16.3 Physical Social Engineering and SE Tools

The rest of PT0-003 4.8 is in-person and environmental social engineering plus the named tools. CompTIA lists dumpster diving, surveillance, shoulder surfing, tailgating, eavesdropping, watering hole, and impersonation next to credential harvesting (the payoff named in the previous section), then Social Engineering Toolkit (SET), Gophish, Evilginx, theHarvester, Maltego, Recon-ng, and Browser Exploitation Framework (BeEF). Exam items mix a dumpster, a held door, a hooked browser, and a mailbox list, then wait for you to grab the wrong logo or the wrong domain.

Physical SE versus 3.3 physical testing

Objective 3.3 was physical security testing techniques: site surveys, USB drops, badge cloning, lock picking, and tailgating as a body through a controlled door. 4.8 reuses some nouns but scores the human angle: pretext, observation, and influence. Lock picking and badge cloning stay on 3.3. If the stem is a pick gun on a cage, that is not 4.8. If the stem is a tester in a borrowed polo who talks a receptionist into a badge, that is impersonation (and maybe tailgating) on 4.8. Either way, a network CIDR still does not authorize walking into headquarters. Physical and social-engineering work need explicit RoE: named building, window, channels, and techniques.

Dumpster diving

Dumpster diving is searching discarded media — trash, recycling, poorly shredded paper, surplus disks — for secrets. What you might find, conceptually: password sticky notes, badge photocopies, network diagrams, customer printouts, backup tapes. When you pick it: the stem is trash or recycling, not a shoulder look and not a phishing mail. Legal overlay: dumpsters on private property are not fair game because they sit outdoors. The RoE must name the dumpster location. Exam trap: diving a neighboring tenant's dumpster in a shared loading dock. Trap two: calling every paper finding "credential harvesting." Harvest is deceit via a lure. Paper pulled from trash is dumpster diving; if the paper contains a password, say both facts without renaming the technique.

Surveillance

Surveillance is watching people and processes to learn patterns: when the smoker door is propped, when the chief financial officer badges in, which contractor is never challenged, where cameras point. It is the 4.8 cousin of a 3.3 site survey, with emphasis on human routine rather than lock hardware. When you pick it: observation over time, notes of behavior, not yet the tailgate. Covert photography of employees can violate workplace and privacy law; RoE and local law bind. Exam trap: calling a one-second glance at a screen surveillance. That glance is shoulder surfing. Surveillance is the pattern, the shift change, the propped door.

Shoulder surfing

Shoulder surfing is observing screens or keyboards from proximity: personal identification numbers at a badge reader, passwords at a coffee-shop laptop, one-time codes on a phone. When you pick it: line-of-sight observation of secrets. When you do not: a packet sniff, an evil twin, or a phishing page. Privacy screens and not typing secrets in public are the controls you recognize. Exam trap: treating a camera in a lobby that recorded a PIN as 3.3 badge cloning. Cloning copies a credential token. Shoulder surfing copies what a human typed or displayed.

Tailgating: the human door problem

Tailgating on 4.8 is still following through a controlled door, but the exam often wraps it in pretext: arms full of boxes, a friendly "can you hold that?", a fake visitor who never signs in. Objective 3.3 distinguished tailgating (unaware follow-through) from piggybacking (knowing hold-the-door). 4.8 will still accept tailgating as the attack type when a human was influenced or exploited at the door. When you pick 4.8 tailgating: the people failed, with or without a story. When you pick 3.3: the item is in a physical-controls list next to lock picking and USB drops. When you pick impersonation: the tester claimed to be someone — facilities, executive, vendor — rather than merely following.

An access-control vestibule (mantrap) is still the usual architectural countermeasure. Training not to hold doors for unbadged people is the operational pair. Those remediations live in objective 1.5. Here you need the attack name and the RoE. Exam trap: treating every lobby conversation as tailgating. If nobody passed a door and the tester only told a story, that is impersonation or vishing depending on channel.

Eavesdropping

Eavesdropping is listening to conversations or ambient signals you should not have: a board-room door cracked, a phone call on a train, a hallway huddle about a break-glass password. When you pick it: audio or conversation intercept by proximity, not a fake invoice email. Exam trap: calling every 4.7 capture eavesdropping. 4.7 wants the wireless attack name (evil twin, deauth, WPAD). 4.8 eavesdropping is the human or ambient listen. Trap two: planting a recording device in an executive office the RoE never named. That is not a bonus finding; it is out of scope and may be illegal.

Watering hole

A watering hole compromises or plants a lure on a site the targets already visit — an industry forum, an internal wiki the tester was allowed to edit, a contractor portal staff open every morning — so the victim comes to you. What it does: targeting by habitat, not by To: line. When you pick it: the stem is a frequented website or hangout, not a spear email and not a dumpster. Scope trap: planting a lure on a public third-party news site or a coffee-shop chain portal the client does not own is usually out of scope and possibly criminal. In-scope watering holes are properties the RoE named. Trap two: calling every evil-twin captive portal a watering hole. The twin is 4.7. Watering hole is 4.8 habitat: they already go there.

Impersonation

Impersonation is pretending to be a trusted identity: help desk, executive assistant, vendor, janitorial staff, auditor. It can be in person (lanyard, uniform), on a call (vishing plus impersonation), or in mail (spear plus impersonation). When you pick it: the identity claimed is the point. A tester who never claimed a role and only followed through a door is tailgating. A tester who said "I am from HVAC, corporate sent me" is impersonation. Exam trap: impersonation as badge cloning. Cloning copies the card. Impersonation copies the story. You can do both on a physical test, but 4.8 scores the story.

4.8 tool matching

SET (Social Engineering Toolkit) is a campaign framework for building SE attacks — phishing pages, cloned sites, infectious-media modules — from a tester console. When you pick it: "which framework builds the SE campaign?" Gophish is a phishing-campaign server: landing pages, mail templates, tracking opens and clicks for an authorized campaign. When you pick it: campaign operations, metrics, mail templates — not a browser hook. SET versus Gophish is a close pair; if the stem says campaign server, templates, and tracking, prefer Gophish. If it says offensive SE toolkit or cloned-site framework in a tester distro, prefer SET.

Evilginx is adversary-in-the-middle (AitM) phishing: a reverse-proxy style kit that presents a live look-alike of the real identity provider and can capture session cookies so the tester inherits an already multi-factor-authenticated session. Conceptual only — this guide will not give a configuration how-to. When you pick it: the stem is phishing that bypasses multi-factor by stealing the session, not by guessing the password offline. Exam trap: Evilginx as a 4.3 cracking tool. Trap two: Evilginx as BeEF. Trap three: Evilginx as WiFi-Pumpkin; the twin framework is 4.7.

BeEF hooks a browser (typically after the user visited a tester-controlled page) so the tester can run in-browser modules inside that origin. When you pick it: hooked browser, JavaScript hook, "command the victim browser." It is not Gophish's mail tracker and not a session-cookie reverse proxy.

theHarvester, Maltego, and Recon-ng were 2.4 OSINT tools. On 4.8 they feed targeting: emails and names for spear and whale lists, relationship graphs for who reports to the chief financial officer, modular recon for domains and people. They do not send the phish. When you pick them: "which tool built the target list?" not "which tool hosted the landing page." theHarvester is people and email. Maltego is the relationship graph. Recon-ng is modular OSINT. None of them is Kismet, and none of them is Gophish.

Worked building

free PenTest+ practice questionsPractice questions with detailed explanations

Sequence on the exam: confirm SE and physical RoE, name the human technique, then pick the tool family. If the stem wants a campaign, SET or Gophish. If it wants session cookies past multi-factor, Evilginx. If it wants a hooked browser, BeEF. If it wants the target list, the OSINT trio. If it wants a lock or a cloned badge, you are on 3.3, not 4.8.