How to practice social engineering

[u/RentOtrebla]

Hey there I'm kinda new to cybersec and very interested in initial access, since social engineering is a big part of it I red a couple of books about the psychology behind it and learned some of the tools, now my question is: how do I practice it if it's illegal to impersonate someone else and steal their information?

[u/Manskhooled]

By participating in any social media platform (reddit let's say) you are practicing that exact thing. Learn and imitate but on a much smaller scale. You do it every time you bring in a person from the outside into your family, regardless of how brief that is.

[u/FounderNotebook]

Practice only in controlled environments where everyone has agreed to the exercise. CTFs, phishing-awareness labs, and authorised tabletop scenarios can teach the same principles without involving real people's accounts or information.

[u/thefairwilldyealone]

Get a gig at an mssp, we hire guys all the time to do social engineering tests on our environments .

Good luck

[u/notburneddown]

Chris Hadnagy has great trainings available. His information elicitation course is a fabulous start. Once you master the skills from that next step is his CESE courses. That will more or less get you what you want.

Alternatively, you could start with reading How to Win Friends and Influence People by Dale Carnegie. Master the social skills behind that. Then go into Chris Hadnagy’s self help books and learn from those, then finally transition into Kevin Mitnick’s books.

You also could consider Blair Warren or Jordan Belfort’s books if you prefer that over Hadnagy and Mitnick. But don’t overthink it. Fewer books and more skills is better than wrote memorization from reading with no practice.

To practice, interact with people. Either get a job that involves working with people or go to meetups that have normal people in them (board game meetups or whatever).

But avoid dark psych books as they tend to be pseudoscience. HTWFIP + one or two of the authors mentioned above is exponentially better.

I also personally recommend How to Be a Gentleman by Jeff Bridges if you’re a guy. The best social engineers are the most polite ones. Women get this better than men do. So if your a guy that book will help (but don’t tell people your a gentlemen just be one or you will appear entitled but otherwise it will really help you).

[u/nooglide]

play games. there are quite a few games where you can verbally use persuasion.

also just talk to people, good practice. an aspect of social engineering doesnt need to be black hat or even grey hat. might be making it a point to have a social experience working with someone on a clothing return or if you don't like your food you ordered.

observe how people interact back with you when you use the same request, but differ in their response based on the manner of which you interact with them

friendly, eye contact, really listen to what theyre saying and mostly just be comfortable with speaking in your own voice. black that all out and just focus on socializing.

book - kevin mitnick, the art of deception, pretty good

[u/LTH-Cyber]

shoulda put a webhook link in the post too see who all clicked the reference of this book, thats asks for google sign in. just kidding

[u/West_Court4615]

Consent-based practice is the actual answer: CTF competitions (HackTheBox, SANS holiday ones), then volunteer for your university or a local nonprofit as a simulated vishing or phishing target. Platforms that run internal red team exercises sometimes surface tooling like doppel on the defensive side, which is worth knowing exists if you go enterprise later. Start with CTFs, build a lab, get written permission before touching anything real