social engineering village PART_OF Defcon
The Social Engineering Village is described as one of the villages at Defcon.
Explicit Confidence 99% · Jack Rhysider EP 144 Details
“The Social Engineering Village is one of the more popular ones”
Episode
02 April 2024 Official episode · Official transcript
penetration test social engineering
Rachel Tobac describes social-engineering penetration tests involving customer-support manipulation, phone-number spoofing, open-source intelligence, fabricated online personas, hiring-process attacks, and AI-generated voice impersonation.
Topics: Social-engineering penetration testing, Phone-number and caller-ID spoofing, Account takeover through customer support, Open-source intelligence and data brokers, Knowledge-based authentication versus multi-factor authentication, Email spoofing and SPF records, Fabricated social-media personas and SOC accounts, Hiring-process and phantom-applicant attacks, AI voice cloning and deepfakes, Authentication and cryptographic identity for remote communications
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
social engineering village PART_OF Defcon
The Social Engineering Village is described as one of the villages at Defcon.
Explicit Confidence 99% · Jack Rhysider EP 144 Details
“The Social Engineering Village is one of the more popular ones”
Social Engineering Contest PART_OF Defcon
The social engineering contest is presented as taking place at Defcon.
Explicit Confidence 97% · Jack Rhysider EP 144 Details
“what she was watching was the social engineering contest”
“she applies to compete again the next year”
Social Engineering Contest INVOLVES Rachel Tobac
Rachel participated in the social engineering contest and competed for three years.
Explicit Confidence 99% · Jack Rhysider EP 144 Details
“Competing three years in a row in the social engineering contest”
Social Engineering Contest INVOLVES social engineering
The contest involved using social-engineering calls to obtain information from a target company.
Explicit Confidence 99% · Jack Rhysider EP 144 Details
“get enough information to hack into a company, all through phone calls”
Rachel Tobac USES social engineering
Rachel performs social engineering as her professional specialization and in penetration tests.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I do all the human hacking stuff”
“I’m one of the best social engineers I’ve ever met”
Rachel Tobac USES Pretexting
Rachel uses pretexts, including posing as a confused employee, journalist, customer, or job applicant.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I pretend to be an employee who’s confused, who’s just starting out”
“I built a fake journalist pretext”
Rachel Tobac USES Account takeover
During an authorized bank penetration test, Rachel attempted to take over customer accounts and obtain administrative access.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“my job was to take over multiple accounts and steal access”
“I have full admin access to the bank account”
Rachel Tobac USES Open-source intelligence
Rachel uses open-source intelligence and data-broker information to identify phone numbers, personal details, and target information.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“when we’re doing OCINT, open-source intelligence”
“I can find those pieces of information through OCINT”
Rachel Tobac USES phone-number spoofing
Rachel spoofed a bank customer's phone number during the authorized penetration test.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I spoof my phone number. I make it look like Kelly on the account”
Rachel Tobac USES Voice cloning
Rachel cloned Sharyn Alfonsi’s voice and used it in a phone call to Elizabeth as part of an authorized live demonstration.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I wanted to clone Sharyn’s voice and spoof Sharyn’s phone number”
“I put her voice into my voice-cloning tool”
Rachel Tobac USES Phantom applicant attack
Rachel used a job-application and interview process as an attack path to obtain merger-and-acquisition information.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I was going to apply to their product manager role”
“I want to attack via the hiring process”
SocialProof Security DEVELOPED_BY Rachel Tobac
Rachel says she created SocialProof Security in 2017 after companies began asking her to speak and test their defenses.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“So, I made SocialProof Security in 2017”
SocialProof Security USES social engineering
SocialProof Security provides social-engineering penetration testing and security-awareness work for companies.
Explicit Confidence 99% · Jack Rhysider EP 144 Details
“SocialProof Security, which is basically social engineering for hire”
Evan MEMBER_OF SocialProof Security
Evan is described as the technical half of SocialProof Security and handles technical work for the engagements.
Explicit Confidence 96% · Rachel Tobac EP 144 Details
“The other half of SocialProof Security is my husband, Evan. He does all of the technical stuff.”
Rachel Tobac USES Knowledge-based authentication
Rachel discusses knowledge-based authentication as an identity-verification method that attackers can find information to defeat; she does not present it as the bank’s preferred method in this test.
Explicit Confidence 86% · Rachel Tobac EP 144 Details
“knowledge-based authentication, things like, what’s your address? What’s the last four digits of your phone number?”
Deepfakes ASSOCIATED_WITH Voice cloning
The episode connects deepfakes with AI-generated audio and video that can imitate a person’s voice or appearance.
Explicit Confidence 98% · Daniel Miessler EP 144 Details
“with deepfakes, for both video and audio”
Rachel Tobac USES Email spoofing
Rachel describes email, phone, and chat as possible channels for account-takeover testing, but the episode’s successful test used phone-number spoofing rather than email spoofing.
Uncertain Confidence 70% · Rachel Tobac EP 144 Details
“they told me that I could hack via phone call, e-mail, or chat”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:20:23.093018+00:00