Section 04

Intermediate

RFID & Access Control

Electronic access control is now a mix of legacy RFID, smartcards, mobile credentials, cloud-managed controllers, and still-too-common weak reader deployments. Offensive badge work is still central, but strong assessments should also explain why the architecture makes cloning, emulation, or downstream abuse possible.

Authorised Testing Only

Badge cloning, emulation, and reader attacks must be explicitly authorised. Carry your scope letter, confirm which entrances are in play, and coordinate with security operations before presenting a cloned credential to any door.

RFID / NFC Badge Types

Frequency	Type	Common Use	Clone Difficulty
125 kHz	HID ProxCard	Legacy access	Easy
125 kHz	EM4100	Basic access	Easy
13.56 MHz	MIFARE Classic	Access/transit	Medium
13.56 MHz	MIFARE DESFire	Secure access	Hard
13.56 MHz	iCLASS	HID high security	Medium-Hard

Modern Access-Control Review Points

Credential Questions

• Is the site still using easily cloned 125 kHz credentials?
• Are mobile credentials tied to strong device assurance or just convenience?
• Are temporary badges controlled, logged, and reclaimed?
• Do employees expose badges visually or carry them in scannable positions?

Reader and Controller Questions

• Is reader wiring protected or physically exposed?
• Does the environment still use Wiegand instead of OSDP Secure Channel?
• Are door events monitored or only logged passively?
• Can a cloned or emulated credential reach sensitive zones without secondary friction?

Proxmark3 Commands

Reading Badges

proxmark3> lf search          # Detect low frequency card
proxmark3> hf search          # Detect high frequency card

Clone HID ProxCard (125 kHz)

proxmark3> lf hid read        # Read card
proxmark3> lf hid clone [ID]  # Write to T5577 blank

Clone EM4100 (125 kHz)

proxmark3> lf em 410x read    # Read card
proxmark3> lf em 410x clone [ID]

MIFARE Classic Attack

proxmark3> hf mf autopwn     # Attempts various attacks
proxmark3> hf mf dump        # Dump all sectors
proxmark3> hf mf restore     # Write to blank card

Brute Force Facility Codes

proxmark3> lf hid brute [CN]  # Try all FCs for card number

Flipper Zero (Portable Alternative)

125kHz → Read → Save
125kHz → Saved → Emulate
NFC → Read → Save & Emulate

Long-Range Reading Techniques

Use directional antenna with Proxmark3 (25+ cm range)
Concealed reader in bag/clipboard
"Brush pass" technique in crowds

Badge Format (HID Example)

HID badges use: FC (Facility Code) + CN (Card Number)

Example: FC:100 CN:12345

What Strong Defenders Do Differently

Defensive Signals

• DESFire EV2/EV3 or SEOS credentials on all perimeter doors
• OSDP Secure Channel readers with encrypted wiring
• Mobile credentials backed by device attestation (not just app-based)
• Quarterly access reviews with automatic badge deactivation

High-Risk Signals

• 125 kHz EM4100 / HID Prox still in use on perimeter doors
• Reader wiring exposed in drop ceilings with Wiegand protocol
• No anti-passback or door-held-open alerts configured
• Temporary badges never reclaimed or audited

Recommended Tools

📡

Proxmark3

The gold-standard RFID/NFC research tool. Reads, writes, and emulates 125 kHz and 13.56 MHz cards including HID, MIFARE, and iCLASS.

🐬

Flipper Zero

Portable multi-tool for quick badge reads, Sub-GHz capture, and NFC emulation. Great for initial access-control reconnaissance.

Observation Record

A credential finding is only as strong as the link between the badge, the reader that accepted it, and the door it opened. Record:

Credential identity: Frequency, technology (EM4100, HID Prox, MIFARE Classic, DESFire, iCLASS), and the UID or facility code and card number read from the badge.

Reader identity: Make, model, and whether the reader speaks Wiegand or OSDP, plus the door and zone it protects.

Interface used: The Proxmark3 command family, Flipper menu path, or phone NFC read that produced the dump, named exactly as run.

Capture artefact: The saved dump filename, its checksum, and the reader where the clone was presented, so the dump can be matched to the door event later.

Credential source: Whether the badge was loaned by the client, cloned with the holder present, or captured at range, and the authorisation that covered it.

Presentation result: Which doors accepted the clone on the first attempt, which refused, and what the controller logged for each.

False Positives

Door opened for another reason: A held door, a REX trigger, or an unlock schedule can accept a clone that the controller never validated. Match the acceptance to an access event.
Wrong frequency claimed: An LF read does not prove an HF door is cloneable. Pair the credential with the reader that actually accepted it.
Anti-passback and time zones: A clone that works at the perimeter may fail at the next door by design. Report the doors that accepted it, not the system as a whole.
Lab-only configuration: A reader on a bench in enrolment or test mode says nothing about a production controller.
Original badge still in the population: If the cloned UID belongs to an active credential, check whether the acceptance was the clone or the original presented by its holder.

Testing Checklist

Credential

☐ Identify frequency and technology before attempting a read.
☐ Record UID, facility code, and card number for every credential touched.
☐ Check whether temporary and contractor badges are logged and reclaimed.

Reader and controller

☐ Note the reader protocol and whether reader cabling is exposed.
☐ Check for anti-passback, door-held-open alerts, and forced-door alarms.
☐ Confirm which doors share a controller with the sensitive zone.

Doors and logging

☐ Present the clone at the lowest-value door first.
☐ Correlate each acceptance with the access log entry for the same minute.
☐ Record the doors that refused, and the reason shown in the log.

Remediation

Credential layer

• Retire 125 kHz proximity credentials on perimeter and sensitive doors in favour of DESFire EV2/EV3 or SEOS.
• Tie mobile credentials to device attestation rather than app-only enrolment.

Reader and controller layer

• Move reader-to-controller links to OSDP Secure Channel and protect the cabling inside the secure side of the wall.
• Enable anti-passback, door-held-open and forced-door alarms, and route them to someone who responds.

Verification schedule

• Review access rights quarterly with automatic deactivation on leaving, and re-test one door per zone after any reader or controller replacement.

Physical Security

Return to section overview and tier model.

Rogue Devices & Post-Ex

What to do once you get past the badge reader.

Flipper Zero & RF Ops

Portable alternative for badge cloning and RF capture.

Standards & Case Studies

Map badge findings to industry standards.

As an Amazon Associate I earn from qualifying purchases.