On a professional pen testing engagement,why is one call or phish pretext selected over another? Why does it work (or not)? This case study describes how an SE pen testing engagement used a combination of exploits - phishing, vishing, and a spoofed site to successfully gain network credentials without even asking for them. Learn why the pretexts and exploits were selected for the engagement and how and why they worked. See the email! Hear the calls! See the site! This presentation is ideal for attendees who understand some social engineering basics but want to learn more about how an SE engagement works

Back to GrrCON 2015 video list