Social Engineering Tutorial

I was torn as to whether I should start with this or with some tech tips on optimizing your box. This, I feel is better because you can use it day to day and it is very useful in dealing with conflicts. (This is my primary weapon outside of the element of surprise. No one ever sees me coming, that;s why they called me Irukandji in the old days.) This tutorial is going to focus on the science of perception, you need to know the code before you can tweak it. I'll follow up with some practical exercises. Get ready to learn a bit about your own subconscious thought processes. (BTW, some of this stuff is straight out of the first Book of Gematria. m0x knew alot about people.)

Social Engineering
As defined by Wikipedia, it is, “the art of manipulating people into performing actions or divulging confidential information.” In a nutshell social engineering can be equated to “people coding.”
Whereas hackers find flaws in computer systems, networks, and programs and exploit those flaws in an attempt to gain access to restricted files, information, or otherwise confidential information, social engineers find flaws in the human psyche and exploit those flaws for many of the same reasons a “typical” hacker would.
When it comes to social engineering there are typically only a handful of “tools” at the disposal of the social engineer. Among these tools are a basic understanding of human nature, cognitive biases, and psychological fallacies. The following lists name, and explain, many of the common cognitive biases:

Decision-making and behavioral biases
Many of these biases are studied for how they affect belief formation, business decisions, and scientific research.
Bandwagon effect — the tendency to do (or believe) things because many other people do (or believe) the same. Related to groupthink and herd behavior.
Base rate fallacy — ignoring available statistical data in favor of particulars.
Bias blind spot — the tendency not to compensate for one's own cognitive biases.
Choice-supportive bias — the tendency to remember one's choices as better than they actually were.
Confirmation bias — the tendency to search for or interpret information in a way that confirms one's preconceptions.
Congruence bias — the tendency to test hypotheses exclusively through direct testing, in contrast to tests of possible alternative hypotheses.
Conservatism bias — the tendency to ignore the consequence of new evidence. (Related to base rate fallacy.)
Contrast effect — the enhancement or diminishing of a weight or other measurement when compared with recently observed contrasting object.
Déformation professionnelle — the tendency to look at things according to the conventions of one's own profession, forgetting any broader point of view.
Denial — the tendency to disbelieve or discount an unpleasant fact.
Distinction bias — the tendency to view two options as more dissimilar when evaluating them simultaneously than when evaluating them separately.
Endowment effect — "the fact that people often demand much more to give up an object than they would be willing to pay to acquire it".
Expectation bias — the tendency for experimenters to believe, certify, and publish data that agrees with their expectations for the outcome of an experiment, and to disbelieve, discard, or downgrade the corresponding weightings for data that appears to conflict with those expectations.
Extreme aversion — the tendency to avoid extremes, being more likely to choose an option if it is the intermediate choice.
Focusing effect — prediction bias occurring when people place too much importance on one aspect of an event; causes error in accurately predicting the utility of a future outcome.
Framing — by using a too narrow approach or description of the situation or issue. Also framing effect — drawing different conclusions based on how data is presented.
Hostility
Hyperbolic discounting — the tendency for people to have a stronger preference for more immediate payoffs relative to later payoffs, where the tendency increases the closer to the present both payoffs are.
Illusion of control — the tendency for human beings to believe they can control or at least influence outcomes that they clearly cannot.
Impact bias — the tendency for people to overestimate the length or the intensity of the impact of future feeling states.
Information bias — the tendency to seek information even when it cannot affect action.
Irrational escalation — the tendency to make irrational decisions based upon rational decisions in the past or to justify actions already taken.
Loss aversion — "the disutility of giving up an object is greater than the utility associated with acquiring it". (see also sunk cost effects and Endowment effect).
Mere exposure effect — the tendency for people to express undue liking for things merely because they are familiar with them.
Moral credential effect — the tendency of a track record of non-prejudice to increase subsequent prejudice.
Maternal/Paternal Instinct - the tendency to be more outraged if a child is portrayed as the victim of a misdemeanor or crime
Need for closure — the need to reach a verdict in important matters; to have an answer and to escape the feeling of doubt and uncertainty. The personal context (time or social pressure) might increase this bias.
Neglect of probability — the tendency to completely disregard probability when making a decision under uncertainty.
Not Invented Here — the tendency to ignore that a product or solution already exists, because its source is seen as an "enemy" or as "inferior".
Omission bias — the tendency to judge harmful actions as worse, or less moral, than equally harmful omissions (inactions).
Outcome bias — the tendency to judge a decision by its eventual outcome instead of based on the quality of the decision at the time it was made.
Perceived self-radicalism - the tendency to jump on a bandwagon (see also bandwagon effect) because one thinks one is in a minority and therefore are 'cool', when actually it is already commonplace to be on the bandwagon (everyone hates the politically correct, everyone hates the faceless corporations, etc.)
Planning fallacy — the tendency to underestimate task-completion times.
Post-purchase rationalization — the tendency to persuade oneself through rational argument that a purchase was a good value.
Pseudocertainty effect — the tendency to make risk-averse choices if the expected outcome is positive, but make risk- seeking choices to avoid negative outcomes.
Reactance — the urge to do the opposite of what someone wants you to do out of a need to resist a perceived attempt to constrain your freedom of choice.
Selective perception — the tendency for expectations to affect perception.
Status quo bias — the tendency for people to like things to stay relatively the same (see also loss aversion, endowment effect, and system justification).
Von Restorff effect — the tendency for an item that "stands out like a sore thumb" to be more likely to be remembered than other items.
Wishful thinking — the formation of beliefs and the making of decisions according to what is pleasing to imagine instead of by appeal to evidence or rationality.
Zero-risk bias — preference for reducing a small risk to zero over a greater reduction in a larger risk.
Biases in probability and belief
Many of these biases are often studied for how they affect business and economic decisions and how they affect experimental research.
• Ambiguity effect — the avoidance of options for which missing information makes the probability seem "unknown".
• Anchoring — the tendency to rely too heavily, or "anchor," on a past reference or on one trait or piece of information when making decisions.
• Attentional bias — neglect of relevant data when making judgments of a correlation or association.
• Authority bias — the tendency to value an ambiguous stimulus (e.g., an art performance) according to the opinion of someone who is seen as an authority on the topic.
• Availability heuristic — estimating what is more likely by what is more available in memory, which is biased toward vivid, unusual, or emotionally charged examples.
• Availability cascade — a self-reinforcing process in which a collective belief gains more and more plausibility through its increasing repetition in public discourse (or "repeat something long enough and it will become true").
• Clustering illusion — the tendency to see patterns where actually none exist.
• Capability bias — The tendency to believe that the closer average performance is to a target, the tighter the distribution of the data set.
• Conjunction fallacy — the tendency to assume that specific conditions are more probable than general ones.
• Gambler's fallacy — the tendency to assume that individual random events are influenced by previous random events. For example, "I've flipped heads with this coin five times consecutively, so the chance of tails coming out on the sixth flip is much greater than heads."
• Hawthorne effect — the tendency of people to perform or perceive differently when they know that they are being observed.
• Hindsight bias — sometimes called the "I-knew-it-all-along" effect, the inclination to see past events as being predictable.
• Illusory correlation — beliefs that inaccurately suppose a relationship between a certain type of action and an effect.
• Ludic fallacy — the analysis of chance related problems according to the belief that the unstructured randomness found in life resembles the structured randomness found in games. Ignoring the non-gaussian distribution of many real-world results.
• Neglect of prior base rates effect — the tendency to neglect known odds when reevaluating odds in light of weak evidence.
• Observer-expectancy effect — when a researcher expects a given result and therefore unconsciously manipulates an experiment or misinterprets data in order to find it (see also subject-expectancy effect).
• Optimism bias — the systematic tendency to be over-optimistic about the outcome of planned actions.
• Ostrich effect — ignoring an obvious (negative) situation.
• Overconfidence effect — excessive confidence in one's own answers to questions. For example, for certain types of question, answers that people rate as "99% certain" turn out to be wrong 40% of the time.
• Positive outcome bias — a tendency in prediction to overestimate the probability of good things happening to them (see also wishful thinking, optimism bias, and valence effect).
• Primacy effect — the tendency to weigh initial events more than subsequent events.
• Recency effect — the tendency to weigh recent events more than earlier events (see also peak-end rule).
• Disregard of regression toward the mean — the tendency to expect extreme performance to continue.
• Reminiscence bump — the effect that people tend to recall more personal events from adolescence and early adulthood than from other lifetime periods.
• Rosy retrospection — the tendency to rate past events more positively than they had actually rated them when the event occurred.
• Selection bias — a distortion of evidence or data that arises from the way that the data are collected.
• Stereotyping — expecting a member of a group to have certain characteristics without having actual information about that individual.
• Subadditivity effect — the tendency to judge probability of the whole to be less than the probabilities of the parts.
• Subjective validation — perception that something is true if a subject's belief demands it to be true. Also assigns perceived connections between coincidences.
• Telescoping effect — the effect that recent events appear to have occurred more remotely and remote events appear to have occurred more recently.
• Texas sharpshooter fallacy — the fallacy of selecting or adjusting a hypothesis after the data is collected, making it impossible to test the hypothesis fairly. Refers to the concept of firing shots at a barn door, drawing a circle around the best group, and declaring that to be the target.
Social biases
Most of these biases are labeled as attributional biases.
• Actor-observer bias — the tendency for explanations of other individuals' behaviors to overemphasize the influence of their personality and underemphasize the influence of their situation (see also fundamental attribution error). However, this is coupled with the opposite tendency for the self in that explanations for our own behaviors overemphasize the influence of our situation and underemphasize the influence of our own personality.
• Dunning-Kruger effect — "...when people are incompetent in the strategies they adopt to achieve success and satisfaction, they suffer a dual burden: Not only do they reach erroneous conclusions and make unfortunate choices, but their incompetence robs them of the ability to realize it. Instead, ...they are left with the mistaken impression that they are doing just fine."(see also Lake Wobegon effect, and overconfidence effect).
• Egocentric bias — occurs when people claim more responsibility for themselves for the results of a joint action than an outside observer would.
• Forer effect (aka Barnum Effect) — the tendency to give high accuracy ratings to descriptions of their personality that supposedly are tailored specifically for them, but are in fact vague and general enough to apply to a wide range of people. For example, horoscopes.
• False consensus effect — the tendency for people to overestimate the degree to which others agree with them.
• Fundamental attribution error — the tendency for people to over-emphasize personality-based explanations for behaviors observed in others while under-emphasizing the role and power of situational influences on the same behavior (see also actor-observer bias, group attribution error, positivity effect, and negativity effect).
• Halo effect — the tendency for a person's positive or negative traits to "spill over" from one area of their personality to another in others' perceptions of them (see also physical attractiveness stereotype).
• Herd instinct — Common tendency to adopt the opinions and follow the behaviors of the majority to feel safer and to avoid conflict.
• Illusion of asymmetric insight — people perceive their knowledge of their peers to surpass their peers' knowledge of them.
• Illusion of transparency — people overestimate others' ability to know them, and they also overestimate their ability to know others.
• Illusory superiority — perceiving oneself as having desirable qualities to a greater degree than other people. Also known as Superiority bias.
• Ingroup bias — the tendency for people to give preferential treatment to others they perceive to be members of their own groups.
• Just-world phenomenon — the tendency for people to believe that the world is "just" and therefore people "get what they deserve."
• Lake Wobegon effect — the phenomenon that a supermajority of people report themselves as above average in desirable qualities (see also worse-than-average effect and optimism bias).
• Money illusion - an irrational notion that the arbitrary values of currency, fiat or otherwise, have an actual immutable value.
• Notational bias — a form of cultural bias in which a notation induces the appearance of a nonexistent natural law.
• Outgroup homogeneity bias — individuals see members of their own group as being relatively more varied than members of other groups.
• Projection bias — the tendency to unconsciously assume that others share the same or similar thoughts, beliefs, values, or positions.
• Self-serving bias — the tendency to claim more responsibility for successes than failures. It may also manifest itself as a tendency for people to evaluate ambiguous information in a way beneficial to their interests (see also group-serving bias).
• Self-fulfilling prophecy — the tendency to engage in behaviors that elicit results which will (consciously or not) confirm our beliefs.
• System justification — the tendency to defend and bolster the status quo. Existing social, economic, and political arrangements tend to be preferred, and alternatives disparaged sometimes even at the expense of individual and collective self-interest. (See also status quo bias.)
• Trait ascription bias — the tendency for people to view themselves as relatively variable in terms of personality, behavior and mood while viewing others as much more predictable.
• Ultimate attribution error — Similar to the fundamental attribution error, in this error a person is likely to make an internal attribution to an entire group instead of the individuals within the group.
• Us vs Them - the tendency to hate another group, usually one much larger than that of the person's (everyone in Europe hates America, America hates China,etc)
Memory errors
• Consistency bias — incorrectly remembering one's past attitudes and behaviour as resembling present attitudes and behavior.
• Cryptomnesia — a form of misattribution where a memory is mistaken for imagination.
• Egocentric bias — recalling the past in a self-serving manner, e.g. remembering one's exam grades as being better than they were, or remembering a caught fish as being bigger than it was
• False memory — confusion of imagination with memory, or the confusion of true memories with false memories.
• Hindsight bias — filtering memory of past events through present knowledge, so that those events look more predictable than they actually were; also known as the 'I-knew-it-all-along effect'.
• Self-serving bias — perceiving oneself responsible for desirable outcomes but not responsible for undesirable ones.
• Suggestibility — a form of misattribution where ideas suggested by a questioner are mistaken for memory.
With that long and boring list now out of the way, you should realize something. If you realized that there are a lot of possible “holes” in the human psyche to exploit then you'd be right, and that is where the danger, as well as strength, of social engineering resides. In the following sections you will learn many techniques that I have accumulated over time which have proven themselves to be worth while, as well as some basic social engineering training exercises.
Techniques
• Be Polite: I cannot tell you how many people hung up on me when I first started social engineering because I acted like an asshole. Act like you own the place but be polite at the same time. Saying, “I would like to speak with your manager” and “BITCH GET ME YOUR FUCKING MANAGER” both mean the same thing at their core but which one would you personally like to respond to?
• Be Knowledgeable: Different professions and companies have different technical jargon. If you can learn this jargon through means of the internet, go for it. If not, try calling a few times and asking tech specific questions which may unlock little nuggets of wisdom for you. Maybe they call a motherboard a MoBo (this is a poor example but whatever), make note of these words.
• Be Firm: People naturally want to help people but that doesn't mean you make yourself a wet noodle.
• Being passive-aggressive while asking for help makes people actually want to help you more. If you ever saw the movie Hackers you can remember the scene when Zero Cool/Crash Override/Dade Murphy called up the television company and told the guard that if he didn't get the work done the corporate big heads would have him commit huri kuri. By asking for help while still “pushing” the guard to help him, Dade Murphy was able to hack into the television network.
• Learn Basic Psychology: I've put up a list of certain things people take to be true even though they shouldn't but you shouldn't stop there. Learn the kinds of people that someone is more likely to help, to avoid, to hate. Knowing these things will help you become any type of person you want. If you think one of the CEO's is an asshole and you try to impersonate them but act nice, your cover is blown.

This is a beginners introduction to social engineering, and as such, things have been left out. The thing to remember is that you always catch more flies with honey than with vinegar and people tend to reflect the people they're talking to. If you are aware of this you can control both your responses and theirs.

Manowar, just so you know, what you wrote above looks like plagiarism, it looks like you're trying to take credit for what you copy and pasted above as your own work.

For reference to the rest, he copy and pasted this Wikipedia article: [You must be registered and logged in to see this link.] (Wikipedia).

The "Techniques" section looks like your own work though. Can you describe in what sort of situations have you used social engineering that these techniques have been useful?

You shouldn't pull out something like that without including something about ethics. It's a minefield of mistakes that can have unpredictable consequences

Gray wrote:

Manowar, just so you know, what you wrote above looks like plagiarism, it looks like you're trying to take credit for what you copy and pasted above as your own work.

For reference to the rest, he copy and pasted this Wikipedia article: [You must be registered and logged in to see this link.] (Wikipedia).

The "Techniques" section looks like your own work though. Can you describe in what sort of situations have you used social engineering that these techniques have been useful?

I didn't write it, I'm just passing on the best source. If some of it was on Wikipedia, I wouldn't be surprised. Wikipedia is the biggest plagiarizer on the internet. I got it out of the BoG, but I didn't compile that particular section. Something to consider, most of the stuff from the BoG is spread all over the net in one place or another. The original book was posted on Efnet ages ago. The important thing is the facts not where they originated.

Wikipedia doesn't plagiarize, it is an encyclopedia--they are supposed to cite sources. Citing sources isn't just something that they make you do in school you know, it is what helps us know the difference between good information and bad information.

I can't find anything about this Book of Gematria online at least, and gematria seems to be a pseudo-science like numerology.

Gray wrote:

Wikipedia doesn't plagiarize, it is an encyclopedia--they are supposed to cite sources. Citing sources isn't just something that they make you do in school you know, it is what helps us know the difference between good information and bad information.

I can't find anything about this Book of Gematria online at least, and gematria seems to be a pseudo-science like numerology.

Gematria is more about hacking and coding. Wikipedia is garbage, trust me.

I can't link to the book, but haxme has alot of this stuff on it too. (It's peppered with my ilk.) Everyone should join HTS and haxme.

Perhaps a link, as Gray put up, would've sufficed, but regardless thanks for posting mhm. My Psychology class has been touching in on this on and off, so this is a great review.

Ohm wrote:

Perhaps a link, as Gray put up, would've sufficed, but regardless thanks for posting mhm. My Psychology class has been touching in on this on and off, so this is a great review.

I believe haxme has a copy of this tute, but the original source is the BoG. I can only link to the portal with that. (It's against the rules to do more than that. What we call DS Protocols.