RFID Attack Matrix v0.4 // redteam.vip

01Physical Examination — Look Before You Scan

Before any tool touches it, examine the card. Physical markings reveal the frequency.

Key fob / round tag→Almost certainly 125kHz LF (HID Prox, EM4100, Indala)

Credit-card sized, no stripe→Access/transit/ID — RFID or NFC (LF or HF)

Sticker / label with coil→NFC/HF (NTAG, Ultralight) — coil visible under light

Metal cylinder (key shape)→iButton / Dallas 1-Wire — contact-based, not RF

Mag stripe on back→May also have RFID — scan both. MSR for mag tracks.

💡 Hold the card to a flashlight — the antenna coil is visible. Large sparse coil ≈ 125kHz LF. Small tight spiral ≈ 13.56MHz HF. No coil = contact-only or dead card.

02Frequency Detection — What Is It Talking On?

Proxmark3 (most thorough):

auto // Tries LF + HF simultaneously — best first command lf search // LF (125kHz) specific scan hf search // HF (13.56MHz) specific scan hw detectreader -l // Is a 125kHz reader field present? hw detectreader -h // Is a 13.56MHz reader field present?

Flipper Zero:

// RFID app → Read → 125kHz tags // NFC app → Read → 13.56MHz tags // iButton app → Read → Dallas 1-Wire contact keys // Sub-GHz → Freq Analyzer → sub-GHz remote fobs

Chameleon Ultra (ChameleonUltraGUI — chameleon.run):

// Home screen → tap Switch Mode → set to Reader mode // Hold Chameleon near card — LED blinks on detection // App shows card type, UID, frequency automatically // Home screen → Switch Mode → back to Emulator for replaying

LF response→125kHz — Step 3a

HF response→13.56MHz — Step 3b

Contact response→Dallas 1-Wire — Step 3c

No response→Sub-GHz fob / mag stripe / UHF — Step 3d

03aLF Card — Protocol Identification

lf search // Auto-identifies: EM4100, HID Prox, Indala, Hitag, T55xx lf hid reader // HID Prox check lf em 410x reader // EM4100/EM4102 check lf indala reader // Indala check lf hitag read --ht2 // Hitag2 check lf t55xx detect // If T55xx → this card is already a CLONE

HID Prox / EM4100→Direct clone → lf hid clone or lf em 410x clone

Indala→lf indala clone -r <raw>

Hitag2→Try default password MIKR (4D494B52) first

T55xx / T5577→⚠ Already a clone — lf search to find what it emulates

💡 If lf search returns T55xx — you're looking at an existing clone. Someone has already been here.

03bHF Card — Protocol Identification via ATQA / SAK

hf search // Auto-identifies protocol — best first hf 14a info // Full ISO 14443-A: ATQA, SAK, ATS, UID hf mf info // MIFARE: type, PRNG weakness, magic card detect hf mfdes info // DESFire: version, key settings, app list hf iclass reader // HID iCLASS (may not appear in hf search) hf 14b reader // ISO 14443-B (national IDs, some transit) hf 15 info // ISO 15693 vicinity cards

ATQA / SAK fingerprint table:

ATQA:0004 SAK:08→MIFARE Classic 1K → hf mf autopwn

ATQA:0002 SAK:18→MIFARE Classic 4K → hf mf autopwn

ATQA:0044 SAK:00→Ultralight / NTAG → hf mfu info → dump

ATQA:0344 SAK:20→DESFire → hf mfdes info → check default keys

ATQA:0304 SAK:28→MIFARE Plus SL3 → relay attack only

ATQA:0008 SAK:00→HID iCLASS → hf iclass autopwn

ATQA:0020 SAK:28→PIV / CAC → hf piv info

💡 hf search includes a "Product suggestion" line — trust it. iCLASS won't match standard ISO ATQA/SAK — run hf iclass reader separately.

03cContact Key / Magstripe

// iButton (Dallas 1-Wire): // Flipper: iButton app → Read → touch contact pad // Reads DS1990A 64-bit ID, no auth — clone immediately // Magstripe (hotel keys, legacy access): // MSR605X / MSRX6-BLE → press Read → swipe card // Displays Track 1/2/3 in plaintext // Write to blank → swipe to clone

💡 DS1990A has zero authentication — any read ID can be replayed. For magstripe: match coercivity (Hi-co vs Lo-co) to the original card type when writing.

03dNo RF Response — Other Possibilities

Sub-GHz fob→Flipper: Sub-GHz → Frequency Analyzer while pressing button

134kHz (animal implant)→lf fdxb reader — FDX-B industrial/veterinary tags

UHF (860-960 MHz)→EPC Gen2 warehouse/inventory — not access control

RFID-blocking sleeve→Remove sleeve and retry all scans

NFC implant→xEM (LF) or xNT (HF) — same commands as surface cards

04Reconnaissance — Extract Maximum Intelligence

// LF: lf search wiegand decode <hex> // Decode FC + card number // HF: hf 14a info // ATQA, SAK, ATS, UID, product type hf mf info // MIFARE: type, PRNG, magic card detection hf mfdes info // DESFire: version, capabilities, key config hf iclass info // iCLASS: CSN, config, app area hf 15 info // ISO 15693: manufacturer, UID, memory hf piv info // PIV/CAC: certs, CHUID, capabilities hf emrtd info // ePassport: chip info, protocol support trace list -t 14a -f // Decode any captured HF trace

Record: UID/CSN, format, facility code, card number, ATQA, SAK, ATS, sector count, key lock status, PRNG type.

💡 hf mf info tells you if the MIFARE Classic has a weak PRNG (Darkside-vulnerable), nonce fixation (needs Hardnested), or is already a magic card. Always run before choosing attack path.

05Attack Path Selection

LF Card (125kHz)

All LF access cards are broken. Clone to T5577 in <60s. lf search → lf [proto] clone

MIFARE Classic

hf mf autopwn — all keys + dump in ~30s. Nonce-resistant? Chameleon Ultra Hardnested. Then magic card or emulate.

DESFire EV1

Check default all-zero keys first. If changed: relay attack only. EV2/EV3: relay only.

iCLASS Legacy / Elite

hf iclass autopwn — tries both standard and Elite key sets automatically. Fully broken since 2012.

Reader access, no card

MFKey32 Detect Reader. Emulate blank → reader leaks nonces → recover keys offline. Flipper or Chameleon Ultra.

Modern (EV2+, SEOS)

No known crypto attack. Options: relay (NFCGate), Wiegand wire tap, PACS network pivot, physical bypass.

💡 Even if you can't attack the card directly, intelligence from Steps 1-4 informs the rest of the engagement. Document everything.

06Emulate, Test, and Document

// Test emulation before writing to any blank: hf mf sim --1k // Simulate MIFARE Classic from PM3 emulator RAM lf hid sim -r <rawHex> // Simulate HID Prox hf iclass sim -t 3 // Simulate iCLASS from loaded dump // Flipper: Saved → Emulate → hold to reader // Chameleon Ultra: load slot → present to reader → verify LED

Test against a live reader before writing to a blank. Emulation is non-destructive and leaves no physical evidence.

Report artifacts: card type, protocol, ATQA/SAK, UID, FC/CN, vulnerability class, attack method, time to completion, PM3/Flipper output screenshots, countermeasure recommendation.

💡 Note whether the attack required (a) physical card possession, (b) reader-only access, or (c) long-range passive capture. This maps to threat actor capability tiers.

🔍 Unknown Card Discovery Guide