pentest-physical

name

pentest-physical

description

Physical penetration testing — covert entry, RFID/NFC cloning, lock bypass, on-site rogue device drop. Use when the user mentions physical pentest, on-site intrusion, tailgating, badge cloning, RFID, NFC, HID Prox, MIFARE Classic / DESFire, iCLASS, Proxmark3, ChameleonMini, Flipper Zero, ESPKey, lock pick, bump key, raking, shimming, REX bypass, Salto/ASSA/Onity/Saflok/Unsaflok, drop box, LAN Turtle, Bash Bunny, USB Rubber Ducky, OMG Cable, dumpster diving, or covert entry.

Pentest — Physical

Apply 08-physical/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 08-physical/00-overview.md first.

Phase order

1. 08-physical/01-recon-osint.md — building footprint, hours, vendor list, employee photos, camera coverage.
2. 08-physical/02-perimeter-bypass.md — fence/gate, tailgating, vehicle access, dumpster diving.
3. 08-physical/03-rfid-nfc-cloning.md — badge identification, capture, clone, replay, OSDP posture.
4. 08-physical/04-lock-bypass.md — picking, bumping, raking, shimming, REX bypass, electronic locks.
5. 08-physical/05-on-site-attacks.md — tailgate, impersonation, drop-box, printer compromise, USB drops.
6. 08-physical/06-egress-and-cleanup.md — covert exit, plant recovery, chain-of-custody, debrief.

How to operate

Hard preconditions before any on-site activity:

• Authorisation letter (templates/authorization-letter-template.md) printed and carried by every tester at all times.
• Emergency-contact phone numbers tested and reachable.
• ROE explicitly covers buildings, floors, time windows, permitted activities.
• Equipment manifest with chain-of-custody (templates/evidence-chain-of-custody.md).

Then walk the phase files in order, with two firm rules:

1. Never separate from the authorisation letter; verify any challenger via emergency contact, not by handing over the letter.
2. If something opens by force, document and stop — physical damage is out of scope unless ROE explicitly permits.

For each technique (badge clone, lock bypass, drop plant), follow the matching Methodology + How to test block; record evidence per 08-physical/06-egress-and-cleanup.md chain-of-custody.

When NOT to use

• Remote / network-only engagement.
• Pure wireless (no physical access required) → pentest-wireless.

Pre-conditions

• Proxmark3 RDV4, ChameleonMini, Flipper Zero, ESP-RFID-Tool.
• Lock-pick kits (SouthOrd, Sparrows).
• Drop devices (LAN Turtle, Bash Bunny, Raspberry Pi 4 with VPN-callback).
• Cover identity props (vendor uniform, ID lanyard, clipboard).

OPSEC

• Physical engagements demand higher discipline than network engagements: error = arrest.
• Camera-aware movement; avoid lingering.
• Privacy: dumpster-diving and personnel-data capture require careful handling.

References inside the library

• Tooling: tool-mappings/08-physical-tools.md (incl. Unsaflok, Flipper Zero).
• Frameworks: frameworks/osstmm.md (PHYSEC channel).
• Templates: templates/authorization-letter-template.md, templates/evidence-chain-of-custody.md.