skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-social-engineering-penetration-test

Designs and executes authorized phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#social engineering#phishing#osint#Red Team#gophish#vishing
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill conducting-social-engineering-penetration-test
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-social-engineering-penetration-test
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/penetration-testing/conducting-social-engineering-penetration-test
Command: npx skills add https://github.com/xalgord/xalgorix --skill conducting-social-engineering-penetration-test

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Organizations cannot measure their human attack surface or validate security awareness training without controlled simulations of real-world deception techniques, and ad-hoc phishing tests often miss critical signals like report rates, MFA bypass feasibility, and non-email vectors.

Core Features & Use Cases

  • Multi-Channel Campaign Design: Structured phases covering OSINT target profiling, GoPhish phishing campaigns, vishing call scripts, and physical pretexting scenarios such as tailgating and USB drops.
  • MFA Bypass Validation: Guidance for using Evilginx2 reverse-proxy phishing to test whether session-token theft defeats MFA, with explicit authorization requirements.
  • Metrics and Remediation: Templates for campaign result dashboards, risk scoring by attack vector, and prioritized remediation recommendations such as FIDO2 deployment and email gateway hardening.
  • Use Case: A red team lead scoping an annual social engineering assessment uses this Skill to build a target selection matrix, configure a GoPhish campaign against finance and help-desk staff, run a vishing pretext, and produce a report measuring click, credential-submission, and report rates.

Quick Start

Ask the AI to design a social engineering penetration test plan for your organization covering phishing, vishing, and physical pretexting with defined success metrics and remediation priorities.

Frequently Asked Questions about conducting-social-engineering-penetration-test

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a phishing campaign with GoPhish?▼

Install GoPhish, configure a sending profile with your SMTP server and spoofed From address, import a cloned landing page with credential capture enabled, then create a campaign with a template, target group, and launch window. The Skill provides a full JSON campaign configuration example.

How can I test whether MFA can be bypassed by phishing?▼

Use a reverse proxy tool like Evilginx2 or Modlishka to relay the real login flow and capture session cookies, proving that token theft defeats MFA. This must only be done with explicit written authorization, and results should note when MFA successfully blocked access.

What metrics should a social engineering penetration test measure?▼

Track delivery, open, click, and credential-submission rates, but prioritize the report rate and SOC response time as the true defensive signal. Also measure vishing information disclosure and physical access success where scoped.

What authorization is required before running a phishing simulation?▼

You need written authorization from senior management such as the CISO or CTO, legal review for compliance with laws like CFAA and GDPR, a defined scope of target groups and exclusions, and coordination with HR and Legal for post-test employee notification.

Does this cover vishing and physical social engineering, not just email phishing?▼

Yes. The Skill includes a vishing call script with engagement metrics, plus physical pretexting scenarios such as delivery-person tailgating, fake IT vendor access, USB drops, and evidence collection guidance.

Related Skills

Explore More Software Engineering Skills→
jd-opensourcejd-opensource
299

pentest-osint-recon

Gather public OSINT data to map external attack surfaces.

Official
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
balsm-healthbalsm-health
2

analyzing-email-headers-for-phishing-investigation

Parse email headers and validate SPF, DKIM, and DMARC records.

Official
Advanced
uphiagouphiago
1.1k

cache-attack

Detect and exploit web cache poisoning and deception vulnerabilities in CDNs and reverse proxies.

Community
Intermediate