Developer's Guide to Web Application Security

Although credentials can be forged for the eyes of the unassuming, most creden-

tials are inferred; assigned solely because the attacker acts as if he belongs where he is.

Quite often, access to the interior of any facility can be gained by “piggybacking”

with a truly authorized individual. In this, the social engineer simply may strike up

small talk with another employee as he walks toward the building. Arriving at the

locked door, the social engineer will pat down his coat pockets,“looking” for his key

or passcard. In such a case, most people will do the other guy a favor and let him in

with their key.

Far from playing the part of the nervous interloper ...