A penetration tester is conducting a physical assessment and wants to test whether an employee will allow them into a secured area. The tester approaches a door carrying large boxes, making it difficult to badge in, and waits for an employee to open the door. What technique is this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — carrying large boxes to make it hard to badge in exploits the natural human tendency to help someone whose hands are full by holding the door open. It combines tailgating with a physical prop to make the bypass seem more natural and less suspicious.
Full Explanation
The tailgating/piggybacking with a pretext prop description is correct because using boxes as props exploits the natural human tendency to help someone whose hands are full by holding the door open, combining tailgating with a social engineering prop to make the bypass seem more natural and less suspicious. The social engineering via pretexting description is wrong because pretexting involves fabricating a false identity or story, such as claiming to be an IT technician; carrying boxes is a physical prop, not a narrative identity assumption. The shoulder surfing description is wrong because shoulder surfing involves observing credentials being entered, not physical access bypass. The dumpster diving description is wrong because dumpster diving involves searching discarded materials for sensitive information, not bypassing physical access controls.