Long-range iCLASS RFID Capture System
Long-Range RFID capture is the holy-grail for security auditors and penetration testers. To date, the only solutions have been either complicated and unpractical in the field, or o ut-of-production and abandoned. The Long-Range RFID Capture by PPE changes everything. It is a modern, complete solution that covers all elements of the RFID Audit life-cycle. By using an industry-standard reader, long-distance read-range and card compatibility are guaranteed. An embedded hardware module, the Doppelgänger Core, provides advanced pentesting functionality. The cross-platform UI tool, Doppelgänger Assistant provides all the functionality you need in one place, optimised for in-the-field use. The Long Range Reader + Doppelgänger Core covers the full RFID pentest life-cycle: Capture: Long range (up to 45cm) capture of iCLASS, iClass SE/SEOS RFID Credentials Control: Manage multiple devices, analyse, save, tag and exfiltrate captured credentials via the cross-platform WebUI. Clone: Emulate, clone and write captured credentials directly from the UI via Proxmark 3. One click & wireless: No command lines, no code. Access: Gain and escalate access via cloned RFID Credentials. Built for professional red teamers and physical penetration testers in commercial or industrial environments with 13.56MHz iCLASS / SE / SEOS badge systems, with real-world performance that allows for advanced audit possibilities: vehicles, closets, or target perimeters. The Long Range Reader + Doppelgänger Core are delivered ready-to-use. Turn on the reader, start collecting credentials. Select a badge to clone, and write or emulate it with one click. This is the modern, professional, feature complete version of the legendary Tastic RFID Thief for iCLASS & iCLASS SE/SEOS Systems. LONG RANGE, HIGH-PERFORMANCE Built on the HID iCLASS R90SE high-performance reader, get 45cm of real-world performance. iCLASS, iCLASS SE & SEOS All-in-one capture, export, emulation and cloning solution for iCLASS targets. OPTIMISED FOR FIELD WORK No unreliable antennas, no tethered computers. From capture to clone with no more missed opportunities. PROFESSIONAL TOOL & SUPPORT Built by pentesters based on real-world requirements: modern hardware, software and frequent updates. ENGINEERED FOR DEMANDING ENVIRONMENTS The R90SE extended read-range allows for novel audit approaches and enhanced operator safety. From the classic targeted "reader-in-bag" brush-by collections, passive collections via concealment or even in-vehicle drive-by collections, the R90SE has dependable performance. The Doppelgänger module provides exhaustive configuration options to fit all mission specs, and complete card analysis and cloning workflow, from initial detection through successful write operations. .scenario-caption { display: none; text-align: center; font-style: italic; margin-top: 0.5em; } @media only screen and (max-width: 749px) { .scenario-caption { display: block; } } .scenario-frame { padding: 10px; border: 1px solid #add8e6; border-radius: 16px; display: inline-block; line-height: 0; } .scenario-frame img { border-radius: 6px; margin-top: 0px !important; margin-bottom: 0px !important;} Targeted "bump" collections Strategic dead-drop capture Public-space vehicle-based captures POWERED BY DOPPELGANGER Inside every long-range reader is the Doppelgänger Core module - the high-performance, multi-protocol, wireless equipped RFID capture, analysis and cloning device. It works hand-in hand with the Doppelgänger Assistant, a cross-platform professional GUI application designed to handle every possible operation requirement. Together, they allow for automated card capture and wireless credential exfiltration. Teams can collaborate and share credentials; credentials can be analysed, exported or cloned. The Doppelgänger Assistant also works as a easy-to-use UI for the Proxmark 3, making credential writing, cloning and verification a one-click operation. Don't miss opportunities because of knowledge gaps or constrained time: the Doppelgänger tools form a results-oriented system for complete RFID audits. 1 2 3 4 1. BEST-IN-CLASS PERFORMANCE Industrial reader hardware for guaranteed protocol compatibility and range performance. 2. ALL-IN-ONE iCLASS SOLUTION Supports iCLASS Legacy, iCLASS SE and iCLASS SEOS badges, and the SE/SEOS degrade attack integrated into the Doppelgänger Assistant. 3. BUILT FOR DISCRETION Credential capture is silent, and can trigger notifications, SMS or emails. Haptic triggers or relays can be added to the Doppelgänger’s GPIO. 4. FEATURE COMPLETE SOFTWARE The modern, maintained, open-source software covers all operations: capture, analysis, calculation, export and more, and integrates directly with your Proxmark 3 for all cloning, writing and verification operations. FIELD-READY WORKFLOW Unlike traditional approaches for RFID audits, the R90SE & its embedded Doppelgänger module provide a full end-to-end workflow for RFID audits. What previously required highly technical knowledge, complicated wiring, fussy tools and unstable software is replaced by an all-in-one device and intuitive, cross-platform software. Red-teamers and auditors can literally plug in the device, slip it into their bag and instantly collect credentials. Captured cards can be detected, analysed and exported to other team-members, or effortlessly simulated or physically cloned wirelessly via a Proxmark - the included Doppelgänger Assistant handles everything. .custom-bottom-margin { margin-bottom: -3em; } @media only screen and (max-width: 749px) { .custom-bottom-margin { margin-bottom: -1em; } } The Long Range Reader and Doppelgänger ecosystem covers every step of an RFID Audit: acquisition, exfiltration & analysis, duplication and access / escalation. 1 2 3 4 1. LONG-RANGE ACQUISITION Capture iCLASS cards up to 45-cm away, silently. Can be embedded or carried. Plug and Play: No messy antennas, wiring or complex setup. 2. CROSS-PLATFORM UI Get instant notifications of captures, across multiple readers. Share readers and card data in real-time with colleagues. 3. PROXMARK3 INTEGRATION Instantly emulate or clone captured credentials via the Proxmark 3 directly via the UI. No commands, no code, no wires. 4. FIELD-TESTED RESULTS The Doppelgänger system is purpose-built by professional red-teamers to be results oriented. RFID Audits just got better and easier. COMPATABILITY AND TECHNICAL DETAILS The PPE iCLASS Longrange RFID Capture System is optimised for iCLASS systems. Depending on your target, there are Long-Range solutions for Low-Frequency HID and Indala systems and Paxton systems. Supported Cards / Protocols Chipset Notes HID iCLASS Legacy HID iCLASS SE Standard Keys only.Legacy mode must be enabled. HID iCLASS SEOS Supports downgrade attacks.Legacy mode must be enabled. MIFARE UID Capture only. Technical Specifications Feature Notes Range 45cmReal world conditions UI Cross Platform App / WebUI Integration Integrates with Proxmark3 RDV4.One-click cloning and emulation.Wireless operation via Blueshark. BACKED BY REAL-WORLD TRAINING & CERTIFICATION Beyond the professional support, highly-detailed documentation and active development - real-world training is available for all PPE products. Covering comprehensive product learning to in-the-field assignments simulating the toughest operating conditions, for individuals and teams. EUROPE We recommend Covert Access Team for Europe-based training. Highly reputed and intimately familiar specifically with this hardware, they have multiple training modules, both online and offline. NORTH AMERICA For North American clients, we recommend the product's creators Mayweather Group. Field-trained and objective focused, Mayweather's products are deeply ingrained in their workshops. What's included 1x HID iCLASS R90SE Reader 1x PPE Doppelgänger Core Module (Pre-installed) 1x Protective Case Recommended Accessories 92Wh Power Supply device Proxmark3 RDV4 (with optional Bluetooth Extension) Resources Long-range Reader Hardware Documentation Firmware Documentation and Configuration Doppelgänger Assistant Documentation and Configuration Firmware & Flashing Documentation
