2.1 RFID Recon Recap

RFID Recon Recap

Bridging passive reconnaissance into active access attacks

From Observation to Action

This lesson marks the transition between two very different phases of RFID testing. Passive reconnaissance, the kind covered in earlier coursework, required no direct interaction with the systems under observation. You watched badge use from a distance, noted reader placements, photographed equipment, and catalogued access points. That work produced an intelligence picture of the target facility without ever touching a card or triggering a reader. Active attacks are fundamentally different: you are now engaging directly with the hardware, reading card data, writing clones, and testing whether those clones grant access. That distinction carries serious legal weight, which is why authorization requirements apply here that did not apply during observation.

Before proceeding with any active technique, confirm your Rules of Engagement explicitly cover RFID testing. Explicit written authorization is the baseline. “Physical security testing” does not automatically include badge cloning. If badge cloning is not specifically named, get written clarification before touching a card.

What Your Recon Should Have Captured

Good passive reconnaissance produces specific, actionable intelligence. The most important outputs are reader locations mapped throughout the facility, an identified card format, and an assessment of which access points represent high-value targets. On reader format identification: HID readers are the most common encounter in the field. Many facilities will mix 125kHz low-frequency systems with 13.56MHz high-frequency systems across different zones, so you may not be dealing with a single uniform technology throughout.

The card format identification is especially critical because it determines which tools and attack techniques apply. HID Prox operating at 125kHz requires different commands and different blank media than a MIFARE Classic card operating at 13.56MHz. An operator who walks into the active phase without knowing the card type will lose time trying to identify it in the field, and field time is typically constrained.

What Active Attacks Cover

The active phase of RFID testing includes four core capabilities. The first is reading card data directly from a target card, which requires either momentary physical access to the card or sufficient antenna range to capture the transmission. The second is cloning that data to a blank programmable card. The third is emulating a badge in real time using a device like a Proxmark3 or Chameleon Mini, which simulates the card electronically without writing to a blank. The fourth, and most invasive, is deploying covert readers as implants to passively harvest credentials over time.

Each of these techniques requires a corresponding authorization level. Reading a card requires access to the card. Cloning requires explicit cloning permission. Emulation falls under the same permission umbrella as cloning. Implant deployment requires separate, specific approval beyond general RFID testing authorization.

Equipment You Need

The core tool for active RFID testing is the Proxmark3. The RDV4 model is strongly recommended for professional work because of its standalone mode, which allows field operation without a connected laptop. The PM3 Easy is a capable training device but is not suited to covert field deployments. In addition to the Proxmark, you will need a supply of blank T5577 cards for low-frequency cloning, and test cards for practicing commands before field work. Chameleon Mini or Tiny devices, covered in depth later in the topic, add real-time emulation capability and complement the Proxmark for field operations.

Key Takeaways

• Active requires authorization. Unlike passive recon, active RFID attacks interact directly with cards and readers. Explicit written permission naming badge cloning must be in your Rules of Engagement before you begin.
• Recon intelligence directs your approach. Knowing the card format from passive recon tells you which tools to bring and which techniques to apply, saving critical field time.
• Frequency determines the attack path. 125kHz low-frequency cards use different tools, different blank media, and different commands than 13.56MHz high-frequency cards.
• Four core capabilities. Active RFID testing covers direct reading, cloning to blank cards, real-time emulation, and implant deployment, each with distinct authorization requirements.

Sources: Proxmark3 RRG/Iceman GitHub  ·  Proxmark3 Wiki  ·  ISO/IEC 14443 Contactless Cards Standard