10 skills · sorted by relevance
Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.
Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.
Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.
Plan and execute authorized phishing and social engineering campaigns for red team engagements. Use this skill when conducting simulated social engineering attacks including email phishing, spear phishing, vishing, pretexting, and credential harvesting. Covers GoPhish setup, pretext development, payload delivery, and measuring human vulnerability. Requires explicit written authorization before any testing.
The English summary is being prepared. Showing the original description.
Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppers, ISO/IMG container abuse, LNK shortcut hijacking, OneNote embedded payloads, HTML smuggling), email authentication bypass techniques (SPF softfail exploitation, DKIM replay attacks, display name spoofing, homoglyph and cousin domain registration), credential harvesting with MFA bypass (EvilGinx2 transparent proxy, Modlishka session relay, pixel-perfect HTML cloning), spear phishing pretext development informed by OSINT, email security gateway evasion, QR code phishing (quishing), and callback phishing for initial access. Integrates with GoPhish for campaign management, EvilGinx2 for adversary-in-the-middle credential interception, King Phisher for template design, and the Social Engineering Toolkit for paylo...
The English summary is being prepared. Showing the original description.
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
The English summary is being prepared. Showing the original description.
Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.
The English summary is being prepared. Showing the original description.
Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.
The English summary is being prepared. Showing the original description.
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
The English summary is being prepared. Showing the original description.
Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.
The English summary is being prepared. Showing the original description.