If you've been reading my tutorials on this blog, you'd be well-Informed of the array of methods that are used to social engineer companies that operate by delivering goods to their customers via their carrier service. Of course, what I'm referring to Is exploiting online stores to the likes of ASOS, Logitech and stating the obvious, good old Amazon by manipulating their representatives to Issue refunds or replacement Items. In order to get the job done, the method used In the attack vector must (for the most part) not only suit the nature of the Item that's being SEd at the time, but It must also be formulated with perfection, thereby leaving very little to no room for error. As such, It will ensure that the SE runs as smooth as possible right from the get-go, through to finalizing the claim In the SE'ers favor- a successful outcome.
There are so many methods available, and If you're new to the art of "the new breed of human hacking", namely "company manipulation and exploitation" (as mentioned above), then you have a lot to learn. It's way beyond the scope of this article to elaborate on each and every one, so please refer to my Social Engineers Directory where you'll find over 30 methods that cater for all your SEing needs. That being said, what I will do, Is quickly discuss what defines a method and why It plays an Integral role with every SE. In simple terms, It's the backbone of every social engineering attack, and It's used to guide It In the right direction and If you don't have a method In place, your SE will not move forward. Think of It as a set of Instructions that ultimately allows you to achieve the task at hand.
For example, If you've purchased an entertainment unit from Ikea that comes with shelves, draws etc In Its collapsed form, you'd need the assembly Instructions to put It together and succeed In accomplishing your project. The same applies to SEing. The "assembly Instructions" Is the "method" that essentially prepares, guides and secures the SE'ers objective- a refund or replacement Item. Clear enough? I'm glad you agree. Now that you know how methods function, I'd like to Introduce you to one In particular that you haven't come across, well, not by Its title- and that's because I just developed It at the time of this post which I've named It: "The Partial Manufacturer Method". This Is very similar to both the "missing Item" and "partial" method, but more effective, and you'll see why a little further down the page. In order to grasp how It works, It's Imperative to have an understanding of the other two methods, so let's start with the "missing Item" as per below.
What Is The Missing Item Method?
There's many ways that you can utilize this method but for the purpose of this guide and to avoid congestion, I'll provide a general example that you can relate to quite easily. As Its name Implies, It's used by SE'ers to say that the Item that was ordered from the online store, was "missing" when they opened the package/box when It was delivered by the carrier. Naturally, It was not the case at all, but the social engineer states that It was- just to get his account credited or another Item dispatched at no extra cost. Now this method requires a calculated and strategic approach, hence It's not as simple as selecting the first Item that comes to mind, and here's why you (as the SE'er) must be methodical with your choice of Item. Packages are weighed on consignment prior to being dispatched by the company and also at the carrier's depot, thus when you say that the Item was missing, the company will open what's called "an Investigation". This Is part of their protocol to see why you didn't receive what you've ordered.
Whilst you're waiting for their reply, behind the scenes, they're cross-checking the "weight" that was recorded at their warehouse and also at the carrier's weighing facilities- right before the package was loaded Into the van to be delivered at your premises. If your Item was quite heavy, It would've registered and If both the "dispatched" and the "carrier's" weight matched, then your Item was not missing! Say goodbye to your SE- It's failed. For that very reason, It's paramount to opt for an extremely light Item that will not be detected when weighed. I recommend a maximum of 120 grams, and that's pushing It to Its limit. Now If this happened with the same scenario as the above, the weight would not be heavy enough to be recorded, so the outcome of your SE would've been the opposite- a success.
What Is The Partial Method?
This Is very similar to the method above and In terms of Investigations opened, the company's procedure Is also much the same- to Identify weights and determine If what you're saying Is true and correct. The only difference to the missing Item method, Is that rather than placing an order for "a single Item" and claiming that alone, the partial method Involves buying "multiple Items" and then social engineer one or more. For this to work, all goods must come In the same consignment and delivered as such by the carrier In one hit, and then say that one or more Items were missing when you opened the package. That Is, your order was partially filled, hence It's appropriately titled "the partial method". Although what you're about to read next Is stating the absolute obvious, many SE'ers neglect to put It as part of the equation, and then they wonder why their SE prematurely came to an end.
If you're planning to social engineer more than one Item, perhaps two or three In total, It's of the utmost Importance to calculate the "total weight", meaning to combine the weight of each Item Into a single figure. Yes, this Is all a matter of common sense, however for one reason or another, SE'ers on all levels somehow completely overlook It and If an Investigation Is opened, the SE will fail- there are no Ifs, ands, or buts about It. Just so you understand what I'm referring to, I shall provide a brief scenario as follows. Let's say I'm going to SE a Fitbit Versa 2 Watch at "38 grams", "Ray-Ban Justin Rectangular Sunglasses at "29 grams" and a Crucial 240 GB SSD at around "55 grams". The weights of each and every Item must be merged Into one. In this case, the total (38 + 29 + 55) Is "122 grams" which just scraped through the 120 gram limit, thus they're fine to use with the partial method. If one or more Items were 15-20 grams heavier, then It'll most likely be noticed at some stage when the package was weighed.
The Partial Manufacturer Method:
Now that you fully comprehend how both the missing Item and partial method Is used and what to expect during the claims process, you should have no Issues whatsoever In following the formulation of the "Partial Manufacturer Method" so without further delay, let's make a start. Okay, In terms of the method, It's simply used to say that upon buying your Item and opening the box thereafter, "a part of It was missing" from the box Itself . This Is the result of a "manufacturer error". In other words, the box was perfectly fine when It arrived at your house from the carrier driver- there were no signs of tampering nor any Inconsistencies with the seal/tape that was used to secure It, but much to your surprise, "one component" was not enclosed and It's this (single component) that you'll be SEing for a replacement or a refund.
As with the other aforementioned methods, you need to be systematic with the "type of Item" that you'll be SEing, and not choose something off the top of your head- there's a couple of very Important elements that must be considered prior to moving forward. I don't like to (once again) state the obvious, but because some SE'ers cannot grasp the most simple tasks, I feel that It's become a requirement with all my tutorials. That aside, the first thing Is to select an Item that has detachable parts or a few accessories that are needed for It to function. An example of this, Is a "CPU" (processor) that comes packaged with the fan/cooler, an RGB cable and of course, the CPU Itself. Now when using the partial manufacturer method on this, you'll be SEing the most expensive part being the "CPU" (some retail as much as 590.00$), by saying that only the cooler and cable was In the box when you opened It.
The thing that makes this method so effective, Is the fact that manufacturers do make errors by forgetting to pack a particular part In Its respective box and companies are well aware of It and given they receive legit claims for such circumstances, your SE also becomes part of this equation! If you've prepared your method flawlessly and executed your attack In the same manner, It will be a very arduous task for the representative to differentiate your SE from the real deal. The second element that plays a crucial and much more significant role, Is that the "box must be fully packaged with cardboard on all four sides"- without a clear film/window, thereby Its contents cannot be viewed externally. "Why Is that", you ask? Well, If the company's warehouse has CCTV cameras that're actively monitoring the packing of goods and an Investigation Is opened, they can refer to the camera footage and see ("through the clear film") that the Item you've claimed as missing, was In fact "In the box" as It was packed and dispatched, therefore your SE will fail. To help you make Informed decisions when selecting Items, checkout the following topic.
Items Suited To The Partial Manufacturer Method:
As you're aware, It's vital to opt for Items that come In pieces and can be attached to each other In some way, and to make your SE well worth the effort, the "part that you'll be SEing" should be rather expensive, so In the event a replacement Is offered and not a refund, you'll still be making a considerable profit. A perfect example, Is what you've just read above pertaining to the CPU that costs (at the time of writing) close to 600.00$, and the cooler/fan Is around 100-120$, hence you'll social engineer the former (CPU) and not the latter (Cooler). I'd like to reiterate the "weight"- do remember to keep It under 120 grams, or else an Investigation will deem It In favor of the company. Just to give you an Insight, I've listed a handful of Items that're well-suited to the method, thus should be used as a general guide when putting your SE together.
- AirPods Pro with charging case. Weight: 56.4 grams
- AirPods (Previous Model) with charging case. Weight: 46 grams
- Crucial 240 GB SSD with USB cable. Weight: 60 grams.
- Ray-Ban Justin Rectangular Sunglasses with case. Weight: 95 grams.
- 10k Bridal Wedding Ring with box, Weight: 110 grams.
The weights of each Item above, are the total weights of how they're shipped (net weight) and you'll be SEing only "one part". For example, regarding the "SSD" that comes with the USB cable (and possibly a driver disc and user manual), It weighs around 45 grams. The other bits make up the difference with a total weight of 60 grams. Evidently, you'll social engineer only the SSD. The same principle applies to the "Ray-Ban Sunglasses", they weigh roughly 40 grams and the case fulfills the rest totaling 95 grams. You will say that only the case arrived, so It's obvious what you'll SE.
In Conclusion:
On the grounds that you've thoroughly read every topic (If you haven't, go back and do so now!), you'll have a clear and accurate understanding of how the "partial manufacturer method" functions, Inclusive of the requirements to formulate It correctly In readiness to manipulate your target successfully. As said, the thing that makes this method so effective, Is that manufacturers make mistakes a lot more often than you think, which supports your claim from an SEing perspective. Moreover, saying that "one part of the complete Item was missing", seems a lot less suspicious than claiming the entire Item. In closing, I'll repeat myself by reminding you to not forget the weight limit- which Is "120 grams". Sure, there are times when reps are half-asleep on the job and approve your claim without considering the weight, but I've left nothing to chance and If an Investigation Is opened, you're well and truly covered.
