Social Engineering and elicitation techniques of hacking a human being

Dorota Kozlowska, a penetration tester and social engineering specialist, opens with the main social engineering vectors: phishing and spear phishing, watering hole attacks, baiting with infected USB drives, and dumpster diving. She illustrates them with a business email compromise and a county ransomware incident, then walks through four phases: reconnaissance, engagement, exploitation and execution.

Much of the talk covers preparation and psychology. Open-source research, email address format checks, dress codes, and cleaning crews are presented as things to learn before an engagement. She explains empathy and rapport, including how repeated quiet presence in a cafe can make a guard stop seeing an outsider as a threat, and how pretexting changes with the day. She reviews influence principles such as reciprocity, urgency, authority, commitment and social proof, and separates manipulation from persuasion. Elicitation is shown through a conversation built on shared interests, and a staged distraction in a bank lobby illustrates how attention can be redirected.

Physical examples include reaching a server room through an open ceiling, shimming doors, and installing a fake badge reader to collect credentials. She stresses written client consent for documentation, a planned exit, and removing all devices afterward. The closing advice for defenders covers non-committal replies to probing questions, verifying identities, and staff awareness training.