🛡️ Sherlocked Security – Physical Penetration Testing (Red Team Ops)
When Digital Walls Fail, Physical Gates Matter
📄 1. Statement of Work (SOW)
Service Name: Physical Security Assessment & Penetration Testing
Client Type: Corporate Campuses, Data Centers, Government Buildings, Financial Institutions
Service Model: On-Site Red Team Ops + Surveillance Bypass + Insider Simulation
Compliance Coverage: NIST SP 800-115, ISO/IEC 27001:2022 (Annex A.7), TIA-942-B, PCI-DSS v4.0 (Requirement 9)
Testing Types:
- Perimeter & Gate Bypass
- Badge Cloning & Tailgating
- Lock Picking & Door Access
- Dumpster Diving & Document Recovery
- Surveillance System Evasion
- Rogue Device Implantation
- Social Engineering (Pretexting / Impersonation)
🧠 2. Our Approach (with Visual)
🕵️ Bypass. Blend In. Breach. Document.
AI Visual Flow:
[Recon Facility] → [Perimeter Breach] → [Surveillance Evasion] → [Access Bypass] → [Payload Drop] → [Evidence Collection] → [Secure Recommendations]
Color Code:
- Perimeter: #263238
- Internal Access: #37474f
- Social Engineering: #880e4f
🧪 3. Methodology (with Visual)
[Pre-engagement Recon] → [Initial Access Attempts] → [On-site Attack Simulation] → [Evidence Logging] → [Reporting & Recommendations]
Visual Flow Phases:
- 🚧 Physical Layer (Access Control, Locks, Gates)
- 🧍 Human Layer (Tailgating, Impersonation)
- 🛠️ Technical Layer (Badge Cloning, Rogue Devices)
📦 4. Deliverables to the Client
- 🗂️ Physical Vulnerability Report
- 🎥 Covert Operation Media (photo/video evidence)
- 🔐 Access Control Bypass Details
- 🪪 Badge / Lock Clone Assessment
- 🛠️ Rogue Device Implantation Logs
- 🤝 Social Engineering Attempt Results
- 🧠 Layered Defense Recommendations
- 🏆 Physical Security Certificate (optional)
🤝 5. What We Need from You (Client Requirements)
- ✅ Site access approval (in scope)
- ✅ Floor plans or blueprints (if permissible)
- ✅ Name of on-site security vendor
- ✅ List of restricted areas (for exclusions)
- ✅ Emergency contact for conflict resolution
- ✅ NDA & legal authorization
🧰 6. Tools & Technology Stack
- 🪪 Access Tools: Proxmark3, Flipper Zero, RFIDler
- 🔓 Lock Tools: SouthOrd Picks, Bump Keys, Electric Picks
- 📷 Surveillance: Hidden body cams, thermal scopes
- 📡 Rogue Implants: LAN Turtle, Bash Bunny, WiFi Pineapple
- 🧢 SE Props: Branded uniforms, fake IDs, clipboards
- 💾 Evidence Logging: Timestamped photos, logbooks
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Planning & Scoping → 2. Recon & Target Mapping → 3. Physical Access Simulation → 4. Covert Entry/SE Execution → 5. Risk Mapping & Analysis → 6. Remediation Advisory → 7. Final Report & Retest (optional)
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 🕵️ Elite Red Teamers | Operatives trained in stealth & covert tactics |
| 🔓 Real-World Lock Bypass | Lockpick, bump, decode – field-tested techniques |
| 🧪 SE Expertise | Impersonation, pretexting, phishing combo playbooks |
| 🎥 Full Evidence Pack | Photos, videos, logs from every entry point |
| 🔁 Retest & Validate | Follow-up test ensures closure of physical gaps |
📚 9. Real-World Case Studies
🏢 Corporate Lobby Breach
Test: Entry via tailgating & fake badge
Attack: Operative entered restricted floors
Result: Accessed unsecured terminals
Fixes: Implemented mantrap doors, badge scan enforcement
🗑️ Dumpster Data Leak
Test: After-hours dumpster inspection
Attack: Recovered HR files & credentials
Impact: Exposed PII & account reset tokens
Fixes: Introduced shredders & locked disposal bins
🛡️ 10. SOP – Standard Operating Procedure
- Target facility scoping
- Recon (external + human)
- Badge and access analysis
- Perimeter entry attempts
- Internal access & SE trials
- Rogue device placement (optional)
- Documentation of findings
- Fix validation (optional)
📋 11. Sample Physical Security Checklist (Preview)
- Assess fencing, gates, and perimeter access points
- Attempt unauthorized entry via tailgating or bypass
- Clone or emulate access badges/cards
- Pick or bypass physical locks
- Identify blind spots in CCTV coverage
- Inspect document disposal procedures
- Attempt social engineering with pretexts
- Locate and test emergency exits & alarm systems
- Implant rogue hardware in accessible areas
- Validate visitor entry logging and escort policies