Physical and OSINT

Not every attack arrives over the wire. Sometimes the fastest path to a server room is a friendly face at the front door. Physical social engineering and open source intelligence (OSINT) are the two halves of getting inside a building: one is the entry, the other is the homework that makes the entry look routine.

Getting through the door

Physical operators rely on human courtesy far more than on lock picks:

• Tailgating: follow an authorized employee through a door before it closes. Carry a coffee in each hand and someone will hold it open for you.
• Piggybacking: the same, but the employee actively lets you in after a word.
• Pretext props: a hi-vis vest, a clipboard, a laptop bag, and a lanyard read as "belongs here" to almost everyone.
• Impersonation: pose as a delivery driver, an auditor, or the fire inspector.

The defense you are testing is whether staff challenge a stranger. Most will not, which is exactly the finding a report needs to change behavior.

Badge cloning, at a glance

Many offices use low-frequency 125 kHz proximity cards (like HID Prox) that were never designed to be secure. They broadcast a static ID with no authentication. A long-range reader hidden in a bag can capture that ID from a badge in someone's pocket, and a cheap tool can then replay it.

OSINT: the homework

Before any of that, you research. OSINT is intelligence gathered from public sources, and it is what makes a pretext land. Names, org charts, badge photos, email formats, and even the type of coffee in the lobby all come from open data.

Pair those with LinkedIn for the org chart, the company's own site for the email format (first.last@ versus flast@), and image search for what real badges look like. Every detail you collect is one less thing the target has to take on faith.