THE PROBLEM
Extracting RFID & Keypad credentials via spliced implants is a well-known technique. However, these tools are rarely used in professional audits: installations are slow and complicated, and damage to wiring, hardware and infrastructure are rarely authorised in Scope of Engagement documents.
The implants themselves have limited functionality and protocol support, and only provide the "capture" part of an RFID Audit lifecycle. The analysis and cloning of a captured credential requires multiple manual steps, tools and skills.
THE SOLUTION
Imagine walking into an audit, placing an access control reader on a wall and instantly collecting credentials. Your phone gives you real-time notifications of skimmed badges and PIN codes, and directly writes a clone badge with your Proxmark.
You don't need a computer, you don't need to damage client property, you don't need to memorise arcane Proxmark commands. Everything is taken care of. When the audit is over, you've got a timestamped log of all operations, ready for export into a report. Your time and skills are spent on the audit, instead of the tools.
You've just imagined the Stealth Decoy Reader platform, a next-generation, non-destructive credential capture system designed specifically for red-teamers and pentesters. The Stealth Decoy Reader is an open-source, battle-tested hardware module built to collect and exfiltrate all known corporate access-control protocols and PIN codes.
Even better, the Stealth Decoy Reader is available pre-installed inside the most common access control readers for perfect camouflage. The readers come equipped with non-destructive mounting systems, ready for rapid placement in public areas, choke points, doorways, cabinets, etc.
The Stealth Decoy Reader Platform covers the full RFID pentest life-cycle:
-
Capture: Rapidly deployed, instant multi-factor credential skimming
-
Control: Manage multiple devices, analyse, save, tag and exfiltrate captured credentials via the cross-platform WebUI.
-
Clone: Emulate, clone and write captured credentials directly from the UI via Proxmark 3. One click & wireless: No command lines, no code.
-
Access: Gain and escalate access via cloned RFID.
POWERED BY STEALTH
Inside every Stealth Decoy Reader is a Stealth Decoy Module - the high-performance, multi-protocol, wireless equipped RFID capture, analysis and cloning device. It works hand-in hand with the Doppelgänger Assistant, a cross-platform professional GUI application designed to handle every possible operation requirement.
Together, they allow for automated card capture and wireless credential exfiltration. Teams can collaborate and share credentials; credentials can be analysed, exported or cloned.
The Doppelgänger Assistant also works as a easy-to-use UI for the Proxmark 3, making credential writing, cloning and verification a one-click operation. Don't miss opportunities because of knowledge gaps or constrained time: the Doppelgänger Suite is a results-oriented system for complete RFID audits.
FIELD-READY WORKFLOW
Unlike traditional approaches for RFID audits, the Stealth Decoy Reader system provides a full end-to-end workflow for RFID audits. What previously required highly technical knowledge, complicated wiring, fussy tools and unstable software is replaced by an all-in-one device and intuitive, cross-platform software.
Red-teamers and auditors can literally turn on the device, attach it to an appropriate wall / door / cabinet / public choke-point and instantly collect credentials. Captured cards can be detected, analysed and exported to other team-members, or effortlessly simulated or physically cloned wirelessly via a Proxmark - the included Doppelgänger Assistant handles everything.
AVAILABLE MODELS & TECHNICAL DETAILS
Every major corporate reader is available - simply take the unit that your client uses for undetectable credential harvesting. Devices ships preconfigured with your choice of integrated reader hardware. For convenience, we have a product selection assistant to help you determine which model / device you require.
The stand-alone module is compatible with all the above protocols and authentication methods.
BACKED BY REAL-WORLD TRAINING & CERTIFICATION
Beyond the professional support, highly-detailed documentation and active development - real-world training is available for all PPE products. Covering comprehensive product learning to in-the-field assignments simulating the toughest operating conditions, for individuals and teams.
On-site training is available in the US, Europe and the UK. For more information, please contact support@lab401.com
