# Remote Badge Cloning with the Flipper Zero

- URL: https://bryancowan.com/remote-badge-cloning-with-the-flipper-zero/
- Published: August 12, 2026
- Series: Conference notes
- Tags: defcon34
- Part of: [DEF CON 34 Notes: 15 Talks on AI Security, Agentic Systems, and Red Teaming](https://bryancowan.com/def-con-34-notes-15-talks-on-ai-security-agentic-systems-and-red-teaming/)

**Speakers:** [Langston Clement](https://info.defcon.org/defcon34/people/67478), [Dan Goga](https://info.defcon.org/defcon34/people/67462) · **Source:** [DEF CON 34 talk page](https://info.defcon.org/defcon34/content/66777) · **GitHub:** [sh0cksec](https://github.com/sh0cksec)

📄 [Download this note as Markdown](https://raw.githubusercontent.com/bryancowan/defcon34-notes/main/Remote%20Badge%20Cloning%20with%20the%20Flipper%20Zero.md)

## Overview

Traditional RFID badge cloning methods require you to be within 3 feet of your target. So how do you conduct a physical penetration test and clone a badge without interacting with a person? This session covers two accessible, entry-level hardware designs you can build in a day and deploy in the field, along with the social engineering techniques that improve your odds of remotely cloning an RFID badge — plus a new Python script to decode badge data faster, and instructions to build your own standalone gooseneck reader, wall implant, and clipboard cloning devices.

## Notes

### Brief
Badge collecting techniques like brush passes and clipboard audits all require getting within about 6 feet — doable, but with more people working remotely, fewer people are badging in at all. The solution is long-range techniques.

### Wall Reader
A wall implant paired with a secondary (decoy) scanner and a sign encouraging its use; scanner data can be pulled via WiFi at close range. ([github.com/sh0ckSec/RFID-Gooseneck](https://github.com/sh0ckSec/RFID-Gooseneck)) Used readers are available on eBay. Can be combined with misdirection: placing readers very close together creates a DoS so the original doesn't work, pushing people to other entrances.

### Gooseneck Pedestal
Used in a parking garage — can be installed by a doorway to grab badge information as people pass by.

### Flipper Zero
[github.com/sh0ckSec/FlipperHIDecoder](https://github.com/sh0ckSec/FlipperHIDecoder) captures facility code and card number, then a Python script converts the badge data into a format the Flipper supports so it can be cloned onto a new, authentic-looking badge.

### From the Repos
- **RFID-Gooseneck**: full build guide for a long-range gooseneck-mounted reader using an HID MaxiProx 5375 or iCLASS SE R90 reader wired to an ESP RFID Tool, with a full bill of materials and wiring schematics; captured data is retrieved from the tool's web interface and written to rewritable T5557 blanks.
- **FlipperHIDecoder**: converts 26-bit HID card data (H10301 standard) from ESP RFID Tool captures into Flipper Zero-compatible format, with single-card or batch processing, CSV/JSON/Markdown export, and parity validation — also handles 33/34/35/37-bit formats.

_Filed Under:_ #defcon34