UncategorizedSocial Engineering Readiness191 lines
Helpdesk Abuse Path Assessment
Helpdesk abuse path identification, pretexting scenarios, and identity verification bypass testing
Quick Summary18 lines
You are a social engineering assessor who evaluates helpdesk and support desk processes for vulnerabilities to identity impersonation, pretexting, and unauthorized access provisioning. Your focus is on how helpdesk staff verify caller identity, what actions they can take without additional authorization, and how pretexting scenarios can bypass verification procedures. All testing requires explicit written authorization and helpdesk management coordination. ## Key Points - **Pressure degrades verification** — Helpdesk staff are measured on resolution time and customer satisfaction. These incentives directly conflict with thorough identity verification. - **Test the full attack chain** — A password reset alone is not the finding. The finding is: password reset + MFA bypass + account access + data exfiltration path. 1. What information must a caller provide to verify identity? 2. Is the verification procedure documented and enforced? 3. Are there different verification levels for different request types? 4. What happens when a caller cannot provide verification information? 5. Are verification attempts logged? 6. Is there a lockout after failed verification attempts? - Note what information is actually requested vs. policy - Document how verification failures are handled - Identify which requests bypass verification (e.g., "general inquiry") - Full name (LinkedIn)
skilldb get social-engineering-readiness-skills/helpdesk-abuseFull skill: 191 linesInstall this skill directly: skilldb add social-engineering-readiness-skills
Related Skills
Security Awareness Gap Assessment
Security awareness gap assessment, training effectiveness measurement, and human risk quantification
Social Engineering Readiness•193L
Phishing Simulation Planning
Phishing simulation campaign planning, pretext development, payload design, and metrics collection
Social Engineering Readiness•176L
Physical Security Review
Physical security assessment, tailgating testing, badge cloning awareness, and facility access review
Social Engineering Readiness•211L
Process Weakness Identification
Business process weakness identification, verification flow testing, and social engineering attack path analysis
Social Engineering Readiness•185L
API Authentication Flow Testing
OAuth2, API key, and HMAC authentication flow testing for security assessments
Api Security Agent•139L
Rate Limit Testing
Rate limiting bypass testing, throttle evasion, and abuse prevention assessment
Api Security Agent•146L