A Peek Behind the Blue Mask: The Evolution of the Social Engineering CTF
SEVillage founder Chris Hadnagy explores the history and methodology of the DEF CON Social Engineering CTF (SECTF), revealing psychological scoring metrics.
Summary
The Origins and Purpose of the SECTF Competition
The Social Engineering Capture the Flag (SECTF) competition was created to demonstrate the critical risk of human vulnerabilities through live, soundproof booth phone calls.
OSINT Gathering and Pre-Engagement Intelligence
Chris Hadnagy explains the rigorous open-source intelligence phase where contestants harvest public employee rosters, vendor names, and company schedules.
Elicitation Techniques in Live Social Engineering Calls
Hadnagy reviews audio recordings from past competitions, dissecting how callers skillfully steer corporate targets into revealing internal flag data without suspicion.
Ethics, Boundaries, and Enterprise Defensive Takeaways
The presentation emphasizes strict ethical boundaries (no password requests) and provides organizations with human risk remediation frameworks.
Related talks
Village Presentations·44 min
Wayne Crowder
Wayne Crowder draws parallels between professional sport fishing and targeted phishing, illustrating how environmental recon yields high-yield social engineering.
Adversary Village·30 min
Sanne Maasakkers
Sanne Maasakkers analyzes real-world nation-state phishing strategies, comparing APT psychological pretexts with traditional red team social engineering.
Recon Village·28 min
Mishaal Khan
Mishaal Khan shares red team methodologies for gathering target intelligence on executives and employees to craft high-impact social engineering pretexts.