<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-physical-penetration-testing
description: >-
  Physical security assessment of facility access controls, surveillance systems, badge cloning, lock bypass, tailgating, and physical data access. Tests physical security layers and security guard procedures.
domain: cybersecurity
subdomain: security-testing
tags:
  - physical-security
  - badge-cloning
  - lock-bypass
  - tailgating
  - facility-access
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1200", "T1091", "T1052"]
  tools: ["proxmark3", "flipper-zero", "hid-iclass", "lockpick-set", "usb-rubber-ducky"]
---

# Conducting Physical Penetration Testing

## Overview

Physical penetration testing evaluates the effectiveness of physical security controls including access control systems, surveillance, security personnel, locks, and environmental controls through authorized simulated intrusion attempts.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `proxmark3` | Security tooling |
| `flipper-zero` | Security tooling |
| `hid-iclass` | Security tooling |
| `lockpick-set` | Security tooling |
| `usb-rubber-ducky` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Physical Reconnaissance

```bash
# Physical security assessment checklist
cat <<'EOF'
PHYSICAL RECON CHECKLIST
=========================
EXTERNAL:
[ ] Perimeter fencing and gates
[ ] Parking lot access controls
[ ] Loading dock security
[ ] Emergency exit locations and alarm status
[ ] Dumpster location (dumpster diving potential)
[ ] Camera positions and blind spots
[ ] Lighting assessment (night conditions)
[ ] Guard patrol patterns and schedules

BUILDING ENTRANCE:
[ ] Badge reader type (HID, MIFARE, etc.)
[ ] Visitor management process
[ ] Guard desk procedures
[ ] Mantrap / turnstile presence
[ ] Tailgating prevention controls

INTERNAL:
[ ] Server room access controls
[ ] Network closet security
[ ] Clean desk policy compliance
[ ] USB port accessibility
[ ] Printer/MFP security
EOF
```

### Step 2: Access Control Testing

```bash
# Badge cloning with Proxmark3
# Read HID badge (authorized test badge)
proxmark3> lf hid read
proxmark3> lf hid clone --r FACILITY_CODE:CARD_NUMBER

# MIFARE Classic attack
proxmark3> hf mf autopwn

# Flipper Zero — RFID read and emulate
# Read badge → Save → Emulate at target reader

# Lock bypass techniques (documented for authorized testing)
cat <<'EOF'
LOCK BYPASS LOG
================
Location: Server Room B, Building 2
Lock Type: Kwikset deadbolt
Method: Single pin picking (SPP)
Time: 45 seconds
Result: ACCESS GAINED
Evidence: Photo with timestamp
EOF
```

### Step 3: Social Engineering Physical Access

```bash
# Physical social engineering scenarios
cat <<'EOF'
SCENARIO LOG
=============
Test 1: Tailgating
  Location: Main entrance, Building 1
  Time: 08:45 (morning rush)
  Method: Followed employee through badge door
  Result: ACCESS GAINED — no challenge
  Duration: Entry in 3 seconds

Test 2: Pretexting (IT Technician)
  Location: Reception, Building 1
  Pretext: "IT support, here to fix the printer on floor 3"
  Props: Clipboard, fake work order, polo shirt
  Result: ACCESS GAINED — escorted to floor 3, left alone
  Duration: 5 minutes to unescorted access

Test 3: USB Drop
  Location: Parking lot, near entrance
  Method: Dropped 5 USB drives labeled "Q4 Salary Review"
  Result: 2/5 drives connected to corporate machines
  Detection: None during 48-hour monitoring period
EOF
```

### Step 4: Evidence and Reporting

```bash
# Evidence collection checklist
cat <<'EOF'
EVIDENCE DOCUMENTATION
=======================
For each test:
  [ ] Timestamped photo/video of access gained
  [ ] GPS coordinates of test location
  [ ] Time of day and conditions
  [ ] Method used with step-by-step description
  [ ] Personnel encountered and their response
  [ ] Assets accessed or observed
  [ ] Time from attempt start to objective achieved

PHYSICAL FINDING FORMAT:
  [PHYS-001]
  Location:    Server Room B, Building 2
  Control:     Door lock — Kwikset deadbolt
  Weakness:    Standard residential lock, no alarm sensor
  Method:      Lock picking (45 seconds)
  Impact:      Direct access to server infrastructure
  Remediation: High-security commercial lock + alarm contact
  Priority:    Critical
EOF
```

## Detection

```yaml
title: Physical Penetration Testing Detection
id: 94e0a6c2-2829-4e3a-a03e-dc96014719d7
status: experimental
description: Detects suspicious activity related to conducting physical penetration testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*physical*"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1091
  - attack.t1052
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Physical Penetration Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1200, T1091, T1052 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
