# Social Eng Physical

> Run an authorized physical social-engineering assessment — tailgating, pretext entry, badge/RFID cloning checks, and media-drop tests — to measure physical and human access controls safely. Load after social-eng-methodology when the objective is on-site. Signals: "physical pentest", "test our building access", "tailgating", "badge cloning", "USB drop", "can we get into the office/data center". Requires a carried authorization letter.

- Skill: `noorqureshi/social-eng-physical` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/social-eng-physical`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/social-eng-physical/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/social-eng-physical

---


# Physical assessment

## When it applies
The engagement authorizes on-site testing (cleared via `social-eng-methodology`) with a defined
objective — reach a floor/room, plug into the network, or drop test media — to measure physical
access controls and staff response. Physical work has the highest real-world risk (police, injury,
genuine alarm), so the guardrails are non-negotiable.

## Why it works
Physical security leans on people extending courtesy (holding a door), trusting a uniform or a
confident manner, and following habit over procedure. A tester with a plausible pretext and a hi-vis
vest often walks past controls that are technically sound — the finding is the *procedural/behavioral
gap*, captured with minimum intrusion.

## Method
1. **Carry authorization.** A signed get-out-of-jail letter on you at all times, plus a live
   emergency contact (client-side) reachable to confirm the test instantly to security or police.
   No letter → no entry.
2. **Objective and stop-line, agreed in writing.** Reach the target and prove it (a photo of a
   defined marker, a benign network beacon) — then **stop**. No damage, no real data theft, no
   accessing others' belongings.
3. **Recon the site** (public, non-intrusive): entry points, badge readers, delivery/smoking doors,
   shift changes, dress code — enough for a credible pretext.
4. **Choose the least-intrusive technique for the objective:**
   - **Tailgating / pretext entry** — follow a group or present as delivery/contractor/new-hire to
     test door and reception controls.
   - **Badge/RFID exposure check** — assess whether badges are clonable at a realistic distance and
     whether readers accept a cloned/observed credential (demonstrate the exposure; don't build a
     persistent illicit credential).
   - **Media drop** — leave tracked, benign test USBs/QR flyers to measure plug-in/scan rate; the
     payload only phones home a token, it does nothing to the host.
5. **Prove and withdraw.** Capture the agreed proof at the stop-line and leave; do not push further
   "because it's working".
6. **Debrief and restore.** Recover any dropped media where feasible, disable beacons, and report.

## Gotchas
- **Present the letter the instant you're challenged** — never bluff past a security guard or police;
  disclose and let the emergency contact confirm.
- **Two-person rule for higher-risk entries** where the RoE allows, for safety and witnessing.
- **Benign media only** — a test USB beacons a token; it must not deploy real malware or alter the
  host. The metric is "someone plugged it in".
- **Respect people and property** — no searching desks/bags, no coercion, no entering genuinely
  restricted safety areas beyond scope.
- **Reversible and clean** — leave the site as found; account for every dropped item.

## Verify success
The agreed proof-of-access (marker photo or benign beacon) or a media-drop plug-in metric, obtained
at the stop-line with authorization carried, nothing damaged or taken, and all test artifacts
accounted for — feeding a physical-controls report and remediation.

## References
MITRE ATT&CK T1091 (Replication Through Removable Media), T1200 (Hardware Additions), T1566.004;
standard physical-pentest RoE and safety practice.