Should Social Engineering be a part of Penetration Testing?

DumpBrowserSecrets is a post-exploitation credential-harvesting tool designed to extract saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history, and bookmarks from major browsers (Chrome/Edge/Brave via App-Bound Encryption bypass, Opera/Opera GX/Vivaldi via DPAPI, and Firefox via NSS). It achieves App-Bound Encryption decryption by spawning a headless Chromium process and injecting a DLL (Early Bird APC) to call the IElevator COM interface, returns decrypted keys via a named pipe, parses on-disk SQLite/JSON stores, outputs structured JSON, and includes multiple evasion features; the report also outlines detection points and mitigation recommendations.