Remote Badge Cloning with the Flipper Zero

  • Post author:
  • Post category:Uncategorized

Speakers: Langston Clement, Dan Goga · Source: DEF CON 34 talk page · GitHub: sh0cksec

📄 Download this note as Markdown

Overview

Traditional RFID badge cloning methods require you to be within 3 feet of your target. So how do you conduct a physical penetration test and clone a badge without interacting with a person? This session covers two accessible, entry-level hardware designs you can build in a day and deploy in the field, along with the social engineering techniques that improve your odds of remotely cloning an RFID badge — plus a new Python script to decode badge data faster, and instructions to build your own standalone gooseneck reader, wall implant, and clipboard cloning devices.

Notes

Brief

Badge collecting techniques like brush passes and clipboard audits all require getting within about 6 feet — doable, but with more people working remotely, fewer people are badging in at all. The solution is long-range techniques.

Wall Reader

A wall implant paired with a secondary (decoy) scanner and a sign encouraging its use; scanner data can be pulled via WiFi at close range. (github.com/sh0ckSec/RFID-Gooseneck) Used readers are available on eBay. Can be combined with misdirection: placing readers very close together creates a DoS so the original doesn’t work, pushing people to other entrances.

Gooseneck Pedestal

Used in a parking garage — can be installed by a doorway to grab badge information as people pass by.

Flipper Zero

github.com/sh0ckSec/FlipperHIDecoder captures facility code and card number, then a Python script converts the badge data into a format the Flipper supports so it can be cloned onto a new, authentic-looking badge.

From the Repos

  • RFID-Gooseneck: full build guide for a long-range gooseneck-mounted reader using an HID MaxiProx 5375 or iCLASS SE R90 reader wired to an ESP RFID Tool, with a full bill of materials and wiring schematics; captured data is retrieved from the tool’s web interface and written to rewritable T5557 blanks.
  • FlipperHIDecoder: converts 26-bit HID card data (H10301 standard) from ESP RFID Tool captures into Flipper Zero-compatible format, with single-card or batch processing, CSV/JSON/Markdown export, and parity validation — also handles 33/34/35/37-bit formats.

Filed Under: #defcon34

Tags: