How to Hack RFID and NFC with the Flipper Zero: LF, HF, MIFARE, and iButton

Introduction

The RFID and NFC module in the Flipper Zero handles both low-frequency (LF) 125 kHz RFID and high-frequency (HF) 13.56 MHz NFC. These frequencies power everything from office access badges and hotel keys to transit cards and contactless payments. This guide goes deep into both bands: the physics of how they work, the protocols that run on them, how to read, clone, emulate, and analyze cards, and the security implications of each technology. This is the field guide for RFID penetration testing with a Flipper Zero.

LF RFID (125 kHz) vs HF NFC (13.56 MHz)

LF RFID 125 kHz

• Inductive coupling, short range (5-15 cm)
• Simple modulation (ASK, FSK, PSK)
• Usually read-only or write-once
• Common for: access control cards, animal microchips, vehicle immobilizers, industrial tags
• Protocols: EM4100, HID Prox, Indala, AWID, IoProx, Viking

HF NFC 13.56 MHz

• Inductive coupling, range up to 10 cm (usually 1-4 cm)
• More complex protocols with encryption options
• Read/write capable, larger memory (up to 8KB)
• Common for: transit cards, payment cards, passports, modern access control, device pairing
• Protocols: MIFARE Classic, MIFARE Ultralight, MIFARE DESFire, NTAG, FeliCa, ISO 14443-A/B, ISO 15693

Step 1: Reading LF 125 kHz RFID Cards

1. Navigate to 125 kHz RFID on the Flipper.
2. Select Read and hold the card against the back of the Flipper (the RFID antenna is on the back, centered).
3. The Flipper automatically detects the modulation type and protocol.
4. For readable cards, it displays:

• Card type: EM4100, HID Prox, Indala, etc.
• Data: The ID number in hex and decimal
• Modulation: ASK, FSK, or PSK

1. Save the read data with a descriptive name.

Supported LF protocols for reading:

• EM4100: Most common 125 kHz access card. 40-bit ID, read-only. The Flipper reads these instantly.
• HID Prox: Proprietary HID format. 26-bit (H10301), 37-bit, and others. Flipper reads most common formats.
• Indala: 26-bit and 64-bit formats.
• AWID: 26-bit access control format.
• Viking / FDX-B: Animal microchip format (FDX-B is the ISO 11784/11785 standard).

Step 2: Emulating LF RFID Cards

Emulation transmits the card's ID as if the Flipper were the original card.

1. After reading a card, select Emulate from the card details screen.
2. Hold the Flipper against the card reader.
3. The Flipper transmits the card's signal continuously.
4. If the reader accepts it, the door opens (or whatever the card controls).

Emulation limitations:

• The Flipper emulates the ID only, not any encrypted challenge-response
• Works on simple read-only systems (EM4100, basic HID Prox)
• Does not work on systems with rolling codes or encrypted handshakes
• Some readers detect the Flipper's emulation as anomalous and reject it

Step 3: Writing to T5577 / EM4305 Rewriteable Cards

T5577 is a programmable 125 kHz RFID chip that can mimic EM4100, HID Prox, Indala, and other formats. These blank cards cost about $0.50 each.

1. Read the original card with the Flipper.
2. Obtain a blank T5577 card or key fob.
3. Navigate to the saved card, select Write.
4. Hold the Flipper against the blank T5577 card.
5. The Flipper programs the T5577 with the captured card's data.
6. Test the clone card against the original reader.

Writing notes:

• T5577 cards can be rewritten hundreds of times
• Some cards ship locked. If writing fails, try a different brand of blank
• The Flipper auto-detects the target card type and sets the appropriate configuration block

Step 4: Reading HF 13.56 MHz NFC Tags

1. Navigate to NFC on the Flipper.
2. Select Read.
3. Hold the card/tag against the back of the Flipper.
4. The Flipper detects the tag and attempts to read all accessible data.

Supported NFC tag types:

• NTAG213/215/216: Common NDEF tags. Fully readable and writable.
• MIFARE Classic 1K/4K: Most common access card. Has encrypted sectors.
• MIFARE Ultralight / Ultralight C: Simple tags, no encryption on standard Ultralight.
• MIFARE DESFire EV1/EV2/EV3: Enterprise-grade encryption. Flipper can read the UID and some unencrypted files only.
• FeliCa: Sony's protocol (Japanese transit cards). Flipper reads the UID.
• ISO 14443-A/B: Generic standard. Flipper reads the UID.
• ISO 15693: Vicinity cards (longer range). Limited support.

What the read screen shows:

• UID: The unique identifier (serial number) of the card
• SAK / ATQA: Type identification bytes
• Memory dump: For unencrypted tags, the full memory contents
• NDEF records: URLs, text, vCards, Wi-Fi credentials stored on the tag

Step 5: MIFARE Classic Deep Dive

MIFARE Classic is the most common HF access card but has known security vulnerabilities. The Flipper can work with these using the right approach.

MIFARE Classic structure:

• 1K card: 16 sectors of 4 blocks each (64 blocks total)
• 4K card: 40 sectors
• Each sector has 3 data blocks and 1 sector trailer (keys + access bits)
• Two 48-bit keys per sector: Key A and Key B
• Default factory keys are often FFFFFFFFFFFF or A0A1A2A3A4A5

Reading MIFARE Classic with the Flipper:

1. Read the tag. The Flipper attempts to read all sectors using known default keys.
2. If successful, you see the full memory dump.
3. If some sectors show as unreadable, those sectors use non-default keys.

Key recovery for MIFARE Classic:

The Flipper has a MIFARE Classic dictionary attack feature:

1. NFC > Extra Actions > MIFARE Classic > Detect Reader
2. Or: use the Mfkey32 app (in the Flipper App Catalog) to recover keys from reader nonce data
3. The dictionary attack tries common keys from a built-in list (the user dictionary file)

Adding keys to the dictionary:

1. Connect Flipper via qFlipper
2. Navigate to the NFC folder on the SD card
3. Edit or create mf_classic_dict_user.nfc
4. Add one key per line in hex (12 characters)
5. The Flipper tries these keys when reading MIFARE Classic cards

Popular keys to add:

FFFFFFFFFFFF A0A1A2A3A4A5 D3F7D3F7D3F7 000000000000 B0B1B2B3B4B5 4D3A99C351DD 1A982C7E459A AABBCCDDEEFF 714C5C886E97 587EE5F9350F A0478CC39091 533CB6C723F6 8FD0A4F256E9

Step 6: Emulating and Writing NFC Tags

Emulating MIFARE Classic:

1. Read a MIFARE Classic card (with known keys for all sectors).
2. Save the full dump.
3. Select Emulate. The Flipper presents itself as the original card.
4. Hold against a reader to test.

Emulation notes:

• The Flipper emulates the UID and memory contents
• Some readers perform anti-clone checks (verify card manufacturer signature). These may reject emulation.
• Emulated MIFARE Classic responds to authentication with the stored keys

Writing to blank MIFARE Classic cards:

1. Read the source card completely.
2. Obtain a blank MIFARE Classic 1K card (Gen1A or Gen2, about $1 each).
3. NFC > Saved > [your card] > Write.
4. Hold the Flipper against the blank card.
5. It writes sector by sector, including keys and access bits.

Gen1A vs Gen2 magic cards:

• Gen1A: Accepts a special backdoor command to write to any block without authentication. Easier to clone but detectable by readers checking for the backdoor.
• Gen2: Requires authentication but allows writing to block 0 (the UID block). More compatible with readers but requires valid keys.

Step 7: NDEF Data and Practical NFC Applications

Beyond access control, NFC tags store NDEF (NFC Data Exchange Format) records:

• URL: Tap to open a website
• Text: Plain text message
• Wi-Fi: Network credentials for auto-connect
• vCard: Contact information
• Application: Launch a specific app
• Bluetooth pairing: Pair a Bluetooth device

Creating NDEF tags with the Flipper:

1. NFC > Read a blank NTAG213/215/216
2. Save the tag
3. Select the saved tag > Edit
4. Add NDEF records (URL, text, etc.)
5. Write back to the tag or emulate

Reading NDEF from tags:

The Flipper automatically detects and displays NDEF records when reading compatible tags. Tap an NTAG with a URL and the Flipper shows the URL with an option to open it.

Step 8: iButton and Dallas Key (1-Wire)

The Flipper can read iButton/Dallas keys using the GPIO pins with the optional iButton probe or by wiring a DS1990A reader to the GPIO.

1. Connect the iButton probe to the GPIO header (or use a DIY probe on GND and 1W pins).
2. iButton > Read.
3. Touch the key to the probe.
4. The Flipper reads the 64-bit ROM ID.

iButton emulation:

The Flipper can emulate iButton keys using the GPIO pins:

1. Read an iButton key.
2. Select Emulate.
3. The Flipper outputs the ROM ID on the 1-Wire bus through the GPIO.
4. Touch the Flipper's GPIO pins to the iButton reader to test.

Writing to RW1990 rewriteable keys:

The RW1990 is a rewritable iButton key:

1. Read the original iButton key.
2. Obtain a blank RW1990 key.
3. Select Write from the saved key.
4. Touch the RW1990 to the probe.

Step 9: Security Assessment Techniques

Card cloning detection test:

1. Read an access card.
2. Emulate it at the reader.
3. If the reader accepts it, the system does not verify card authenticity (no cryptographic challenge).
4. If it rejects, the system may check the card's digital signature or use encrypted handshakes.

MIFARE Classic vulnerability check:

1. Read the card with the Flipper.
2. If any sectors use default keys (FFFFFFFFFFFF), the system is misconfigured and vulnerable to trivial cloning.
3. If all sectors use custom keys but you can crack them with Mfkey32, the system uses weak key diversification.
4. MIFARE Classic should not be used for high-security applications. Recommend migration to MIFARE DESFire or mobile credentials.

UID-only system test:

Many cheap readers only check the UID and ignore everything else:

1. Read the card's UID.
2. Use the Flipper's UID emulation feature (NFC > More > Emulate UID).
3. If the reader accepts the UID-only emulation, the system is trivially bypassable.

Step 10: Advanced NFC with External Tools

For deep analysis beyond the Flipper's capabilities:

Proxmark3 integration:

The Proxmark3 is the professional RFID research tool. It can:

• Perform nested authentication attacks on MIFARE Classic
• Crack MIFARE Classic keys in seconds (darkside attack, nested attack)
• Sniff NFC communication between card and reader
• Emulate any RFID/NFC card with precise timing

Workflow: Use the Flipper for field reads and basic emulation. Use the Proxmark3 for key cracking and protocol analysis. Transfer captures between devices using the Flipper's SD card.

ChameleonMini / ChameleonTiny:

Standalone NFC emulation devices that complement the Flipper:

• Store 8 card slots simultaneously
• Button-selectable card switching
• Better emulation compatibility than Flipper for some readers

Tips for RFID/NFC Success

• Card position matters: The Flipper's NFC antenna is on the back, centered. Position the card directly over the logo for best coupling.
• Remove the case: Thick phone cases or Flipper cases reduce read range. Remove for difficult reads.
• Power matters: NFC reading is power-hungry. A low battery reduces read range and reliability.
• Some cards are shielded: Payment cards and some high-security access cards have metal shielding that blocks the signal. These cannot be read without specialized equipment.
• Keep a key dictionary: Build your mf_classic_dict_user.nfc file over time. Every unique key you encounter adds to your capability.
• Blank card inventory: Keep T5577 cards (LF), MIFARE Classic 1K Gen2 cards (HF), and NTAG215 stickers on hand for cloning jobs.
• Tag your captures: Name saved cards with location, date, and card type: OfficeMain_EM4100_20260507.

Conclusion

The Flipper Zero's RFID and NFC capabilities cover the full spectrum from simple 125 kHz EM4100 reads to complex MIFARE Classic analysis. For LF, the read-emulate-write workflow handles most access control assessments. For HF, the MIFARE Classic dictionary attack, NDEF editing, and UID emulation provide deep functionality. Combined with external tools like the Proxmark3 for professional key recovery, the Flipper is an essential field tool for any RFID security assessment. Know your protocols, build your key dictionary, and always test only on systems you own or have explicit authorization to assess.