Conducting Social Engineering Penetration Test\n\n## Overview\n\nSocial engineering penetration testing assesses an organization's human attack surface through controlled simulation of real-world deception techniques. According to Verizon DBIR 2024, the human element is involved in approximately 68% of all breaches, with phishing remaining the dominant initial access vector. This skill covers phishing, vishing (voice phishing), smishing (SMS phishing), and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting social engineering penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization from senior management (CISO\u002FCTO)\n- Legal review confirming compliance with local laws (CFAA, GDPR, etc.)\n- Defined scope: target employee groups, attack types, exclusions\n- GoPhish server, domain for phishing infrastructure, VPS\n- OSINT tools: Maltego, theHarvester, LinkedIn scraping tools\n- Coordination with HR and Legal for employee notification post-test\n\n## Phase 1 — OSINT and Target Profiling\n\n### Employee Reconnaissance\n\n```bash\n# Email harvesting\ntheHarvester -d targetcorp.com -b all -l 500 -f harvester_results\n\n# LinkedIn OSINT (manual + tools)\n# Gather: names, roles, departments, email format\n# Identify: new hires, IT admins, finance team, executives\n\n# Email format discovery\n# Check: first.last@, flast@, firstl@\n# Verify with: hunter.io, phonebook.cz, email-checker.net\n\n# Social media OSINT\n# Twitter\u002FX: employees posting about work tools\u002Ffrustrations\n# Facebook: corporate event photos, office layout\n# GitHub: employee repos with corporate email addresses\n\n# Domain intelligence\ndig targetcorp.com MX +short\ndig targetcorp.com TXT +short\n# Check for SPF, DKIM, DMARC records\n# Weak DMARC = easier email spoofing\n\n# Check breach databases (authorized)\n# HaveIBeenPwned API for corporate emails\n# Identify employees with compromised credentials\n```\n\n### Target Selection Matrix\n\n| Group | Count | Pretext | Attack Vector |\n|-------|-------|---------|--------------|\n| Finance | 15 | Invoice approval | Phishing (credential harvest) |\n| IT Help Desk | 8 | Password reset | Vishing |\n| Executives | 5 | Board meeting update | Spear phishing |\n| New Hires (\u003C 90 days) | 12 | HR onboarding form | Phishing (payload) |\n| All Employees | 200 | IT security update | Broad phishing |\n\n## Phase 2 — Phishing Campaign\n\n### Infrastructure Setup\n\n```bash\n# Register lookalike domain\n# targetcorp.com -> targetc0rp.com, targetcorp-secure.com, targetcorp.net\n\n# Set up GoPhish server\nsudo apt install gophish\n# Edit config.json for admin and phishing server ports\ngophish\n\n# Configure sending profile in GoPhish\n# SMTP server: mail.attackdomain.com\n# From: it-security@targetcorp-secure.com\n# Headers: proper DKIM\u002FSPF for attack domain\n\n# Create landing page (credential harvesting)\n# Clone legitimate login page (Office 365, Okta, etc.)\n# GoPhish: Import Site -> https:\u002F\u002Flogin.microsoftonline.com\n# Enable: Capture Credentials, Capture Passwords\n# Redirect to real site after capture\n\n# Set up Evilginx for MFA bypass (authorized testing only)\nevilginx2\n: config domain attackdomain.com\n: config ipv4 \u003Cserver_ip>\n: phishlets hostname o365 login.targetcorp-secure.com\n: phishlets enable o365\n: lures create o365\n: lures get-url 0\n```\n\n### GoPhish Campaign Configuration\n\n```json\n{\n  \"campaign\": {\n    \"name\": \"IT Security Update - Q1 2025\",\n    \"template\": {\n      \"name\": \"Mandatory Security Training\",\n      \"subject\": \"Action Required: Complete Security Awareness Training by Friday\",\n      \"html\": \"\u003Chtml>...[branded email with urgency]...\u003C\u002Fhtml>\",\n      \"from\": \"IT Security Team \u003Csecurity@targetcorp-secure.com>\"\n    },\n    \"landing_page\": \"Office 365 Login Clone\",\n    \"sending_profile\": \"Phishing SMTP\",\n    \"groups\": [\"All Employees - Batch 1\"],\n    \"launch_date\": \"2025-03-10T09:00:00Z\",\n    \"send_by_date\": \"2025-03-10T12:00:00Z\"\n  }\n}\n```\n\n### Phishing Email Templates by Pretext\n\n**Template 1 — IT Security Update:**\n```\nSubject: [Action Required] Mandatory Password Reset - Security Incident\nFrom: IT Security \u003Csecurity@targetcorp-secure.com>\n\nDear {FirstName},\n\nOur security team has detected unauthorized access attempts on our systems.\nAs a precautionary measure, all employees must reset their passwords immediately.\n\nPlease click below to reset your password within the next 24 hours:\n\n[Reset Password Now] -> {phishing_url}\n\nFailure to comply may result in temporary account suspension.\n\nThank you,\nIT Security Team\n```\n\n**Template 2 — Finance Invoice:**\n```\nSubject: Invoice #INV-2025-4821 - Approval Required\nFrom: Accounts Payable \u003Cap@targetcorp-secure.com>\n\nHi {FirstName},\n\nPlease review and approve the attached invoice from our vendor.\nAmount: $47,250.00 | Due: March 15, 2025\n\n[View Invoice] -> {phishing_url}\n\nBest regards,\nAccounts Payable\n```\n\n## Phase 3 — Vishing Campaign\n\n### Call Script Template\n\n```\nPretext: IT Help Desk calling about suspicious login\n\nCaller: \"Hi, this is [Name] from the IT Help Desk. Am I speaking with [Target Name]?\"\n\n[Wait for confirmation]\n\nCaller: \"We've detected some unusual login activity on your account from an\nunrecognized location. For your protection, I need to verify your identity\nbefore we can investigate further.\"\n\nCaller: \"Can you confirm your employee ID and the email address associated\nwith your account?\"\n\n[Record responses]\n\nCaller: \"Thank you. I'm going to send you a verification link to confirm\nit's really you. Can you click on it and enter your credentials so we can\nsecure your account?\"\n\n[Send phishing link via email\u002FSMS during call]\n\nCaller: \"Great, I can see you've been verified. Your account is now secured.\nIf you notice any further issues, please call the help desk at [real number].\"\n```\n\n### Vishing Metrics to Track\n\n| Metric | Description |\n|--------|-------------|\n| Call answered | Target picked up the phone |\n| Engaged | Target continued conversation past initial question |\n| Information disclosed | Target provided credentials, employee ID, or PII |\n| Link clicked | Target clicked the verification link |\n| Credentials entered | Target entered credentials on phishing page |\n| Reported | Target reported the call to security |\n\n## Phase 4 — Physical Social Engineering\n\n### Physical Pretexting Scenarios\n\n```\nScenario 1: Delivery Person\n- Arrive with package labeled for executive\n- Request access to deliver personally\n- Attempt to tailgate through secure doors\n- Drop USB drives in common areas\n\nScenario 2: IT Vendor\n- Arrive with vendor badge (printed)\n- Claim scheduled maintenance on network closet\n- Attempt to access server rooms\n- Install rogue wireless AP if access gained\n\nScenario 3: New Employee\n- Arrive claiming first day orientation\n- Request temporary badge\n- Attempt to access restricted areas\n- Photograph sensitive screens\u002Fdocuments\n\nEvidence Collection:\n- Body camera (if legally permitted and authorized)\n- Photographs of accessed areas\n- WiFi probe from rogue AP\n- Notes on which doors\u002Fcheckpoints bypassed\n```\n\n## Phase 5 — Metrics and Analysis\n\n### Campaign Results Dashboard\n\n```\nPhishing Campaign Results:\n├── Emails Sent: 200\n├── Emails Delivered: 195 (97.5%)\n├── Emails Opened: 142 (72.8%)\n├── Links Clicked: 68 (34.9%)\n├── Credentials Submitted: 31 (15.9%)\n├── MFA Bypassed: 8 (4.1%)  [Evilginx]\n├── Reported to SOC: 12 (6.2%)\n└── No Action: 53 (27.2%)\n\nVishing Campaign Results:\n├── Calls Made: 23\n├── Calls Answered: 18 (78.3%)\n├── Engaged in Conversation: 15 (65.2%)\n├── Information Disclosed: 9 (39.1%)\n├── Credentials Provided: 4 (17.4%)\n└── Reported to Security: 2 (8.7%)\n\nPhysical Assessment:\n├── Tailgating Successful: 3\u002F5 attempts\n├── USB Drives Plugged In: 2\u002F10 dropped\n├── Restricted Areas Accessed: 2\u002F4 attempted\n└── Challenged by Employee: 1 time\n```\n\n### Risk Scoring\n\n| Attack Vector | Success Rate | Risk Level | Priority |\n|--------------|-------------|------------|----------|\n| Phishing (credential harvest) | 15.9% | High | P1 |\n| Vishing (info disclosure) | 39.1% | Critical | P1 |\n| Physical tailgating | 60% | High | P2 |\n| USB drop | 20% | Medium | P3 |\n| Spear phishing (exec) | 40% | Critical | P1 |\n\n## Phase 6 — Reporting and Recommendations\n\n### Remediation Priorities\n\n| Priority | Recommendation | Timeline |\n|----------|---------------|----------|\n| P1 | Deploy phishing-resistant MFA (FIDO2\u002FWebAuthn) | 30 days |\n| P1 | Implement targeted security awareness training | 14 days |\n| P1 | Deploy email gateway with URL rewriting | 30 days |\n| P2 | Strengthen physical access controls (mantraps, visitor badges) | 60 days |\n| P2 | Implement security champion program per department | 30 days |\n| P3 | Deploy USB device control policy | 30 days |\n| P3 | Establish phishing reporting button in email client | 14 days |\n\n## Tools Reference\n\n| Tool | Purpose |\n|------|---------|\n| GoPhish | Phishing campaign management platform |\n| Evilginx2 | MFA bypass via reverse proxy phishing |\n| Social Engineer Toolkit (SET) | Social engineering attack framework |\n| Maltego | OSINT and relationship mapping |\n| theHarvester | Email and domain OSINT |\n| King Phisher | Phishing campaign tool |\n| Modlishka | Reverse proxy for credential interception |\n\n## References\n\n- GoPhish: https:\u002F\u002Fgetgophish.com\u002F\n- Evilginx2: https:\u002F\u002Fgithub.com\u002Fkgretzky\u002Fevilginx2\n- Social Engineer Toolkit: https:\u002F\u002Fgithub.com\u002Ftrustedsec\u002Fsocial-engineer-toolkit\n- Verizon DBIR: https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F\n- NIST SP 800-61: Computer Security Incident Handling Guide\n",{"name":5,"tags":49,"author":55,"domain":41,"license":15,"version":56,"mitre_f3":57,"nist_csf":84,"subdomain":89,"description":7,"nist_ai_rmf":90,"mitre_attack":93,"atlas_techniques":98},[31,50,51,52,53,28,54,30,32],"phishing","vishing","pretexting","GoPhish","OSINT","mahipal","1.0",{"tactics":58,"version":62,"techniques":63},[59,60,61],"reconnaissance","initial-access","resource-development","1.1",[64,68,71,75,78,81],{"id":65,"name":66,"source":67,"tactic":59},"T1598","Phishing for Information","attack",{"id":69,"name":70,"source":67,"tactic":60},"T1660","Phishing",{"id":72,"name":73,"source":74,"tactic":59},"F1029","Gather Customer Information","f3",{"id":76,"name":77,"source":74,"tactic":60},"F1032","Impersonate Official",{"id":79,"name":80,"source":67,"tactic":60},"T1557","Adversary-in-the-Middle",{"id":82,"name":83,"source":74,"tactic":61},"F1020.002","Create Fake Materials: Fake Website",[85,86,87,88],"ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07","penetration-testing",[91,92],"GOVERN-6.2","MAP-5.2",[94,65,95,96,97],"T1566","T1566.004","T1204.001","T1589",[99,100],"AML.T0088","AML.T0052","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconducting-social-engineering-penetration-test",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":112,"prompt":122,"zipAvailable":123},[113,116,119],{"tool":114,"command":115},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-social-engineering-penetration-test",{"tool":117,"command":118},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-social-engineering-penetration-test",{"tool":120,"command":121},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-social-engineering-penetration-test","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002FSKILL.md",true,[125,131,137,141,145,150,154,158,162,168],{"path":126,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"agents\u002Fopenai.yaml","REFERENCE","参考文档",102,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcodebase-design\u002Fagents\u002Fopenai.yaml",{"path":132,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":135,"sourceHtmlUrl":136},"assets\u002Ftemplate.md","ASSET","资产文件",1016,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002Fassets\u002Ftemplate.md",{"path":138,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":139,"sourceHtmlUrl":140},"DEEPENING.md",2553,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcodebase-design\u002FDEEPENING.md",{"path":142,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":143,"sourceHtmlUrl":144},"DESIGN-IT-TWICE.md",2664,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcodebase-design\u002FDESIGN-IT-TWICE.md",{"path":146,"resourceType":146,"resourceTypeDesc":147,"sizeBytes":148,"sourceHtmlUrl":149},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002FLICENSE",{"path":151,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":152,"sourceHtmlUrl":153},"references\u002Fapi-reference.md",1498,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002Freferences\u002Fapi-reference.md",{"path":155,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":156,"sourceHtmlUrl":157},"references\u002Fstandards.md",958,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002Freferences\u002Fstandards.md",{"path":159,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":160,"sourceHtmlUrl":161},"references\u002Fworkflows.md",1147,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002Freferences\u002Fworkflows.md",{"path":163,"resourceType":164,"resourceTypeDesc":165,"sizeBytes":166,"sourceHtmlUrl":167},"scripts\u002Fagent.py","SCRIPT","脚本",5926,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002Fscripts\u002Fagent.py",{"path":169,"resourceType":164,"resourceTypeDesc":165,"sizeBytes":170,"sourceHtmlUrl":171},"scripts\u002Fprocess.py",7527,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-social-engineering-penetration-test\u002Fscripts\u002Fprocess.py",[173,201,225,250,275,302],{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":182,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[179],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[183,184,185,186,42,41,187,188,189,190,191,192,193,194,195,196,197,198,199,200],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[207],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},[209,197,210,211,42,212,41,189,213,214,215,216,217,218,219,220,221,222,223,224],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":233,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[231,232],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},[219,234,235,236,35,41,237,238,213,239,240,241,242,243,244,245,246,247,248,249],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":257,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[256],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},[258,259,260,41,261,262,263,264,265,266,267,268,269,270,271,28,216,272,273,274],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","collection","pecmd","artifact-collection",{"skillNo":276,"name":277,"nameZh":6,"description":278,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":279,"categories":280,"keywords":282,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[281],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},[283,284,285,41,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":303,"name":304,"nameZh":6,"description":305,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":306,"categories":307,"keywords":309,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[308],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},[42,310,41,311,312,313,314,315,316,317,318,245,319,246,320,321,322,323,324,325],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]