Page 1 of 2

good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 4:27 pm
by dark159123
i have recently been reading alot about social engineering, but i kinda need a good idea to get some practice...
i have recently been trying to get some info about the local bus system with the intend to eventually be able to fake a ticket somehow, probably by dumpster diving for a ticket machine - scanpoint Mk I/II? i just need a dumpster... and as a bus lasts for about 12 years i will probably need quite a deal of luck too... i have also gathered a fair amount of information through the interweb, and i'm currently waiting for a good opportunity to ask the busdriver about it (good opportunity = an experienced and medium+ friendly busdriver and an empty front seat from the time i enter the bus, plus it must be a trip where i actually bough a ticket instead of using my card), for which i have gathered a fair amount of info for a "plan", by eavesdropping and "spying" on the bus equipment (that's how i found out what ticket machine they use).

well to the point, this is the only social engineering i have(n't even) done (yet)... and i would like some ideas to some places that i could train my (net yet existing) skills? like getting a discount on a candybar, or stuff like that... preferably something not serious enough to get in serious trouble for (i know i can get in trouble for faking tickets, but it's worth the risk :D)

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 5:21 pm
by Goatboy
Unlike code, it's hard to practice social engineering. Luckily, there are ways.

The best advice I can give is to get comfortable lying. Lie to someone each day. Little things at first, like what you had for dinner last night. This will get you comfortable. You need to be a compulsive liar so it comes naturally when you need it.

Every good lie has a grain of truth in it, so don't go saying you are a black belt if you've never taken a karate class before.

Know who you are talking to. You need to get really good at reading people. For example, I have convinced several strangers that I am from a wealthy family in Ireland who owns a castle, when in reality I was born in the states to a middle-class family. It wasn't even that hard, because the people were dull as hell. Conversely, don't try to lie to someone who will catch you. Case in point.

When in doubt, use flattery. The human ego is strong. Stroking that ego can get you far. This especially works if you are a woman talking to a man. There was a good article about this in the last 2600, you might wanna check it out.

In the end, it all comes down to how believable you are as a person. I am currently taking a criminal justice course for my major, and it's all about body language, detecting lies, behavior, etc. If you have the money, take a course or get a book on it. There are some dead giveaways for when you are lying, and you need to recognize and avoid them.

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 6:45 pm
by nermd
hmm, i have experience with SE to some extent as part of political activism. I can assure you if you are confident in lying and have a kind of self-assured appearance and manner its much easier than most people would probably think. But as goatboy mentioned there are individuals that are trained in recognizing such tactics, i.e police. So good targeting is important. This means depending on your aim you have to gather information on your target and find a weak spot (this process is at least comparable to pen testing). Also in my experience it tends to be easier to do SE via telephone, but stick to what you are comfortable with.

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 6:52 pm
by sanddbox
Honestly, lying is just something that comes naturally -- not something you practice.

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 6:56 pm
by insomaniacal
Police will generally ask questions indirectly. If they want to know something, they'll ask it in such a way that you think you're giving them other information.

Generally, being amicable, preferably with a good humor and a smile on your face can get you really far. Act natural, but remember why you're there.

Dialing random 1-800 numbers and seeing what you can get the person on the other end to tell you, or seeing what you can make them believe is a pretty good practice route as well.

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 8:08 pm
by dark159123
i am comfortable lying (that gives a really bad imppression of me XD)

by the way i am a 14 year old boy (this part is pretty important for giving any good suggestions), from denmark, so dialling 1-800 numbers would probably be abit too expensive.

i'm more looking for something to test my skills (what i've reed), as i already know most of the things you guys just said (thanks anyway though).

to be exact i am looking for stuff like the bus driver stuff... i just need some good places/persons (bus drivers for example) where i can test my skills, by finding a piece of information that i don't really care about and see if i can get it (mitnik style, yes i am reading his book, The Art Of Deception - great book, by the way)

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 8:18 pm
by sanddbox
I'm going to be blunt, here:

Kevin Mitnick is a tool.

Burn that book as fast as you possibly can, and give up dreams of being a tool like him.

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 8:30 pm
by dark159123
@sanddbox by mitnik style i was refering to the way that he learned social engineering, by *what i said in my last post which im not gonna repeat because i'm to lazy... yet i wrote all this instead, when i could just have copy/pasted it... that's rather stupid actually... dooh*. and i know that his book is extremely influenced by the fact that he got busted, and needs to behave all nice and quite, but it does teach you the core basics of social engineering, so that's why im reading it... and by the way it belongs to my local library so burning it would be rather stupid/expensive O.o

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 8:57 pm
by sanddbox
Kevin.

Mitnick.

Is a tool.

Re: good places to train Social Engineering?

PostPosted: Mon Mar 08, 2010 9:10 pm
by insomaniacal
I've read the book, it's alright, though the examples aren't really that great, and he doesn't really talk about psychology as much as I was hoping.

I'm sure there's an extension in Denmark for toll-free numbers. Dial random ones of those, though I've got no clue as to what the numbers would be. Google should be able to help you there.