Description

This curriculum mirrors the technical and procedural rigor of a multi-phase red team engagement, spanning from initial reconnaissance with handheld SDR and BLE sniffers to sustained proximity operations involving rogue device deployment, protocol exploitation, and anti-forensic evasion, all within the constraints of enterprise governance and physical security controls.

Module 1: Understanding Proximity Attack Vectors and Threat Models

Decide whether to simulate Bluetooth-based beacon spoofing in controlled environments based on asset density and physical access controls.
Implement rogue Wi-Fi access point detection using passive monitoring tools on enterprise-grade wireless sensors.
Configure MAC address randomization testing procedures to assess endpoint exposure in public or semi-public spaces.
Evaluate the risk of NFC relay attacks by mapping high-value transaction systems accessible via mobile payment interfaces.
Integrate physical access badge cloning assessments into red team operations using proximity reader emulation tools.
Assess the feasibility of deploying software-defined radio (SDR) for capturing and analyzing unencrypted proximity signals in operational facilities.

Module 2: Scanning Tools and Hardware Selection for Close-Range Exploitation

Select handheld scanning devices based on supported protocols (e.g., BLE, RFID, Zigbee) and stealth requirements during site surveys.
Calibrate signal strength thresholds in Kismet or Ubertooth to distinguish between legitimate and spoofed proximity sources.
Deploy Raspberry Pi-based proximity sniffers with GPS tagging to correlate attack feasibility with physical location data.
Compare packet injection capabilities across hardware platforms for testing proximity-based authentication bypass scenarios.
Integrate custom firmware on ESP32 devices to simulate malicious beacon transmissions during physical penetration tests.
Validate toolchain compatibility with enterprise logging systems to ensure scan data can be ingested into SIEM platforms.

Module 3: Wireless Protocol Analysis and Fingerprinting Techniques

Extract device identifiers from BLE advertising packets to build target profiles for follow-up social engineering.
Map service UUIDs in BLE devices to identify exposed management functions that may lack authentication.
Reverse-engineer proprietary pairing sequences in Zigbee devices using packet capture and timing analysis.
Differentiate between encrypted and plaintext NFC payloads using logic analyzer output from real-world transactions.
Document firmware version leakage in wireless beacons that could indicate unpatched vulnerabilities.
Classify wireless device roles (e.g., central vs. peripheral) to determine potential attack surfaces in mesh topologies.

Module 4: Rogue Device Deployment and Physical Placement Strategy

Determine optimal placement of rogue access points near building entrances based on foot traffic and signal bleed analysis.
Assess power source options (battery, PoE, USB) for long-term rogue device operation in monitored facilities.
Modify enclosure materials to minimize visual detection while maintaining RF transmission efficiency.
Time beacon spoofing operations to coincide with shift changes to maximize device pairing attempts.
Use directional antennas to focus rogue signal coverage and reduce forensic detection likelihood.
Implement automated shutdown triggers on rogue devices based on unexpected network disconnections or management frame floods.

Module 5: Data Exfiltration and Session Hijacking via Proximity Channels

Design man-in-the-middle relays for BLE connections to capture authentication tokens during device pairing.
Modify firmware on SDR platforms to perform real-time decryption of weakly secured Zigbee traffic.
Inject malicious payloads into OTA firmware update streams intercepted from proximity-connected IoT devices.
Exploit lack of mutual authentication in NFC payment systems to replay transaction data under controlled conditions.
Route exfiltrated data through chained Bluetooth piconets to obscure origin in layered network environments.
Test session fixation attacks on mobile apps that maintain persistent BLE connections without re-authentication.

Module 6: Evasion and Anti-Forensic Techniques in Proximity Operations

Rotate spoofed MAC addresses and device names in beacon transmissions to avoid signature-based detection.

Limit transmission duty cycles to mimic legitimate device behavior and avoid anomaly-based alerts.

Use frequency hopping patterns that align with normal device operation to blend into background RF noise.

Obfuscate command-and-control traffic by tunneling through legitimate IoT device update channels.

Implement time-bounded activation schedules on rogue hardware to reduce exposure during security sweeps.

Remove identifiable metadata from captured packets before storage or transfer for post-engagement analysis.

Module 7: Enterprise Detection and Monitoring for Proximity Threats

Configure wireless intrusion detection systems (WIDS) to flag duplicate SSIDs with mismatched BSSIDs in proximity zones.
Deploy endpoint agents that monitor for unexpected pairing requests or unauthorized Bluetooth service exposure.
Establish baselines for normal NFC transaction frequency to detect bulk data access attempts.
Integrate RFID reader logs with physical access control systems to identify cloning or replay anomalies.
Define alert thresholds for BLE signal strength fluctuations that may indicate relay attacks.
Correlate proximity event logs with user identity and location data to detect policy violations or spoofing.

Module 8: Governance, Risk, and Compliance in Proximity Testing

Obtain documented authorization for physical device placement in restricted areas to align with legal boundaries.
Define data retention policies for captured proximity signals to comply with privacy regulations (e.g., GDPR, CCPA).
Classify risk levels for cloned access badges based on the criticality of protected zones and systems.
Coordinate testing windows with facility management to avoid disruption of safety or operational systems.
Document chain of custody for all deployed hardware used in proximity assessments for audit purposes.
Report findings using standardized severity metrics that account for physical access requirements and exploit complexity.