Useful "Social Engineering" resources

SMS services:

• Nexmo: https://www.nexmo.com

It has an API, so it could be implemented in other tools. Messages are sent writing a URL and fulfilling some arguments:

http://rest.nexmo.com/sms/xml?api_key=xxxxx&api_secret=xxxxxx&from=senderID&to=destination_number&text=messagebody

• Clickatell: https://www.clickatell.com/

Easier to manage than Nexmo, directly available from Web interface. API also available.

URL shortener:

• tinyurl.com
• ow.ly

Tools:

• Social Engineering Toolkit

  • Official website: https://www.trustedsec.com/social-engineer-toolkit/

  • Spanish intro: http://www.daw-labs.com/set-kit-de-herramientas-para-ingenieria-social/

• Kali Linux (old Backtrack): https://www.kali.org/

Linux distribution with security testing tools.

• Network tools:
  • http://network-tools.com/
  • http://ping.eu
  • http://www.dnsstuff.com/

• Social-Engineer.org: http://www.social-engineer.org

Blog and Podcast.

• Other tools:
  • Maltego: https://www.paterva.com/web6/
  • Intelligence online tolos: http://inteltechniques.com
  • Nirsoft Windows appes: http://launcher.nirsoft.net
  • Nmap: http://nmap.org/ (Network mapping tool).
  • Ettercap for man-in-the-middle atacks http://ettercap.github.io/ettercap/
  • Wireshark: https://www.wireshark.org/ (Network protocol analyzer).

• Exif and metadata:
  • FOCA: https://www.elevenpaths.com/es/labstools/foca-2/index.html
  • ExifReader: www.takenet.or.jp/~ryuuji/minisoft/exifread/english/
  • ExifTool: www.sno.phy.queensu.ca/~phil/exiftool/ and its GUI: u88.n24.queensu.ca/~bogdan/

• Search engines:
  • http://www.google.com
  • http://www.bing.com
  • http://www.yahoo.com
  • http://www.ask.com

• Spcialized searching engines:
  • https://www.shodan.io/: PCs, webcams, IPs, geolocation...
  • http://namechk.com/: Check a username in more than 150 services.
  • http://knowem.com/: More services than NameCHK.
  • https://www.tineye.com/: Similar to image searching of Google.

• People searching:
  • http://www.spokeo.com/
  • https://pipl.com/
  • Wink

• Metadata:
  • Metagoofil (https://code.google.com/p/metagoofil/): offimatic document metadata (pdf, doc, xls, ppt, docx, pptx, xlsx).
  • Libextractor (http://www.gnu.org/software/libextractor/): Support more formats than Metagoofil but less detailed.

• Domains:
  • http://www.domaintools.com/: professional watch over domains and contracting holder.
  • https://www.robtex.com/: reliability analysis and domain visits.
  • http://www.my-ip-neighbors.com/: check which domains and services share an IP or server.

• Other:
  • GooScan (http://www.aldeid.com/wiki/Gooscan): automatic google searching.
  • SiteDigger (http://www.mcafee.com/es/downloads/free-tools/sitedigger.aspx): from McAfee; like GooScan but also searching in Google cache and revealing vulnerabilities.
  • OsintStalker (FBStalker & GeoStalker): Collecting info about a person from social network profiles.
  • Cree.py: get locations, dates, etc from social network accounts.
  • Theharvester: search people/companies information using search engines and social networks.