One reader wrote in asking: "How can one practice social engineering before using it in the wild?"

Answering is Chris "loganWHD" Hadnagy, the lead social engineer and developer of the web's official social engineering framework. He works closely with the Offensive Security and Remote Exploit teams and advocates knowledge and awareness as the keys to what can protect people from social engineering attacks and help secure people from being deceived and influenced maliciously.

Chris: I really thought this was an excellent question. In traditional penetration testing if we want to practice our wares we can do a number of things: set up a virtual machine, a small LAN or we can even purchase a course that comes with labs to practice in.

That methodology works perfect for practicing that level of security auditing, but we can't really set up "fake" people and "hack" them to practice social engineering. Staged events rarely work the way real life does. Unless we are dealing with expert and experienced actors facial expressions, reactions to questions and body language are almost impossible to mirror the way a real target would react.

With that being said, it is not wise to drive around and take videos of yourself shmoozing free food or getting into clubs for free. Although there might certain aspects that reflect social engineering, in the truest sense it will not prepare you for professional social engineering audits.

Another method that has been suggested, which I feel really isn't wise, is to practice lying to your friends and family, even for short periods. Social engineering isn't really all about who is the best liar. Social engineering is about obtaining information from your target that can lead to a security breach. Even little bits of information (i.e. kids names, favorite restaurants, etc) can lead to a security breach.

How can one go about practicing social engineering to perfect the science before trying their hand in the wild? In the recent release of the first framework for social engineers, there is a breakdown of the key components of social engineering. This framework outlines in logical progression these components and then dissects each one to talk about what it is, make makes up the aspects of it and how to perfect it. Mastering all these components would make one a perfect social engineer. It must be mentioned that not every aspect of social engineering is used in every audit, but regardless to act and think like a social engineer here are the keys. Let's take the top five categories that we would focus on:
1. Information Gathering
2. Elicitation
3. Pretexting
4. Psychological principles
5. Influence

Each one of these can be practiced and enhanced in its own without breaking the law or ruining relationships, actually with just the reverse effect. It may actually enhance your relationships with others. Let's take two examples.

Elicitation is basically extracting information through the use of questions. Sounds easy? Not really. Try walking up to a stranger and saying: "What is your name and where do you live?" and see what happens. Tell us when you get released from the slammer. If we practice using intelligent questions, questions that provoke thought, questions that cannot be answered with a YES or NO we can be on the road to perfecting elicitation.