← All cheat sheets

🌶 LOCKPICKING

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Physical security assessment techniques for authorized
penetration testing. Legal and ethical use only.

  - Only pick locks you own or have explicit written authorization to test
  - Lock pick possession laws vary by jurisdiction
  - In the US: legal in most states (illegal in some with intent)
  - UK: legal to own, illegal to carry without good reason
  - Check local laws before carrying or using lock picks
  - Always carry authorization letter during engagements
  - Document all activities for reporting

Components:
  Plug:           The rotating cylinder (where key inserts)
  Shell:          The outer housing
  Shear line:     Gap between plug and shell (must be clear to rotate)
  Key pins:       Bottom pins touched by key (varying heights)
  Driver pins:    Top pins pushed up by springs
  Springs:        Push driver pins down into plug

How a key works:
  1. Key inserted, lifts key pins to correct heights
  2. All driver/key pin junctions align at shear line
  3. Plug rotates freely
  4. Lock opens

Pin states during picking:
  Set:            Pin at shear line (correct position)
  Overset:        Pin pushed too high (past shear line)
  Underset:       Pin not pushed high enough

Security pins (anti-pick):
  Spool pins:     Hourglass shape, creates false set
  Serrated pins:  Multiple grooves, multiple false sets
  Mushroom pins:  T-shaped, similar to spool
  Medeco pins:    Require rotation + lift (very difficult)

Types:
  Bottom of Keyway (BOK):
    - Most common for beginners
    - Inserted at bottom of keyway
    - Less interference with pick movement
    - Less feedback than TOK

  Top of Keyway (TOK):
    - Inserted at top of keyway
    - More keyway space for picking
    - Better feedback
    - Preferred by experienced pickers

Tension principles:
  - Light tension for standard pins
  - Very light tension for security pins
  - Heavy tension for raking
  - Too much tension: pins bind too hard, feedback lost
  - Too little tension: pins don't stay set
  - The "sweet spot" varies per lock

The most precise and reliable technique.

Process:
  1. Apply light tension to plug (turning tool)
  2. Identify binding pin (pin that resists movement most)
  3. Push binding pin up until you feel a slight "click" or give
  4. The plug will rotate very slightly when pin sets
  5. Move to next binding pin
  6. Repeat until all pins are set
  7. Plug rotates, lock opens

Finding the binding pin:
  - Test each pin with light upward pressure
  - Binding pin feels stiff/springy (resists movement)
  - Non-binding pins feel loose/floppy
  - Binding order changes as pins are set

Picking security pins (spools):
  1. Apply light tension
  2. Pick as normal until you reach a "false set"
  3. False set: plug rotates further than expected but stops
  4. Indicates a spool pin is counter-rotating
  5. Release tension slightly (NOT completely)
  6. Spool pin will push itself up past the ledge
  7. Re-apply tension
  8. Continue with remaining pins

Common SPP picks:
  Short hook:     General purpose, most commonly used
  Medium hook:    For deeper pin positions
  Deep hook:      For reaching back pins in longer locks
  Offset diamond: Alternative to hooks, good for tight keyways
  Gem:            Hybrid pick for various pin heights

Tips:
  - Start with light tension, increase as needed
  - Feel for feedback - picking is mostly by touch
  - If stuck: release tension, let pins drop, start over
  - Practice on progressive training locks
  - Learn to distinguish pin states by feel

Faster but less precise than SPP. Good for low-security locks.

Techniques:
  Scrubbing:
    1. Apply medium tension
    2. Insert rake to back of keyway
    3. Quickly scrub in and out while varying height
    4. Pins set randomly from the scrubbing action
    5. Adjust tension as pins set

  Rocking:
    1. Apply medium tension
    2. Insert rake
    3. Rock the rake back and forth (like a seesaw)
    4. Vary speed and pressure

  Zipping:
    1. Apply medium tension
    2. Insert rake to back
    3. Pull out quickly in one smooth motion
    4. Pins "zip" into place from back to front
    5. Try multiple times with varying tension

Common raking tools:
  Bogota rake:    W-shaped, very effective for raking
  Snake rake:     S-curves, good for scrubbing motion
  City rake:      Profile mimics key, good for random pins
  L-rake:         Simple, effective for basic locks

Effectiveness:
  - Standard pins: raking often works in seconds
  - Spool pins: raking can cause false sets (switch to SPP)
  - Serrated pins: may work but takes more attempts
  - High-security: raking usually ineffective

Concept: A key cut to maximum depth on all positions (999 key).
Impact sets all pins simultaneously.

Process:
  1. Insert bump key one pin short of full insertion
  2. Apply light rotational pressure (tension)
  3. Strike the key sharply (bump it) while turning
  4. Impact causes driver pins to jump above shear line
  5. Key pins remain below shear line
  6. Plug rotates during the brief moment pins are separated

Tools:
  - Bump key set (various keyway profiles)
  - Bump hammer (or use screwdriver handle)
  - Rubber o-ring on key (controls insertion depth)

Pros:
  - Fast (seconds per attempt)
  - Works on many pin tumbler locks
  - Minimal skill required

Cons:
  - Noisy (audible impact)
  - Ineffective against bump-resistant locks
  - May damage lock with repeated attempts
  - Some high-security pins resist bumping

Bypass = opening a lock without picking the pins.

Latch slipping (loiding):
  - Credit card or shim tool slides between door and frame
  - Pushes back spring-loaded latch
  - Only works on spring latches (not deadbolts)
  - Tool: plastic shim, credit card, traveler hook
  - Prevention: deadbolt, latch guard plate, anti-shim latch

Under-door tools:
  - Flexible tool slides under door
  - Hooks or presses interior lever handle
  - Effective on lever handles without interior locks
  - Tool: commercial under-door tool, wire coat hanger
  - Prevention: bottom door sweep, interior thumb turn

Traveler hook:
  - Wire tool reaches around or through door
  - Operates interior handle or thumb turn
  - Works through mail slots, gaps, or drilled holes

Comb pick:
  - Metal comb inserted above pins
  - Pushes all driver pins above shear line at once
  - Only works on locks without anti-comb features
  - Fast and simple when it works

Wafer lock bypass:
  - Many filing cabinets use simple wafer locks
  - Jigglers: set of try-keys for common wafer patterns
  - Often openable with simple tools (bobby pin, paper clip)

Concept: Thin metal shim inserted into shackle gap to release
the locking mechanism without picking.

Process:
  1. Cut shim from aluminum can (or use commercial shim)
  2. Wrap shim around a small cylinder to shape it
  3. Insert shim between shackle and lock body
  4. Push shim down while rotating it inward
  5. Shim pushes the locking pawl, releasing shackle

Works on:
  - Spring-loaded shackle padlocks
  - Many cheap to mid-range padlocks

Does NOT work on:
  - Ball-bearing locking padlocks (ABUS, Abloy)
  - Double-shackle locked padlocks
  - Shrouded shackle padlocks

Keypad locks:
  - Default codes (0000, 1234, manufacturer default)
  - Worn buttons reveal frequently pressed keys
  - Shoulder surfing for code observation
  - Brute force (if no lockout, 10,000 combos for 4-digit)
  - Electromagnetic analysis (some locks leak signals)

Smart locks:
  - Bluetooth sniffing (some transmit in cleartext)
  - Replay attacks (capture and replay unlock signal)
  - API vulnerabilities in companion app
  - Firmware vulnerabilities (OTA update interception)
  - Default credentials on management interface
  - WiFi-based attacks if connected to network
  - Battery removal may cause unlock (fail-open)

Hotel locks:
  - Legacy systems vulnerable to magnetic stripe cloning
  - Some RFID hotel locks have known vulnerabilities
  - Firmware bypass tools exist for certain brands
  - Physical bypass (under-door tools, latch slipping)

Electric strikes and mag locks:
  - Power failure: electric strikes often fail-open (for fire safety)
  - Request-to-exit sensors: triggered from outside (PIR sensors)
  - Cut power to mag lock (if not on UPS)
  - REX sensor exploitation (blow air, use lighter through gap)

See PHYSICAL-PENTEST.txt for Proxmark3 details.

Common access card types:
  125kHz (Low Frequency):
    HID Prox:       Most common, easily cloned
    EM4100:         Simple, no encryption, easily cloned
    AWID:           Similar to HID, clonable

  13.56MHz (High Frequency):
    MIFARE Classic:  Weak crypto (Crypto-1), crackable
    MIFARE DESFire: Strong encryption, harder to clone
    HID iCLASS:     Some versions crackable
    iCLASS SE:      More secure, hardware encryption

  Tools for cloning:
    Proxmark3:       Most capable RFID tool
    Flipper Zero:    Portable, multi-protocol
    ChameleonMini:   Card emulation device
    ACR122U:         USB NFC reader/writer (HF only)
    Blue Cloner:     Simple LF card copier

  Quick clone workflow:
    1. Read target card (use Proxmark3: lf hid reader)
    2. Identify card type and extract data
    3. Write to blank writable card (T5577 for LF)
    4. Test clone at door reader

  Long-range reading:
    - Standard: requires 1-5cm proximity
    - Custom antennas: 30cm-1m for 125kHz
    - Concealment: hide reader in bag, clipboard, or briefcase
    - Social engineering: "Can I see your badge for a moment?"

For each lock evaluated, document:
  [ ] Lock type (pin tumbler, disc detainer, smart, etc.)
  [ ] Brand and model
  [ ] Security rating (if visible)
  [ ] Anti-pick features observed
  [ ] Time to open (or failed to open)
  [ ] Technique used
  [ ] Bypass methods attempted
  [ ] Overall security rating
  [ ] Recommendation for upgrade (if needed)

Low security:
  - Basic pin tumbler, standard pins only
  - 4-5 pins, no security features
  - Master Lock, cheap padlocks
  - Opened in seconds by raking

Medium security:
  - Spool or serrated driver pins
  - 5-6 pins
  - Schlage, Yale, some Kwikset
  - Opened in 1-5 minutes by SPP

High security:
  - Multiple security pin types
  - Restricted keyways
  - Anti-drill, anti-bump features
  - Medeco, Mul-T-Lock, ASSA, Abloy
  - May require significant skill and time
  - Some effectively pick-proof (disc detainer)

Progressive training:
  1. Start with clear/cutaway practice locks
  2. Move to basic 4-pin locks
  3. Progress to 5-pin standard locks
  4. Introduce security pins (spool, serrated)
  5. Try real-world locks (practice locks you own)

Recommended practice locks:
  - Progressive lock set (Sparrows, Dangerfield)
  - Clear practice locks (visual feedback)
  - Reload kit (repin locks with different pins)
  - Challenge locks from the lock sport community

- Practical Lock Picking (Deviant Ollam)
- Lock Picking: Detail Overkill (PPT by Schuyler Towne)
- TOOOL: https://toool.us/
- LockPickingLawyer YouTube channel
- Sparrows Lock Picks: https://www.sparrowslockpicks.com/
- Deviant Ollam presentations (DEF CON, DerbyCon)