Search “NFC emulator” and you’ll find two different things wearing the same name: a device that pretends to be a card, and a setup that forwards a real card’s session somewhere else. They solve different problems, and mixing them up is the fastest way to buy the wrong tool.
What is an NFC emulator?
An NFC emulator is a device that answers a reader’s request the way a real contactless card would, without a physical card present. The reader can’t tell the difference — it just sees valid card data coming back over the air, generated by the emulator instead of read off a chip embedded in plastic.
We built that capability into BomberCat’s firmware: it can emulate a contactless card in VISA MSD mode, pulling the card’s Track 2 data straight from the air with one command.
NFC emulator vs NFC relay attack — what’s the difference?
An emulator stands in for a card entirely on its own; it needs no live connection to anything else. A relay attack is different: it forwards a live session between a real card and a real reader through two linked devices, so the reader ends up talking to a genuine card that’s physically somewhere else.
BomberCat does both, just with different firmware modes. Emulation uses the mode we just described. The relay instead uses NFCGate, an existing open-source Android project — one BomberCat (or a phone running that app) sits next to the card, a second BomberCat sits next to the reader, and the two talk to each other over the network while the reader and card never meet.
Is one of them “the hack” and the other just a demo? Not really — both move real card data, which is exactly why we only frame either one for a reader and a card you’re authorized to test.
What else does BomberCat read and write, beyond emulation?
Emulating a card is one firmware mode among several:
- DetectTags reads the ID and technology of whatever tag is nearby — MIFARE Classic, NTAG, FeliCa and more — without emulating anything.
- Full MIFARE Classic access: card detection, key authentication, block read and write, and sector read, plus a live session for hands-on key work.
- DetectReaders fingerprints payment terminals and skimmers instead of cards — it’s the function BomberCat inherited from our older Hunter Cat NFC, which it replaced.
- MagSpoof is a separate mode entirely: it replays a magnetic-stripe card’s data wirelessly through an onboard coil, based on Samy Kamkar’s open-source MagSpoof project. It has nothing to do with NFC — no antenna, no reader handshake, just the stripe’s two data tracks.
How does the relay mode actually run?
Both ends install our bombercat command-line tool on a Linux computer and point it at a shared relay server over a plain network connection. Running two BomberCats side by side is the setup we’ve seen work most reliably; swapping one end for a phone running NFCGate’s app instead is possible, but it’s the fussier of the two paths.
Once it’s running, capturing what crosses the wire is one flag away: start the relay and watch the card commands land in Wireshark in real time. In our own hardware tests, a full relayed payment transaction took about 4.5 seconds end to end.
Which board do you need?
BomberCat hardware v1.4.0 is what ships today, plug-and-play out of the box. It’s the board we built to replace Hunter Cat NFC, first released at DEF CON 30 back in 2022, so if you already know that name, this is where its reader-fingerprinting function lives now.
Authorized use only
Everything above — emulation, relay, reading, writing — only belongs on cards and readers you own or have explicit permission to test. Electronic Cats frames every one of these as an authorized-audit tool, not a way around anyone else’s lock.
A few questions people ask us
Does BomberCat replace the Hunter Cat NFC?
Yes. BomberCat is its successor, and DetectReaders carries over Hunter Cat NFC’s reader-fingerprinting job.
Can it emulate a MIFARE Classic card too, not just the VISA MSD mode?
Not yet, as far as our own tests confirm. Today’s firmware emulates cards in that one mode; MIFARE Classic support covers reading, key authentication, and block read/write, but not emulating a MIFARE card from scratch. The firmware repo’s releases are where that changes first, if it does — we’re not promising a date here, just pointing at where the current state actually lives.
Do I need two BomberCats to run a relay?
Two BomberCats is the setup we’d recommend first. One BomberCat plus a phone running that same app also works, just less reliably in our own testing.
Curious what else it does? Start with the BomberCat page.
Go forth and relay responsibly.
