---
source: https://info.defcon.org/defcon34/content/66777
github: https://github.com/sh0cksec
---
- [Langston Clement](https://info.defcon.org/defcon34/people/67478 "Langston Clement")
- [Dan Goga](https://info.defcon.org/defcon34/people/67462 "Dan Goga")

## Overview

Traditional RFID badge cloning methods require you to be within 3 feet of your target. So how can you conduct a physical penetration test and clone a badge without interacting with a person? Companies have increasingly adopted a hybrid work environment, allowing employees to work remotely, which has decreased the amount of foot traffic in and out of a building at any given time. This session discusses two accessible, entry-level hardware designs you can build in a day and deploy in the field, along with the tried-and-true social engineering techniques that can increase your chances of remotely cloning an RFID badge.

Langston and Dan discuss their Red Team adventures using implant devices and their Flipper Zero workflow. As a bonus the two will present a new python script to help you decode your badge data faster. This presentation is supplemented with files and instructions that are available for download in order to build your own standalone gooseneck reader, wall implant and clipboard cloning devices!

## Notes

### Brief
- Badge collecting techniques
	- Brush pass
	- Clipboard (badge audit)
	- All require 6 feet
	- Can put a face with the name
	- Now with more remote folks, you get fewer people badging in
- The solution is long-range techniques

### Wall Reader
- Wall implant with a secondary (decoy) scanner and a sign encouraging its use
- Scanner data can be pulled via WiFi at close range
- https://github.com/sh0ckSec/RFID-Gooseneck
- Used readers are available on eBay
- Combine with misdirection
	- Readers placed very close to each other create a DoS, so the original one doesn't work
	- That lets you push people to other entrances — social-engineering style

### Gooseneck Pedestal
- Used in a parking garage
- Can be installed by a doorway to grab badge information as people pass by

### Flipper Zero
https://github.com/sh0ckSec/FlipperHIDecoder
- Card data captured:
	- Facility code
	- Card number
- The Python script converts the badge information into a format the Flipper supports
- Then use the Flipper to clone it onto a new badge that looks authentic

### From the Repos
- **RFID-Gooseneck**: full build guide for a long-range gooseneck-mounted reader using an HID MaxiProx 5375 or iCLASS SE R90 reader wired to an ESP RFID Tool, with a bill of materials and wiring schematics; captured badge data is retrieved from the ESP RFID Tool's web interface (`192.168.1.1`), converted from HEX, and written to rewritable T5557 blanks
- **FlipperHIDecoder**: converts 26-bit HID card data (H10301 standard) from ESP RFID Tool hex captures into Flipper Zero-compatible format; supports single-card or batch processing of ESP-RFID log files, exports to CSV/JSON/Markdown, and includes parity validation and Wiegand bit analysis. Also handles 33/34/35/37-bit formats