Its Coming From Inside the House: Guide to Physical Facility Pentesting

The talk starts with scoping a physical facility engagement. The speaker stresses agreeing on in-scope methods, success criteria and after-hours contacts, and using a letter of authorization plus a third-party consent form when the client does not own the building. Reconnaissance comes next: social media, company hashtags and satellite imagery can reveal badge designs, dress codes and entry points, and on-site visits confirm what remote research suggested, including crowd flow and the security culture of staff.

The middle section covers initial access through three routes: social engineering with tailgating, surreptitious entry outside business hours, and authenticated entry by badge cloning. The speaker explains how to build a pretext that gets you in, lets you move around and lets you stay, and how inexpensive replica badges can be made. Badge technology is traced from magnetic stripe through low-frequency and high-frequency RFID to newer readers, with notes on which formats are vulnerable and on tools such as Flipper Zero and Proxmark. A covert reader placed beside a door can capture credentials from people who badge in.

The talk closes with post-exploitation: photograph evidence, stay within the agreed impact, and leave the site no less secure than it was found. The main takeaway is that preparation, documentation and a calm, credible story matter most.