HackTheBox functions as a training lab, or otherwise a "hacker gym" where people can put their skills to the test, and enhance them through learning. As someone interested in offensive cybersecurity, especially in regards to human exploitation, I imagined, "why is there no 'gym' for social engineering?" Some obvious issues came to mind: how could someone be ethically manipulated? How can someone participate without knowing an attackers intentions? But, I knew there could be a way. I knew because events like DEFCON host Capture The Flags, and the Social Engineering village hosts their own CTF. Lastly, I had seen some video game called Vaudeville, which you basically play as a police officer trying to make an AI admit they committed a crime by dissecting their alibi. After realizing that humans couldn't actually be put to use, but an AI could functionally imitate them, the idea for Pond was made.

The idea is simple: pick your mode, achieve your goal. Based on the different modes, the user has different deliverables. The options that users can choose between with are 1. Mass Phishing 2. Spear Phishing, and 3. Vishing. After you select your mode, the user chooses their difficulty. The difficulty chooses what data is visible, such as suspicion meter, starting suspicion levels, timers, but also information regarding deliverables like target scores, target victim, etc., and are all difficulty dynamic. The goals and operations also shift depending on your task. For example, OSINT in mass phishing is minimalist compared to spear phishing and vishing, since you're targeting a broader population. Or in mass phishing, where the goal is to capture as many points as you can. Spear phishing and Vishing are much more targeted, specific instances. The idea behind Pond was to create spaces where social engineering could be experimented and played with, similarly and ethically akin to technical hacking platforms like TryHackMe or HackTheBox. Since it couldn't practically be made with humans, AI was the next best thing.

The Github repo includes an MIT license so anyone can edit or interact with the code, improve it, play with it, etc. Besides lacking actual humans, another limitation I would have preferred is if Pond could function with the same technical sophistication of using actual real world tools. HackTheBox achieves this through allowing you to either run their cloud based virtual machine, or connect to their virtual private network through a local virtual machine. Since social engineering as the broader concept within human interaction isn't necessarily huge, I opted to not use that same heavy set up, or use real world tools for that matter. Perhaps that can be a future enhancement. Nevertheless, Pond is a project I made as the "TryHackMe / HackTheBox Social Engineering alternative."