skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-physical-intrusion-assessment

Conduct authorized physical penetration tests using tailgating, badge cloning, lock bypass, and rogue devices.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#tailgating#physical security#Red Team#RFID#badge cloning#lock picking
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-physical-intrusion-assessment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-physical-intrusion-assessment
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/performing-physical-intrusion-assessment
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-physical-intrusion-assessment

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Organizations often invest heavily in network security while leaving physical entry points untested, allowing attackers to bypass all digital controls by simply walking in. This Skill guides authorized testers through a structured physical intrusion assessment that evaluates badge systems, locks, guards, and exposed network ports with documented evidence.

Core Features & Use Cases

  • Tailgating and Social Entry: Test employee challenge behavior using pretexts like deliveries, smoke breaks, and shift-change timing.
  • Badge Cloning and Lock Bypass: Capture and clone HID/MIFARE credentials with Proxmark3 or Flipper Zero, and bypass pin tumbler, wafer, and mag locks.
  • Rogue Device Deployment: Plant LAN Turtles, WiFi Pineapples, and USB drop devices to establish internal network footholds.
  • Use Case: A red team is contracted to test a corporate campus. The tester follows the methodology to map entry points, clone an employee badge, tailgate through a side door, and deploy a LAN Turtle on an exposed lobby jack, producing timestamped photo evidence for the final report.

Quick Start

Plan an authorized physical intrusion assessment for a corporate office covering tailgating, badge cloning, lock bypass, and rogue device deployment with full documentation requirements.

Frequently Asked Questions about performing-physical-intrusion-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an authorized physical penetration test?▼

Start with pre-assessment reconnaissance of entry points, cameras, and guard patterns, then execute phases covering perimeter, building entry, internal access, and restricted areas. Always carry a signed authorization letter and document every attempt with timestamps and photos.

How to clone RFID access badges with Proxmark3?▼

Use 'lf hid read' to capture a 125kHz HID card, then 'lf hid clone --fc <fc> --cn <cn>' to write it to a T5577 blank card. For 13.56MHz MIFARE cards, use 'hf mf rdbl' with the appropriate key. Flipper Zero can also read and emulate common badges.

What tools are needed for physical security assessments?▼

Core tools include a Proxmark3 RDV4 for badge cloning, Flipper Zero for RF analysis, a lock pick set, under-door tool, LAN Turtle for network implants, WiFi Pineapple for rogue wireless, and a body camera for evidence documentation.

What legal authorization is required for physical pentesting?▼

You need a signed authorization letter carried at all times, a get-out-of-jail letter signed by an executive authority, and a 24/7 emergency contact for the client security team. Stop immediately if law enforcement is called before deconfliction.

Which MITRE ATT&CK techniques map to physical intrusion?▼

Physical intrusion maps primarily to T1200 (Hardware Additions) and T1091 (Replication Through Removable Media) under Initial Access, with T1199 (Trusted Relationship) and T1078 (Valid Accounts) also relevant for rogue devices and cloned credentials.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

osint

Enumerate repositories, scan for secrets, and map employee footprints across public sources.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
AcczdyAcczdy
2

performing-wireless-network-penetration-test

Coordinate monitor-mode setup, WPA2/WPA3 attacks, and rogue-AP testing.

Community
Advanced
YukiIto1999YukiIto1999

social-engineering

Assess human-factor security risks through authorized social engineering simulations.

Community
Advanced