Social Engineering Scripts for Pentesters 2026 — Phishing, Vishing & Pretexting Playbooks
Mr Elite ··
22 min read
⚠️ Authorised Engagements Only: Every script, template, and technique covered here is for use in authorised penetration testing and red team engagements with explicit written scope covering social engineering. Sending phishing emails to individuals without their organisation’s written authorisation is illegal under the Computer Fraud and Abuse Act, Computer Misuse Act, and equivalent legislation worldwide. SecurityElites.com accepts no liability for misuse.
Six months into a red team engagement for a financial services firm, the technical team had found nothing. Every external port was locked down. Every web application was patched. VPN required hardware MFA. The security operations team was sharp — they caught our port scans within minutes. Then I called the IT helpdesk. Fifteen minutes and one carefully worded conversation later, I had the name of the VPN client they used, the internal LDAP server address, and confirmation that accounts used the pattern firstname.lastname. That one call produced more actionable intelligence than six months of technical scanning. The person on the helpdesk was not incompetent — they were doing their job, responding helpfully to someone who sounded exactly like a new IT contractor with a legitimate question.
Social engineering succeeds because it targets the part of security infrastructure that does not get patched — human judgment under pressure. In 2026, with technical defences more mature than ever, the phone call and the convincing email remain the most reliable initial access vectors on a red team engagement. This article gives you the social engineering scripts for pentesters I use on real engagements: phishing lure templates, vishing call frameworks, pretexting playbooks, and GoPhish campaign setup — all structured for authorised use in professional security assessments.
Which social engineering technique have you tested in an authorised engagement?
🎯 What You’ll Get From This Article
Real phishing email templates structured for maximum delivery and click rates
Vishing call scripts and objection handling frameworks for IT helpdesk pretexts
GoPhish campaign setup — infrastructure, DKIM/SPF, tracking, and reporting
OSINT-driven spear phishing methodology — how role-specific targeting works
Pretexting scenario library — 8 ready-to-adapt scenarios for different engagement types
Reporting social engineering results — metrics, evidence, and remediation framing
⏱️ 60 min · 3 exercises · Browser + Think Like Hacker + Kali Terminal
✅ Prerequisites
Written scope authorisation covering social engineering before attempting any of the active exercises
Basic OSINT skills —
theHarvester tutorial
and
Recon-ng tutorial
cover the reconnaissance that feeds pretext development
A VPS for GoPhish hosting — DigitalOcean, Vultr, or Linode ($5/month is sufficient)
Understanding of email delivery basics (DKIM, SPF, DMARC) — Exercise 3 covers the setup
📋 Social Engineering Scripts Pentesters 2026 — Contents
Why Social Engineering Bypasses Technical Defences
Every technical control in a mature security programme has a bypass-via-human equivalent. MFA? A vishing call telling the target their account is being attacked gets them to approve the push notification right now. Email filtering? A spear phish from a domain the target recognises with content specific to their current project gets forwarded to colleagues. Locked-down workstations? An employee who receives a “your benefits enrolment closes today” email will ask IT to help them open the attachment. The human element is not a weakness in the security programme — it is the intended bypass route for attackers who find the technical surface hardened.
Understanding why each social engineering technique works helps you craft more effective pretexts and helps you explain findings to clients. Three psychological mechanisms do most of the work. Authority — people comply with requests from figures who appear to have power or expertise, especially in a professional context where questioning authority has social cost. Urgency — compressed time pressure disables careful thinking; “your account will be locked in the next hour” produces action before verification. Familiarity — people trust communications that reference real internal systems, real colleagues, real events. OSINT is what turns a generic phishing email into a familiar-looking one.
Effective phishing emails share a structure. Short body, single clear action, authority-and-urgency framing, minimal spelling or formatting tells. Here are the five lure categories that consistently produce the highest click rates across different industry verticals, with annotated examples for each.
LURE 1 — IT SECURITY ALERT (HIGHEST CLICK RATE)
Subject: Action Required — Unusual Sign-In Detected on Your Account
From: security-noreply@[lookalike-domain].com
Display Name: IT Security Team
We detected a sign-in attempt to your account from an unrecognised
device at 03:17 UTC today.
Location: Kyiv, Ukraine
Device: Windows 11 / Chrome 122
If this was you, no action is needed.
If this was not you, secure your account immediately:
→ [Review Activity and Secure Account]
This link expires in 24 hours.
— Why it works —
Authority (IT Security) + Urgency (expires) + Fear (foreign login)
“If this was you, no action needed” reduces suspicion by appearing legitimate
Specific details (time, location, device) increase believability
Research and Score a Phishing Lure Against a Target Profile
⏱️ 20 minutes · Browser only · Authorised scope required for active testing
Before crafting a phishing email, I build a target profile from open sources. The profile drives every decision about the pretext. This exercise builds that research habit — the same process I run for every spear phishing campaign before writing a single word of lure content.
Step 1: Choose a target organisation you are authorised to assess
(or use your own company as a practice target with management approval).
Step 2: Open LinkedIn and search for employees at the organisation.
For the top 5 results, record:
— Full name and job title
— Which department they work in
— Any tools or systems mentioned in their profile
— Any recent company news they might reference
Step 3: Run theHarvester against the target domain:
theharvester -d targetcorp.com -b all
Record: email format pattern (firstname.lastname? flastname?)
and any named IT contacts.
Step 4: Visit the target’s career page and job postings.
Job descriptions reveal: internal tools, security stack,
active projects, team structures. Note anything that would
make a spear phish more credible.
Step 5: Now build a lure brief:
— Which of the three lure templates (security alert, HR, shared doc)
best fits this target’s profile and role?
— What OSINT detail makes it more specific?
— What is the target action (click link, open attachment, reply)?
— Write the subject line and first two sentences.
Step 6: Score your lure:
Rate each dimension 1-5: Authority, Urgency, Familiarity, Plausibility.
Total score out of 20. A score below 14 means the lure needs work
before being used in an assessment.
✅ You just built a target profile and scored a phishing lure using the same research-to-pretext workflow I use before every spear phishing campaign. The scoring framework is not scientific — it is a quick sanity check that forces you to articulate why a target would act. A lure that scores low on Familiarity means you need more OSINT. Low on Plausibility means the scenario is too far from the target’s real context. The OSINT step is what separates a 20% click rate from a 60% click rate on the same audience.
📸 Share your lure brief (anonymised if needed) in #social-engineering on Discord.
Vishing Call Scripts — IT Helpdesk, Vendor & Executive Pretexts
Vishing is harder to scale than phishing but produces higher-value intelligence because a live conversation can pivot dynamically based on what the target reveals. The key principle: never read from a script verbatim. The script is a framework — the opening, the key questions, the objection responses, and the exit. Everything in between is conversation.
I open every vishing call with authority establishment — who I am and why I am calling — before asking for anything. The reason is simple: people hang up on requests from strangers but stay on the line with colleagues and service providers who call with a specific, plausible purpose. Establishing the pretext identity in the first fifteen seconds determines whether the rest of the call happens at all.
VISHING SCRIPT 1 — IT HELPDESK PRETEXT
PRETEXT: IT Security team running account verification sweep
GOAL: Confirm username format, MFA method, VPN client name
AUTHORISATION: Written scope required, number spoofing laws apply
OPENING (establish authority immediately):
“Hi, this is [name] from the IT Security team. We’re running a
routine account verification sweep following some unusual activity
we flagged on the network this morning. I just need to verify a
couple of account details to make sure your account isn’t affected.
Is now a good time?”
KEY QUESTIONS (build from low-sensitivity to medium):
“Can I confirm your full name and department for the record?”
“And your work email address — just so I can pull up the account?”
“What MFA method are you currently using — the app or SMS?”
“Which VPN client does your team use — is it the standard one or
did you get set up with the contractor access?”
OBJECTION — “Can I get your employee number?”:
“Of course — I’m [name], ticket number INC-[plausible number].
You’re welcome to call the main helpdesk to verify — I can hold
while you do that.”
# Offering to hold while they verify paradoxically increases trust
EXIT:
“Great, everything looks fine on your account. You’ll get a
confirmation email in the next hour. Thanks for your time.”
VISHING SCRIPT 2 — MFA PUSH APPROVAL PRETEXT
PRETEXT: IT team running MFA device re-registration
GOAL: Get target to approve an MFA push while attacker logs in
REQUIRES: Valid credentials (from phishing, breach data, or spraying)
SETUP: Attempt login with target’s credentials immediately before calling
MFA push will arrive on their phone during the call
“Hi [name], this is [name] from IT. We’re migrating accounts to
our new authentication platform today and I need to verify your
authenticator app is still working correctly.
You should receive an approval notification on your phone in the
next few seconds — can you confirm when you see it? And then
go ahead and approve it so we can confirm the migration completed
on our end.”
— Why this works —
The push notification arrives at exactly the right moment — highly credible
The target approves a real MFA prompt in a plausible context
No credentials are ever requested — only the approval action
— Defence note to include in report —
Mitigated by: number matching MFA (shows code to enter, not just approve)
A pretext is only as good as its specificity to the target. Each scenario below is a starting framework — adapt the details to the target organisation, the target’s role, and anything your OSINT phase surfaced. Generic pretexts produce generic results.
8 PRETEXTING SCENARIOS — FRAMEWORK REFERENCE
# 1. NEW EMPLOYEE ONBOARDING
Pretext: New starter needs IT access set up urgently before first day
Target: IT helpdesk · Goal: VPN credentials, account provisioning info
Works because: Helpdesk routinely handles these — hard to verify quickly
# 2. VENDOR ACCOUNT VERIFICATION
Pretext: Supplier calling to verify contact details for invoice processing
Works because: Facilities requests are routine and low-risk appearing
# 7. BENEFITS PROVIDER
Pretext: Health insurance or pension provider with query on the target’s account
Target: Any employee · Goal: Personal details, employment confirmation
Works because: Employees cooperate with benefits queries readily
# 8. INTERNAL SURVEY
Pretext: HR running anonymous satisfaction survey, needs to verify eligibility
Target: All staff · Goal: System usage, tool names, manager names
Works because: Survey participation feels low-stakes and voluntary
🧠 EXERCISE 2 — THINK LIKE A HACKER (20 MIN · NO TOOLS)
Build a Full Spear Phishing Campaign Plan for a Target Organisation
⏱️ 20 minutes · No tools needed
A professional phishing campaign starts with a plan, not a template. Work through this scenario the same way I approach a client’s social engineering scope before a single email is written or a single call is made.
SCENARIO: A professional services firm (500 employees) has commissioned
a phishing simulation to test resilience ahead of cyber insurance renewal.
Scope: email phishing only, no vishing, no physical.
Target groups: All staff, with separate metrics for IT, Finance, and HR.
Goal: Measure click rates and credential submission rates per department.
QUESTION 1 — Which of the three lure categories (security alert,
HR/benefits, shared document) would you deploy to each group?
IT staff? Finance team? HR team? Why different for each?
QUESTION 2 — OSINT shows the company uses Microsoft 365 and
their IT manager’s name is on LinkedIn. Build a spear phishing
email subject line and opening sentence targeting the IT manager.
What specific detail makes it more credible than a generic lure?
QUESTION 3 — Your first campaign runs and IT staff click at 8%
but Finance clicks at 52%. What does that difference tell you
about the training programme? What is your recommendation?
QUESTION 4 — The client says “we cannot include HR in scope because
they handle sensitive employee data.” Why is that argument backwards
from a security perspective? How do you frame your pushback?
QUESTION 5 — A Finance employee calls the real IT helpdesk to report
the phishing email mid-campaign. What is the correct procedure?
Who needs to be informed and what documentation do you produce?
✅ You just planned and stress-tested a full phishing campaign before writing a word of lure content. The answers: (1) IT gets security alert (most credible given their role), Finance gets vendor/invoice lure (matches their workflow), HR gets benefits or survey lure (their operational context); (2) Subject: “Microsoft 365 admin centre — licence assignment requires review” — real product, relevant to IT manager’s role; (3) Finance needs immediate targeted training; IT has a mature detection culture; (4) HR is the highest-risk department in most organisations precisely because they handle sensitive data and external requests — exclusion creates a security blind spot, not protection; (5) Pause campaign, inform the pre-designated engagement contact, document the report, do not reveal the test is authorised to non-contact employees until the debrief.
📸 Write your campaign plan and share in #social-engineering on Discord.
GoPhish Campaign Setup — Infrastructure to Launch
GoPhish is the standard open-source phishing simulation platform. Web UI, built-in tracking, credential capture, campaign reporting. Here is the setup sequence I use for every phishing engagement — from VPS provisioning through the first test email.
# Real-time dashboard updates as targets interact with the campaign
securityelites.com
GoPhish Campaign Dashboard — Live Results
247
Emails Sent
143
Opened (58%)
89
Clicked (36%)
41
Submitted Creds (17%)
EMAILDEPARTMENTEVENTTIME
j.walsh@…FinanceSubmitted Data09:14
d.park@…ITClicked Link09:22
s.chen@…HRSubmitted Data09:31
📸 GoPhish campaign dashboard showing real-time results for an IT security alert lure sent to 247 targets — 36% clicked the link and 17% submitted credentials. Finance and HR accounts are among the first credential submissions, consistent with benchmark data showing these departments as highest-risk. Each row provides timestamp, department, and event type for the engagement report.
⚡ EXERCISE 3 — KALI TERMINAL (25 MIN)
Install GoPhish and Send a Test Campaign to Your Own Email
⏱️ 25 minutes · Kali Linux · Send to your own email only
This exercise runs the complete GoPhish setup — install, configure, clone a landing page, build an email template, and send the campaign to your own email address. You will see exactly what your target sees, how the tracking works, and what the dashboard shows. Only send to email addresses you control.
Step 1: Download and install GoPhish on Kali
wget https://github.com/gophish/gophish/releases/latest/download/gophish-linux-64bit.zip
unzip gophish-linux-64bit.zip
chmod +x gophish
Step 3: Run GoPhish and note the admin password in the output
./gophish
# Open browser: https://127.0.0.1:3333 (accept self-signed cert)
# Login with admin + password from output
Step 4: Create a Sending Profile
GoPhish UI → Sending Profiles → New Profile
Set SMTP host to your mail relay (or use a local Postfix for testing)
Send a test email to confirm delivery
Step 5: Import a landing page
Landing Pages → New Page → Import Site
Enter: https://accounts.google.com/signin
Enable: Capture Submitted Data
Save the page
Step 6: Create an email template using Lure 1 (security alert)
Email Templates → New Template
Use the IT security alert template from this article
Add a link to your landing page
Enable: Add Tracking Image
Step 7: Create a user group with your own email address only
Users & Groups → New Group → add YOUR email only
Step 8: Launch campaign and interact with it from your inbox
Click the link in the email — watch the GoPhish dashboard update
Submit test credentials on the landing page
Review: what data GoPhish captured, how the timeline looks
Step 9: Export the campaign report
Campaigns → [campaign name] → Export CSV
Review the columns — this is what goes in the client report
✅ You just ran a complete phishing campaign from infrastructure setup through results capture. The experience of receiving and interacting with your own lure is genuinely valuable — it shows you exactly what your targets experience, which details look suspicious, and which look convincing. The exported CSV is the raw data that feeds the engagement report metrics. From here, the only change for a real authorised campaign is replacing your test email with the authorised target list.
📸 Screenshot your GoPhish dashboard showing your test campaign results and share in #social-engineering on Discord. Tag #gophish-complete
Reporting Social Engineering Results
Social engineering reports have a different structure from technical vulnerability reports because the finding is a human behaviour pattern, not a software bug. The metrics need to tell a story that creates urgency for training and process improvement — not assign blame to individuals.
The headline metrics I report for every phishing campaign: email delivery rate, open rate, click rate, credential submission rate, and report rate (targets who reported the email to IT). I break these down by department because the department-level comparison is often where the most actionable insight lives. I also report time-to-first-click — how quickly after sending the first target clicked. Under two minutes means the lure was credible enough to act on without reflection. That is the number that gets the attention of executives who think their team “would never fall for that.”
Clone landing pageLanding Pages → Import Site → target URL
Test deliverabilitymail-tester.com → send test → aim for 8/10+
SPF recordTXT @ “v=spf1 ip4:VPS_IP ~all”
DKIM key generationopendkim-genkey -t -s mail -d yourdomain.com
Vishing opening lineAuthority → purpose → specific detail → request
Pretext verification offer“You’re welcome to call back to verify — I can hold”
Campaign exportCampaigns → Export CSV → paste into report template
Key report metricTime-to-first-click — under 2 min means high credibility lure
✅ Complete — Social Engineering Scripts for Pentesters 2026
Phishing lure templates, vishing call frameworks, eight pretexting scenarios, GoPhish infrastructure setup, and professional reporting metrics. The scripts are frameworks — adapt every detail to the target organisation’s specific context. A generic pretext produces a generic result. OSINT-driven specificity is the difference between a 15% click rate and a 55% click rate on the same audience.
🧠 Quick Check — Social Engineering
You send a phishing campaign to 200 employees. Finance clicks at 48%, IT clicks at 6%, HR clicks at 41%. The client’s security manager says “the IT results prove our training works — overall we’re doing fine.” What is the correct professional response?
❓ Social Engineering Pentest FAQ
Is social engineering testing legal?
Social engineering testing is legal only with explicit written authorisation from an organisation with the authority to authorise testing of the specific targets. This means a signed statement of work naming the permitted techniques, target groups, and what actions are in and out of bounds. Testing employees without their organisation’s written permission is illegal under computer fraud and impersonation laws in most jurisdictions.
What is the difference between phishing and spear phishing?
Phishing sends a generic lure to a large number of targets — low personalisation, broad reach. Spear phishing is highly targeted, using OSINT to personalise the lure to a specific individual using their name, role, colleagues, and current projects. Spear phishing consistently achieves 3-5x higher click rates because the target believes the email is genuinely relevant to them.
What tools do pentesters use for phishing campaigns?
GoPhish is the industry standard — open source, web UI, full tracking. Evilginx2 handles credential harvesting via reverse proxy, capturing session tokens even with MFA. SET (Social-Engineer Toolkit) automates payload delivery. For larger campaigns, commercial platforms like Lucy or KnowBe4’s testing module offer more reporting depth but GoPhish covers everything needed for professional red team engagements.
What is a pretexting scenario in penetration testing?
Pretexting is creating a fabricated scenario to manipulate a target into taking an action or disclosing information. Common pentesting pretexts include: IT helpdesk calling about account security issues, new employee onboarding requesting access, vendor account verification, executive assistant calling on behalf of senior leadership, and cloud provider support following up on a ticket.
How do you bypass email spam filters in phishing tests?
Key controls: register an aged domain rather than a brand new one; configure DKIM, SPF, and DMARC correctly; warm up the sending IP gradually before the campaign; avoid spam trigger words in subject lines; use a reputable mail delivery service rather than sending from a raw VPS IP; and test deliverability with mail-tester.com before launching — aim for 8/10 or higher.
What percentage of employees typically click phishing emails?
Industry benchmarks vary widely based on training and pretext quality. Generic phishing with untrained employees averages 25-35% click rates. Spear phishing with role-specific pretexts averages 45-65% on first campaigns. After phishing awareness training, rates typically drop to 5-15%. The most susceptible roles are HR, finance, and executive assistants — all of whom handle external requests as a core job function.
← Related
Social Engineering Attacks 2026
Next →
Phishing Simulation Tools 2026
📚 Further Reading
theHarvester Tutorial 2026— The OSINT foundation for spear phishing. The email addresses, employee names, and technology stack theHarvester surfaces are what transforms a generic phishing lure into a targeted one.
Recon-ng Tutorial 2026— Modular OSINT framework that automates the target profiling feeding pretext development — Hunter.io module surfaces professional emails with job titles in minutes.
C2 Frameworks 2026— What happens after a phishing payload is clicked — the C2 callback, beacon establishment, and internal access that a successful phishing campaign enables.
GoPhish Official Documentation— Complete setup guide, API reference, and campaign configuration documentation for the industry-standard phishing simulation platform.
Social-Engineer.org Framework— The definitive reference for social engineering methodology, psychology, and ethical practice — the academic foundation behind the practical scripts above.
ME
Mr Elite
Owner, SecurityElites.com
The vishing call that gave me more intelligence than six months of technical scanning was not sophisticated. It was a two-minute conversation with a helpful person doing their job. I have run social engineering assessments where the technical team found nothing but the phishing campaign compromised three senior accounts on the first day. I have also run campaigns that produced a 2% click rate because the security team had built genuine awareness culture over years of consistent training. The difference between those two organisations was not technology — it was whether the humans had been given the tools to make good decisions under pressure. That is what the reporting from social engineering assessments should build toward.
