Social Engineering & Phishing Attacks

Module 1: Introduction to Social Engineering

• Psychological principles: Authority, urgency, reciprocity, social proof
• Social engineering attack taxonomy
• Why social engineering succeeds: Human factors
• Social engineering in cyber kill chain
• Legal and ethical boundaries for testing

Module 2: Phishing Attacks

• Spear phishing vs. bulk phishing
• Phishing email anatomy: Lures, sender spoofing, urgency
• Clone phishing and reply-chain attacks
• Whaling: Targeting executives
• BEC (Business Email Compromise) tactics

Module 3: Phishing Campaign Setup

• GoPhish platform setup and configuration
• Email template creation and testing
• Landing page cloning
• Campaign tracking: Click rates, credential captures
• Analysing phishing campaign results

Module 4: Vishing (Voice Phishing)

• Vishing attack methodology
• Pretexting scenarios: IT helpdesk, bank fraud team
• OSINT for vishing preparation
• VoIP spoofing tools
• Call script development

Module 5: Smishing and Messaging Attacks

• SMS phishing (smishing) techniques
• WhatsApp and social media phishing
• QR code phishing (quishing)
• Mobile malware delivery via messaging
• Defending against smishing

Module 6: Advanced Phishing Techniques

• Evilginx2: Reverse proxy phishing for MFA bypass
• Modlishka phishing framework
• Browser-in-the-browser (BitB) attacks
• AiTM (adversary-in-the-middle) phishing with Microsoft-targeted campaigns
• Credential harvest with session cookie theft

Module 7: Physical Social Engineering

• Tailgating and piggybacking
• Shoulder surfing
• Dumpster diving
• Baiting with malicious USB drops
• Impersonation: Delivery personnel, IT staff, contractors

Module 8: OSINT for Social Engineering

• LinkedIn recon for employee targeting
• Social media footprint analysis
• Corporate website and job posting analysis
• Building target profiles with Maltego
• OSINT-to-social engineering workflow

Module 9: Social Engineering Toolkit (SET)

• SET architecture and modules
• Credential harvesting with SET
• Website cloning with SET
• Payload delivery via SET
• HTA attacks and macro-based delivery

Module 10: Defending Against Social Engineering

• Security awareness programme design
• Phishing simulation programme management
• Anti-phishing training: KnowBe4, Proofpoint Security Awareness
• Technical controls: DMARC, SPF, DKIM
• Email security gateways and anti-phishing solutions

Module 11: Social Engineering Assessments

• Scoping a social engineering engagement
• Social engineering test types: Phishing, vishing, physical
• Documentation and evidence collection
• Social engineering assessment report writing
• Remediation recommendations

Module 12: Capstone Projects

• Live phishing simulation with GoPhish in a controlled lab
• Vishing scenario practice
• Evilginx2 AiTM attack demonstration
• Social engineering assessment report
• Security awareness programme design project

Experience in the Industry Learn from security professionals specialising in social engineering assessments with experience conducting phishing simulations, vishing campaigns, and physical intrusion tests for enterprise clients.

Backgrounds at the Top Our instructors have conducted authorised social engineering assessments for banks, IT companies, and critical infrastructure organisations, with expertise in both offensive techniques and awareness programme design.

Clear & Effective Teaching Social engineering psychology and technical tools are taught together, giving students a complete picture of how human-based attacks work and how to defend against them.

Hands-On Learning Focus Students configure GoPhish campaigns, use Evilginx2 for AiTM simulation, practice vishing scripts, and design security awareness programmes.

Up-to-Date Knowledge Instructors stay current with AiTM phishing techniques, QR code phishing trends, Microsoft Defender for Office 365 anti-phishing capabilities, and updated DMARC/DKIM implementation guidance.