Techzone/RFID & NFC Tools

RFID & NFC Tools

4 min readArticle

RFID (Radio Frequency Identification) and NFC (Near Field Communication) are short-range wireless technologies used in access cards, key fobs, contactless payment, passports, and asset tracking. Security relevance: many physical access control systems use low-frequency RFID that's trivially clonable. Even modern HID cards have vulnerabilities.

RFID Frequencies and Protocols

Frequency Range Common Use Security
125 kHz (LF) ~10cm Old access cards (HID Prox, EM4100) Very weak, trivially cloned
13.56 MHz (HF) ~10cm Modern cards (MIFARE, HID iCLASS, NFC) Better, but many have vulns
860-960 MHz (UHF) ~3m Asset tracking, supply chain Read-range attacks

Tools

Proxmark3

The gold standard for RFID security research. Can read, analyze, emulate, and clone cards.

bash 
# Install client
git clone https://github.com/RfidResearchGroup/proxmark3.git
cd proxmark3
make clean && make all

# Connect to device
pm3

# Basic commands
[pm3] help
[pm3] hw version     # Device info
[pm3] hf scan        # Auto-detect 13.56 MHz cards
[pm3] lf scan        # Auto-detect 125 kHz cards

# Read a 125 kHz HID Prox card
[pm3] lf hid read

# Clone HID card to T5577 (writable card)
[pm3] lf hid clone --fc 101 --cn 1234

# Read MIFARE Classic (13.56 MHz)
[pm3] hf mf autopwn     # Auto-attack MIFARE Classic
[pm3] hf mf read --blk 0  # Read block

# Emulate a card
[pm3] lf hid sim --fc 101 --cn 1234

ACR122U

Cheap USB NFC reader for 13.56 MHz. Good for reading/writing MIFARE cards and NFC tags.

bash 
# Install
sudo apt install libnfc-bin libnfc-dev

# Test detection
nfc-list

# Read NFC tag
nfc-poll

# MIFARE Classic tools
mfoc -O tag_dump.mfd        # Crack MIFARE Classic
mfcuk -C -R 0:A -s 250 -S 250 -f keys.mfd  # Darkside attack

# Read the dump
nfc-mfclassic r A tag_dump.mfd known_key.mfd

Flipper Zero

Multi-tool with RFID, NFC, sub-GHz, IR, Bluetooth, and GPIO. Great for field work.

shell 
RFID (125 kHz):
  Read → Read card
  Saved → replay/emulate
  Add Manually → enter card data

NFC (13.56 MHz):
  Read → auto-detect and read
  Saved → emulate (UID + dump)
  MIFARE Classic: reads, writes to compatible blank cards

Sub-GHz:
  Read RAW → capture RF signal
  Send → replay signal
  (Good for garage doors, keyfobs)

Card Attack Types

Clone Low-Frequency Cards (Easiest)

EM4100 and HID Prox cards have no encryption — just an ID number. Read and copy:

bash 
# With Proxmark3
[pm3] lf em 410x read         # Read EM4100
[pm3] lf em 410x clone --id 1122334455  # Clone to T5577

# With Flipper Zero
# RFID → Read → moves to Saved → Emulate

MIFARE Classic Attacks

MIFARE Classic (very common in access control and transit systems) uses weak CRYPTO1 cipher — breakable with captured nonces.

bash 
# Autopwn (tries all known attacks)
[pm3] hf mf autopwn

# If factory keys work (many cards never change default keys)
# Common defaults: FFFFFFFFFFFF, 000000000000, A0A1A2A3A4A5

# Dump the card after cracking
[pm3] hf mf dump 1 --fn card_dump   # 1K classic

Relay Attack

Even if you can't clone the card (cryptographic protection), you can relay it:

  • Attacker 1 is near the target's card (wallet in a cafe)
  • Attacker 2 is near the card reader
  • They relay the RF communication over long range

Tools for relay attacks:

  • Proxmark3 with two units
  • NFCGate

NFC on Phones (Quick Testing)

bash 
# Android: NFC Tools app — read NFC tags
# iPhone (NFC Reader): basic NDEF reads

# For more: use an app like
# "NFC TagInfo" by NXP — detailed card analysis
# "MIFARE Classic Tool" — MIFARE read/write

Writing to Blank Cards

Common writable cards for testing:

  • T5577 — writable 125 kHz (clone HID, EM4100, etc.)
  • MIFARE Classic 1K blank — for NFC cloning (must crack original first)
  • Magic MIFARE — has unlockable block 0 (clone any UID)
bash 
# Write T5577 with HID data
[pm3] lf hid clone --fc 201 --cn 5678

# Write Magic MIFARE with cloned data
[pm3] hf mf csetuid --uid DEADBEEF
[pm3] hf mf restore 1 --fn original_dump

Protecting Your Cards

  • RFID blocking wallet — prevents skimming (aluminum foil works too)
  • Enable card access audit logs
  • Switch to SEOS or DESFire EV2/EV3 (much stronger than MIFARE Classic)
  • Use multi-factor — card + PIN

See Also

  • hackrf-sdr-attack-tool — For longer range RF attacks
  • software-defined-radio-sdr — SDR for passive RF monitoring
  • bluetooth-hacking — Related wireless attack
techzonesite.comUnlock Your IT Potential