📖 What is Pretexting?
Pretexting is a form of social engineering where an attacker creates a fabricated scenario, or 'pretext,' to trick a victim into divulging sensitive information. Unlike simple phishing, pretexting involves building a believable story to establish trust with the target.
"In a professional engagement, ensure your rules of engagement explicitly state whether social engineering is permitted, as pretexting can often be perceived as highly intrusive by the client."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Pretexting?
- ▸ Leveraging OSINT to gather specific details about a target organization, ensuring the fabricated story sounds authentic and believable to the victim.
- ▸ Establishing a position of authority or trust, such as impersonating an IT technician or an executive, to lower the victim's natural defenses.
- ▸ Using psychological triggers like urgency or fear to pressure the target into bypassing standard security protocols to resolve a fake problem.
- ▸ The iterative process of building a narrative that evolves based on the victim's responses to extract deeper levels of sensitive information.
- ▸ Integrating pretexting with other social engineering techniques, such as baiting or quid pro quo, to increase the overall success rate of the attack.
🎯 How does Pretexting appear on the PT0-002 Exam?
You may be asked to identify the social engineering technique used when a tester calls a help desk pretending to be a remote employee who lost their MFA device.
A scenario might describe a pentester using LinkedIn data to impersonate a known vendor, requesting internal API documentation under the guise of a system update.
Expect questions where you must distinguish between a generic phishing campaign and a targeted pretexting attempt based on the level of research and interaction.
❓ Frequently Asked Questions
What is the primary difference between pretexting and standard phishing?
Phishing is often a broad delivery method using email. Pretexting is the specific narrative or 'story' used to manipulate the target, often involving more interaction and deeper research to establish trust.
Why is the Rules of Engagement (ROE) document critical for pretexting?
Pretexting can be highly intrusive and emotionally stressful for employees. The ROE must explicitly define permitted personas and targets to avoid legal issues or severe corporate backlash during an engagement.