BomberCat — NFC Relay & Magstripe Tool | Electronic Cats

Oh what a shame it would be if SOMEONE was to use a device to emulate a prison guards key card... I mean... NOBODY voted for whatever law their in for anyways so... Oh and it would be oh so bad if someone was to use a device to FUCK the rich... Yeah terrible horrible things to do. Dont do it... ... ... BomberCat Read, emulate, and relay NFC and magnetic-stripe card data from one open-source board — the field tool for pentesters auditing contactless readers and payment terminals. What is BomberCat? BomberCat is an open-source security tool that combines the two card technologies you meet most in the field: NFC and magnetic stripe, used in access control, identification, and payment cards. On one board it reads and emulates NFC tags and smart cards, spoofs magnetic-stripe tracks wirelessly through an embedded coil (MagSpoof), and fingerprints the readers and terminals that probe it. It also works as an NFCGate-compatible relay endpoint. NFCGate is the open-source project for relaying contactless sessions over a network — so a card in one place can be presented to a reader you are authorized to test somewhere else. An RP2040 handles USB and control, an NXP PN7150 drives the NFC front end, and an ESP32 co-processor adds WiFi and BLE. Its DetectReaders firmware fingerprints EMV terminals and skimmers — the reader-detection job the retired Hunter Cat NFC used to do. Hardware and firmware are open source, on GitHub. It is a wireless pentesting tool for authorized security audits only. Demonstrate an NFC relay against a reader you're authorized to test Situation: you need to show an NFCGate relay against a contactless or EMV terminal on systems you’re authorized to test. What you do: the board ships with NFCGate pre-flashed, so you just pair two peers (two BomberCats, or one BomberCat and the NFCGate Android app) through an nfcgate-server on a shared WiFi, set the role and a matching session byte, and start the relay from the CLI. Result: a full EMV transaction relayed end-to-end — validated on real hardware at roughly 4.5 s per transaction — with every APDU tapped straight into Wireshark for your report. Audit a legacy magstripe reader, or fingerprint an unknown terminal A magnetic-stripe reader is in scope, or you need to identify a terminal before you trust it. Flash MagSpoof to replay Track 1 and 2 data from your own test cards wirelessly through the embedded coil, or flash DetectReaders so the board emulates a card and fingerprints whatever reader probes it. You see whether the stripe reader reacts with no physical card present, and you know whether you’re facing an EMV terminal or a skimmer before going further. Run a hands-on NFC lab, workshop, or CTF Situation: you’re teaching contactless security or running a CTF station and want everyone on real hardware. What you do: flash DetectTags to read UIDs and technologies (ISO 14443-A/B, ISO 15693, FeliCa), or the all-in-one WiFiWebServer firmware so each board becomes its own WiFi access point with a browser UI. Result: a self-contained NFC and magstripe bench, reprogrammable in Arduino, CircuitPython, or MicroPython, that each participant drives from a phone or laptop. Start in 10 minutes Install the bombercat CLI on a Linux PC (Python; add your user to the dialout group for serial access): github.com/ElectronicCats/bombercat-tools Configure the NFCGate relay over USB-serial: set the nfcgate-server host:port (default TCP 5566), a matching session byte (1–255) on both peers, and the role (reader or card). Config persists in flash. Stand up the nfcgate-server yourself following the repo deployment guide (Docker or systemd), and pair the second peer (another BomberCat or the NFCGate Android app) on the same WiFi. Start the relay from the CLI and capture the APDUs to Wireshark with :apdu + bombercat capture (classic pcap, DLT_ISO_14443). To switch modes, run bombercat flash DetectReaders (or DetectTags / MagSpoof) — resets to UF2 automatically, no Arduino toolchain required. Can it really run an NFC relay like NFCGate? Yes. BomberCat is an NFCGate-compatible relay endpoint with selectable reader and card roles. It pairs with a second BomberCat or with the NFCGate Android app through an nfcgate-server. Both paths are validated end-to-end on real hardware, relaying full EMV transactions over WiFi/TCP at roughly 4.5 s per transaction, on systems you’re authorized to test. Note: the TCP link is currently plaintext (no TLS yet). Once you’ve set the network, session and role from a computer, the relay role can also run standalone — the board boots straight into it on its own from then on, no host attached. Do I need to know how to code? No. BomberCat ships with the NFCGate firmware pre-flashed and is driven from the bombercat CLI. Switching to another mode (DetectTags, DetectReaders, MagSpoof) is one bombercat flash command over UF2 — no Arduino toolchain required. If you want to change how it behaves, it’s fully open source and programmable in Arduino In the box BomberCat board (RP2040 + PN7150 + ESP32, black) NFC antenna USB-C to USB-A cable (1 m) Antistatic bag + product/spec labels Not included Battery (3.7 V LiPo/Li-Ion) — buy separately Case — provided as 3D-print STL files in the repo, not shipped A second BomberCat, only if you want a board-to-board relay You also need A 3.7 V LiPo/Li-Ion battery to run it off USB (onboard charger included; battery not) For an NFCGate relay: a second peer (another BomberCat or the NFCGate Android app), a PC running the nfcgate-server, and a shared WiFi network A Linux PC for the bombercat CLI (macOS/Windows should work, untested); Wireshark for APDU capture A card and a reader/terminal you are authorized to test