Social Engineering?

Social engineering is often the simplest way for attackers to get what they’re looking for to break into systems and attain information. They’d much rather have someone open the door to the organization than physically break in and risk being caught. Security technologies such as IDS, ­firewalls and access controls won’t stop a determined social engineer.

Social engineering can harm people’s jobs and reputations, and confidential information could be leaked. This is especially true when phishing tests are performed. Plan things out and proceed with caution.

Phishing

Phishing is one of social engineering techniques that often used in cyberattacks. It is carried out by sending fraudulent communications that appear to come from a legitimate, reputable source, usually via email and text messages.

Mainly we perform two types of simulated attack:

1. E‐mails Phishing sent by whomever to gather user IDs and passwords of unsuspecting recipients. These attacks can be generic in nature or more targeted — something called spear‐phishing attacks. The criminals then use those passwords to install malware, gain access to the network, ­capture intellectual property, and more.

2. Wi-Fi Phishing It's a kind of social engineering attack that performed against WiFi victims so as to get credentials or infect the victims with malware.

Physical Hacking

The social engineer will use tactics to manipulate psychologically and trick users into making security mistakes, giving away sensitive information, or authorise the wrong person.
The attack scenario can include going to the target company and impersonating a character or characters to collect information, search for vulnerabilities, and exploit them. They can enter the server room as the manager who asks the guard for the key to the room, given that the guard does not know them.
Another example, the social engineer can make a call to a bank customer, assuming that they are a bank employee and that the customer’s account has a problem that must be resolved urgently, so they ask them about sensitive information such as the card number and password. ­