Social Engineering for Physical Pentesting Assignments

Social Engineering for Physical Pentesting Assignments

Speaker: Dorota Kozlowska (Black Hills Information Security)

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=TIfSrX4w2os

Reading time: ~7 minutes

TL;DR

Dorota Kozlowska walks through a complete social-engineering-driven physical penetration test, from OSINT reconnaissance to gaining covert access to a client's server room. She maps the four phases — reconnaissance, engagement, exploitation, and execution — onto real-world techniques: pretexting, tailgating, elicitation, and prop construction. The talk is a practical primer for security practitioners who need to understand how human manipulation sits at the center of the most consequential physical breaches.

Introduction

Physical penetration testing is not about bypassing technology; it is about bypassing people. Organizations invest heavily in access-control systems, surveillance cameras, and encrypted hard drives, yet a determined social engineer can often walk past all of it — if they have done their homework. At NorthSec 2025, Dorota Kozlowska, penetration tester and social engineer at Black Hills Information Security, delivered a condensed but densely practical guide to executing a social-engineering-led physical pentest whose ultimate goal is planting a flag inside a client's server room.

Kozlowska brings uncommon credentialing to the subject. She holds certifications as a Covert Access Specialist, Physical Auditor, and Elicitation Specialist from the CORE Access team — a specialization profile that deliberately eschews the more common OSCP track in favor of the human-centric side of offensive security. The talk draws on her work at BHIS's NTISOC, a red-team operations center that delivers continuous penetration testing engagements.

The Four Phases of a Social-Engineering Engagement

Every social-engineering engagement, whether digital or physical, follows the same structural arc. Kozlowska organizes the methodology around four phases that serve as a navigational map throughout the talk.

Reconnaissance is the longest and most consequential phase. It involves collecting personal information, mapping organizational structure, identifying employee behavior patterns, and locating potential physical vulnerabilities. Kozlowska emphasizes OSINT sources — LinkedIn, corporate websites, social media — to determine the organizational hierarchy, key vendors, and contractors. The reconnaissance phase also includes physical scouting: identifying entry points, mapping camera placement and coverage gaps, understanding what access-control technology is in use, and locating restricted areas such as server rooms.

Engagement transitions from passive information-gathering to active contact with the target environment. This phase focuses on building trust and rapport. Kozlowska cites a training example from Brian Harris of the CORE Access team: Harris spent several consecutive days working in a corporate lobby, drinking coffee and operating his laptop without interacting with security staff. By the time he was ready to move on with the engagement, the security guard had ceased to perceive him as a threat — he had simply become part of the environment.

Exploitation is where accumulated trust and prepared pretexts are leveraged to gain unauthorized access. The attacker manipulates the target into divulging sensitive information, granting physical access, or performing actions that compromise security. Elicitation — the art of subtly extracting information through crafted conversation without arousing suspicion — plays a central role here. Kozlowska's example: discovering through OSINT that a target enjoys a particular television show, opening with that topic to build genuine rapport, and then steering the conversation toward technical details the target might not otherwise volunteer.

Execution is the final phase: achieving the objective, covering tracks, and erasing evidence of the intrusion. Log deletion and behavioral normalization (exiting calmly, not drawing attention) are part of this phase.

▶ Watch: Four Phases Overview (4:01)

Physical Pentesting Methods and Scope

Before touching on social engineering tactics specifically, Kozlowska establishes what physical pentesting actually encompasses. A physical pentest is a real-world threat scenario in which an attacker attempts to compromise a target's physical barriers to access infrastructure, buildings, systems, and personnel.

The methods employed during a physical pentest can include perimeter mapping, dumpster diving, lock picking, shoulder surfing, tailgating, RFID badge cloning or spoofing, accessing server and meeting rooms, testing network jacks, and intercepting wireless signals. Critically, she notes that before any of this begins, the practitioner must obtain a clearly written authorization letter — colloquially called the "get out of jail free card" — signed by client leadership and including contact numbers. If the tester is detained or confronted by law enforcement during an engagement, that document is the difference between a successful test and a criminal charge.

▶ Watch: Physical Pentesting Scope (5:50)

Pretexting and Props: Constructing Believability

A pretext is a fabricated scenario that provides a plausible reason for the attacker's presence. Kozlowska walks through the craft of building a convincing pretext in detail. The goal is not perfection — it is believability under the conditions of a casual check or a brief security interaction.

Dress code is paramount. Blending in with the target organization's clothing culture removes the visual friction that might cause an employee to question the attacker's presence. If a third-party cleaning company services the building, adopting that company's uniform and demeanor provides both a pretext and keys — access that most employees would not question. Props reinforce the pretext: ID badges (potentially copied from LinkedIn profile photos), uniforms, clipboards, work orders, and laptops all signal belonging.

One counter-detection technique Kozlowska highlights is the value of variation across days. An attacker who wears a wig on day one and a completely different outfit without it on day two may appear as two entirely different individuals to any observer, including security guards reviewing camera footage. Pretexts should be prepared in advance, rehearsed, and specific — for example, claiming to be checking server racks for overheating, or inspecting security system infrastructure, rather than giving a vague cover story that falls apart under questioning.

▶ Watch: Pretexting and Props (16:00)

Tailgating, Elicitation, and Human Exploitation

Tailgating — walking through a secured door behind an authorized employee — exploits social norms around courtesy. Most employees are conditioned to hold doors open for others, especially if those others appear to belong there. Kozlowska positions this as an exploitation of cultural politeness rather than a technical attack: the target's good manners become the attack vector.

Elicitation is the more sophisticated version of this human exploitation. Defined as "subtly extracting information from a target in carefully crafted conversation in a way that does not raise suspicion," elicitation is built on OSINT-informed rapport. Knowing a target's interests, professional context, and role allows the attacker to construct a conversation that feels natural to the target while systematically extracting information they would not consciously share with a stranger.

The 2023 MGM Resorts attack provides a striking real-world precedent. Attackers conducted a vishing (voice phishing) campaign, impersonating employees while contacting the IT help desk. By convincing staff to reset credentials and provide access to internal systems, they deployed ransomware and ultimately extracted a $100 million payout. No technical exploit was required — just well-prepared social manipulation of the kind Kozlowska teaches practitioners to replicate in authorized engagements.

▶ Watch: Elicitation Techniques (14:00)

Notable Quotes

"Reconnaissance, in my opinion, is the longest phase of the engagement, and you have to prepare really well to just go in and do everything on one go and then go out."

"You need a solid reason to be in the area, like a cover story. Maybe you're inspecting security systems or checking the server racks for overheating — just prepare it before, and it's important."

"Elicitation is subtly extracting information from a target in carefully crafted conversation in a way that it doesn't rise suspicion of the target."

Key Takeaways

• Reconnaissance is the foundation. The longer and more thorough the OSINT and physical scouting phase, the higher the probability of a clean single-pass engagement. Skipping it is the most common failure point.
• Authorization letters are non-negotiable. Physical pentesting operates in legal grey zones without explicit written authorization from client leadership. Carry it on your person at all times during the engagement.
• Pretexts require specificity. Vague cover stories fail under questioning. A tester claiming to service the fire suppression system should know how those systems work.
• Human courtesy is an attack surface. Tailgating exploits cultural norms, not technical vulnerabilities. Organizations that focus only on access-control hardware remain exposed to this vector.
• Elicitation is patience, not pressure. Effective elicitation does not rush to extract information — it builds authentic-seeming rapport over time, allowing the target to volunteer what they would normally protect.
• Real-world attacks validate the methodology. The MGM Resorts breach demonstrates that social engineering at scale produces catastrophic outcomes without any need for technical exploitation.