There is a thing called a "get out of jail letter," which is written authority to be performing physical or cyber pentesting activities. This letter is to be presented by the pentester to anyone that attempts to apprehend the pentester while on the job. There's no mention that such a device was present during this physical security test.
I saw this on LinkedIn. I was skeptical about it and didn't believe it at first. How could physical pentesting not be included in the contract? I didn't know that it had to be included in the penetration test . When the Pentagon, not to far from where the President of the United States lives does those yearly hack me events, they don't say try and see if you can get physical access as well. I am sure someone would get shot trying to get past the Pentagon Force Protection Agency and others guarding the Pentagon. Not every organization that promotes doing penetration tests, is capable of doing a physical penetration test. Not every organization that wants a penetration tests needs a physical penetration test (in my option). Not every organization that wants a penetration test has the budget for a physical penetration test. The term penetration test is vague. You can't take it and run with it anyway you see fit. I was at a SANS conference this year and it was a presentation on physical penetration tests. The guy told us how he used costumes, an Uber sticker to get inside the building premises, and had these long range cameras. Long story short (search YouTube), they aren't teaching you how to do a physical pen test in Hack The Box, OSCP, GPEN, etc. But, guess what? These companies are looking for certifications, education, and experience. They aren't saying see if you can gain physical access before you are hired.To add to that, someone attempted to do a physical test on a court house that probably had 10-40 (ARMED) deputies, police, sherifs, detectives in it at any given time? Yeah....I don't feel sorry for them at all. The court house in ANY American city is full of law enforcement personnel. Either guarding the place or showing up for court (traffic tickets and criminal proceedings). So I think THEY made a (stupid life changing - rookie) mistakeJust how bad can engagement managers be.... <- LOL I won't respond to that. I have to do something. I might come back and respond LOL