Want to learn the ideas in Social Engineering better than ever? Read the world’s #1 book summary of Social Engineering by Hadnagy here.

Read a brief 1-Page Summary or watch video summaries curated by our expert team. Note: this book guide is not affiliated with or endorsed by the publisher or author, and we always encourage you to purchase and read the full book.

Video Summaries of Social Engineering

We’ve scoured the Internet for the very best videos on Social Engineering, from high-quality videos summaries to interviews or commentary by Hadnagy.

1-Page Summary of Social Engineering

Overview

Have you heard of the e-mail from a Nigerian prince asking for help retrieving an inheritance in exchange for money? Or have you seen the movie The Sting and been amazed at how two main characters can fool virtually anyone? You might have asked yourself if people really can pull off such scams. Do people really fall for them? The clear answer is yes, but the real question is: why do they fall for these schemes?

Social Engineering is a science that can be used to scam people. It’s more than just sweet talking and social adeptness; it’s a whole category of knowledge and skills that make us vulnerable to scammers, as well as the very people who try to prevent them from succeeding.

In this article, we will discuss the basics of social engineering. It is a type of hacking that uses human interaction and psychological manipulation to obtain information or access sensitive systems. This includes how someone could hack you by using information about your family on Facebook.

Big Idea #1: Social engineering is a way to gain influence over others without them knowing.

Have you ever bought something that later turned out to be useless? Most people have. Social engineering is a common tactic used by salespeople, and it often works on us.

Social engineering is a set of psychological tricks that exploit human vulnerabilities to influence a target’s actions. Governments, salespeople and law enforcement officers are familiar with these tactics, but the fact is that we all use social engineering even when we’re dealing with our friends and family. For example, kids try to get what they want by using social engineering on their parents (i.e., “I love you Mommy! Can I have a puppy for my birthday?”).

Social engineering is about manipulating people to get what you want. It can be used for good or bad purposes, such as scamming people out of their money or compromising a computer system.

If you want to install malware on a company’s server, you could break in and fight your way through security. That’s messy. A social engineer will instead disguise themselves as an IT specialist or other employee and prepare a convincing story to get past security.

Once someone is inside a building, they can do whatever they want without anyone knowing. A security guard might think that an “IT person” was just doing their job when in fact the IT person had no intention of fixing anything. Luckily, we can protect ourselves with a solid understanding of how social engineering works.

Security auditors are hired to play the role of malicious social engineers and test a client’s security system. They will do this by performing authorized penetration tests, which are basically fake social engineering attacks that the client doesn’t know about.

Big Idea #2: Gathering information is the first important step in a fake or real social engineering attack.

Before you plan an attack, whether it’s on a company or individual, you need to know all about your target. The more you know about them, the better prepared and effective your plan will be.

First, you need to create a profile of the person you’re trying to spy on. You can start by searching for her online and using social media sites. Just remember that even minor details could prove useful.

For example, the author’s mentor once did a pentest for a company. He discovered that one of their high-ranking officials was using his work e-mail on an online forum about stamps. So he created a website with a stamp related address and embedded some software to access the target computer. When the official got an offer to buy his deceased grandfathers stamp collection, he fell into the trap.