PHLIPPED
A defensive framework for physical electronic attacks: badge cloning, keystroke injection, drop devices and rogue radios. It catalogs the threats, scores how exposed you are, and maps each one to a concrete detection and fix.
New here? See the framework applied end to end to one real attack,
MIFARE badge cloning, from threat to detection to remediation:
Framework in action →
Threat catalog
10 threats · filter by category:
| ID | Name | Category | Access | Skill | Severity |
|---|---|---|---|---|---|
| PHL-T-001 | HID Prox 125 kHz cloning | rfid-nfc | proximity | 1/5 | 7.5 |
| PHL-T-002 | HID injection via BadUSB | hid-injection | touch | 2/5 | 8.0 |
| PHL-T-003 | MIFARE Classic key recovery and cloning | rfid-nfc | proximity | 2/5 | 8.0 |
| PHL-T-004 | Sub-GHz fixed-code replay (garage doors, gates, simple remotes) | sub-ghz | rf-range | 1/5 | 6.5 |
| PHL-T-005 | Drop device on corporate LAN (Responder / mitm6 / ntlmrelayx) | drop-device | touch | 3/5 | 9.2 |
| PHL-T-006 | O.MG Cable (malicious USB cable with HID + WiFi C2) | hid-injection | touch | 3/5 | 8.5 |
| PHL-T-007 | Evil twin rogue AP with captive portal credential harvest | rogue-ap | rf-range | 2/5 | 7.5 |
| PHL-T-008 | USB mass-storage exfiltration from kiosks and unattended endpoints | usb-exfil | touch | 1/5 | 7.0 |
| PHL-T-009 | WPA handshake capture and offline cracking (pwnagotchi, opportunistic) | rogue-ap | rf-range | 2/5 | 6.0 |
| PHL-T-010 | Vehicle key fob relay attack (signal amplification) | sub-ghz | rf-range | 3/5 | 7.0 |