Study guide
16.3 Physical Social Engineering and SE Tools
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
16.3 Physical Social Engineering and SE Tools
Key Takeaways Explain This Topic AI
Objective 4.8 physical social engineering is the human angle — dumpster diving, surveillance, shoulder surfing, tailgating, eavesdropping, watering hole, and impersonation — not 3.3 lock picking, badge cloning, or USB drops.
Tailgating on 4.8 is influence or follow-through at a controlled door; impersonation is claiming a trusted identity; both still need explicit physical and social-engineering rules of engagement.
SET and Gophish run authorized phishing campaigns; Evilginx is conceptual adversary-in-the-middle phishing for session cookies; BeEF hooks a browser.
theHarvester, Maltego, and Recon-ng feed social-engineering targeting from OSINT; they do not host the landing page or send the lure by themselves.
Watering holes against third-party public sites the client does not own are usually out of scope; in-scope watering holes are properties the rules of engagement named.
Last updated: August 2026
The rest of PT0-003 4.8 is in-person and environmental social engineering plus the named tools . CompTIA lists dumpster diving , surveillance , shoulder surfing , tailgating , eavesdropping , watering hole , and impersonation next to credential harvesting (the payoff named in the previous section), then Social Engineering Toolkit (SET) , Gophish , Evilginx , theHarvester , Maltego , Recon-ng , and Browser Exploitation Framework (BeEF) . Exam items mix a dumpster, a held door, a hooked browser, and a mailbox list, then wait for you to grab the wrong logo or the wrong domain.
Physical SE versus 3.3 physical testing
Objective 3.3 was physical security testing techniques : site surveys, USB drops, badge cloning , lock picking , and tailgating as a body through a controlled door . 4.8 reuses some nouns but scores the human angle: pretext, observation, and influence. Lock picking and badge cloning stay on 3.3. If the stem is a pick gun on a cage, that is not 4.8. If the stem is a tester in a borrowed polo who talks a receptionist into a badge, that is impersonation (and maybe tailgating) on 4.8. Either way, a network CIDR still does not authorize walking into headquarters. Physical and social-engineering work need explicit RoE : named building, window, channels, and techniques.
Dumpster diving
Dumpster diving is searching discarded media — trash, recycling, poorly shredded paper, surplus disks — for secrets. What you might find, conceptually: password sticky notes, badge photocopies, network diagrams, customer printouts, backup tapes. When you pick it: the stem is trash or recycling, not a shoulder look and not a phishing mail. Legal overlay: dumpsters on private property are not fair game because they sit outdoors. The RoE must name the dumpster location. Exam trap: diving a neighboring tenant's dumpster in a shared loading dock. Trap two: calling every paper finding "credential harvesting." Harvest is deceit via a lure. Paper pulled from trash is dumpster diving; if the paper contains a password, say both facts without renaming the technique.
Surveillance
Surveillance is watching people and processes to learn patterns: when the smoker door is propped, when the chief financial officer badges in, which contractor is never challenged, where cameras point. It is the 4.8 cousin of a 3.3 site survey , with emphasis on human routine rather than lock hardware. When you pick it: observation over time, notes of behavior, not yet the tailgate. Covert photography of employees can violate workplace and privacy law; RoE and local law bind. Exam trap: calling a one-second glance at a screen surveillance. That glance is shoulder surfing . Surveillance is the pattern, the shift change, the propped door.
Shoulder surfing
Shoulder surfing is observing screens or keyboards from proximity: personal identification numbers at a badge reader, passwords at a coffee-shop laptop, one-time codes on a phone. When you pick it: line-of-sight observation of secrets. When you do not: a packet sniff, an evil twin, or a phishing page. Privacy screens and not typing secrets in public are the controls you recognize. Exam trap: treating a camera in a lobby that recorded a PIN as 3.3 badge cloning. Cloning copies a credential token. Shoulder surfing copies what a human typed or displayed.
Tailgating: the human door problem
Tailgating on 4.8 is still following through a controlled door, but the exam often wraps it in pretext : arms full of boxes, a friendly "can you hold that?", a fake visitor who never signs in. Objective 3.3 distinguished tailgating (unaware follow-through) from piggybacking (knowing hold-the-door). 4.8 will still accept tailgating as the attack type when a human was influenced or exploited at the door. When you pick 4.8 tailgating: the people failed, with or without a story. When you pick 3.3: the item is in a physical-controls list next to lock picking and USB drops. When you pick impersonation: the tester claimed to be someone — facilities, executive, vendor — rather than merely following.
An access-control vestibule (mantrap) is still the usual architectural countermeasure. Training not to hold doors for unbadged people is the operational pair. Those remediations live in objective 1.5. Here you need the attack name and the RoE. Exam trap: treating every lobby conversation as tailgating. If nobody passed a door and the tester only told a story, that is impersonation or vishing depending on channel.
Eavesdropping
Eavesdropping is listening to conversations or ambient signals you should not have: a board-room door cracked, a phone call on a train, a hallway huddle about a break-glass password. When you pick it: audio or conversation intercept by proximity, not a fake invoice email. Exam trap: calling every 4.7 capture eavesdropping. 4.7 wants the wireless attack name (evil twin, deauth, WPAD). 4.8 eavesdropping is the human or ambient listen. Trap two: planting a recording device in an executive office the RoE never named. That is not a bonus finding; it is out of scope and may be illegal.
Watering hole
A watering hole compromises or plants a lure on a site the targets already visit — an industry forum, an internal wiki the tester was allowed to edit, a contractor portal staff open every morning — so the victim comes to you . What it does: targeting by habitat, not by To: line. When you pick it: the stem is a frequented website or hangout, not a spear email and not a dumpster. Scope trap: planting a lure on a public third-party news site or a coffee-shop chain portal the client does not own is usually out of scope and possibly criminal. In-scope watering holes are properties the RoE named. Trap two: calling every evil-twin captive portal a watering hole. The twin is 4.7. Watering hole is 4.8 habitat: they already go there.
Impersonation
Impersonation is pretending to be a trusted identity: help desk, executive assistant, vendor, janitorial staff, auditor. It can be in person (lanyard, uniform), on a call (vishing plus impersonation), or in mail (spear plus impersonation). When you pick it: the identity claimed is the point. A tester who never claimed a role and only followed through a door is tailgating. A tester who said "I am from HVAC, corporate sent me" is impersonation. Exam trap: impersonation as badge cloning. Cloning copies the card. Impersonation copies the story . You can do both on a physical test, but 4.8 scores the story.
4.8 tool matching
SET (Social Engineering Toolkit) is a campaign framework for building SE attacks — phishing pages, cloned sites, infectious-media modules — from a tester console. When you pick it: "which framework builds the SE campaign?" Gophish is a phishing-campaign server : landing pages, mail templates, tracking opens and clicks for an authorized campaign. When you pick it: campaign operations, metrics, mail templates — not a browser hook. SET versus Gophish is a close pair; if the stem says campaign server, templates, and tracking, prefer Gophish . If it says offensive SE toolkit or cloned-site framework in a tester distro, prefer SET .
Evilginx is adversary-in-the-middle (AitM) phishing : a reverse-proxy style kit that presents a live look-alike of the real identity provider and can capture session cookies so the tester inherits an already multi-factor-authenticated session. Conceptual only — this guide will not give a configuration how-to. When you pick it: the stem is phishing that bypasses multi-factor by stealing the session , not by guessing the password offline. Exam trap: Evilginx as a 4.3 cracking tool. Trap two: Evilginx as BeEF. Trap three: Evilginx as WiFi-Pumpkin; the twin framework is 4.7.
BeEF hooks a browser (typically after the user visited a tester-controlled page) so the tester can run in-browser modules inside that origin. When you pick it: hooked browser, JavaScript hook, "command the victim browser." It is not Gophish's mail tracker and not a session-cookie reverse proxy.
theHarvester , Maltego , and Recon-ng were 2.4 OSINT tools. On 4.8 they feed targeting : emails and names for spear and whale lists, relationship graphs for who reports to the chief financial officer, modular recon for domains and people. They do not send the phish. When you pick them: "which tool built the target list?" not "which tool hosted the landing page." theHarvester is people and email. Maltego is the relationship graph. Recon-ng is modular OSINT. None of them is Kismet, and none of them is Gophish.
- Tool 4.8 job Typical stem cue Not the answer for
- SET SE campaign framework Which toolkit builds the SE attack Passive RF sniffer (Kismet)
- Gophish Phishing campaign server (templates, tracking) Mail campaign metrics, landing pages Browser hooking
Evilginx AitM phishing for session cookies Multi-factor already passed; steal the session Offline hash cracking; 4.7 evil twin
- BeEF Browser hooking Hooked origin, browser modules Mail-merge campaign
- theHarvester People and email OSINT for targeting Harvest mailboxes for spear lists Hosting the fake SSO
- Maltego OSINT relationship graph Who connects to the whale Captive-portal kit
- Recon-ng Modular OSINT Recon modules for people and domains Deauthentication
- Worked building
Authorized physical and SE window at headquarters. Dumpsters behind the dock yield a printed wireless pre-shared key — dumpster diving , not lock picking. Two days of notes on when the smoker door is propped is surveillance . A PIN watched at the reader is shoulder surfing . Following an employee who did not hold the door is tailgating ; claiming to be a fire inspector is impersonation . Overhearing a standup about a break-glass account is eavesdropping . A tester-controlled change on the in-scope internal wiki that staff already open is a watering hole , not a generic phish. Campaign: Gophish or SET to run the authorized mailer; Evilginx if the stem is AitM session theft; BeEF if a browser hooked; theHarvester , Maltego , or Recon-ng if the question is who to target. When you drill mixed 4.7 and 4.8 stems, use the free PenTest+ practice questions and match the channel, the human behavior, or the tool job before you pick a logo.
Sequence on the exam: confirm SE and physical RoE, name the human technique, then pick the tool family. If the stem wants a campaign, SET or Gophish. If it wants session cookies past multi-factor, Evilginx. If it wants a hooked browser, BeEF. If it wants the target list, the OSINT trio. If it wants a lock or a cloned badge, you are on 3.3, not 4.8.