BomberCat
Read, emulate, and relay NFC and magnetic-stripe card data from one open-source board — the field tool for pentesters auditing contactless readers and payment terminals.
$119.00
In stock
- Works with: NFCGate app (Android) + a nfcgate-server you host
- Connects via: USB-C — control over serial, NFC over the PN7150
- Firmware: ships with NFCGate pre-flashed, updatable over UF2
- Software: Wireshark (APDU capture) · bombercat CLI on Linux
In the box
NFC antenna
USB-C to USB-A cable (1 m)
Antistatic bag + product/spec labels
Not included
Case — provided as 3D-print STL files in the repo, not shipped
A second BomberCat, only if you want a board-to-board relay
You also need
For an NFCGate relay: a second peer (another BomberCat or the NFCGate Android app), a PC running the nfcgate-server, and a shared WiFi network
A Linux PC for the bombercat CLI (macOS/Windows should work, untested); Wireshark for APDU capture
A card and a reader/terminal you are authorized to test
- 183 GitHub Stars
- DEF CON 30 (2022)
- Designed and built in Aguascalientes, Mexico
- Hardware CERN-OHL v1.2 · firmware GPL-3.0
What is BomberCat?
BomberCat is an open-source security tool that combines the two card technologies you meet most in the field: NFC and magnetic stripe, used in access control, identification, and payment cards.
On one board it reads and emulates NFC tags and smart cards, spoofs magnetic-stripe tracks wirelessly through an embedded coil (MagSpoof), and fingerprints the readers and terminals that probe it.
It also works as an NFCGate-compatible relay endpoint. NFCGate is the open-source project for relaying contactless sessions over a network — so a card in one place can be presented to a reader you are authorized to test somewhere else.
An RP2040 handles USB and control, an NXP PN7150 drives the NFC front end, and an ESP32 co-processor adds WiFi and BLE. Its DetectReaders firmware fingerprints EMV terminals and skimmers — the reader-detection job the retired Hunter Cat NFC used to do.
Hardware and firmware are open source, on GitHub. It is a wireless pentesting tool for authorized security audits only.
Demonstrate an NFC relay against a reader you're authorized to test
Audit a legacy magstripe reader, or fingerprint an unknown terminal
Run a hands-on NFC lab, workshop, or CTF
Start in 10 minutes
- Install the bombercat CLI on a Linux PC (Python; add your user to the dialout group for serial access): github.com/ElectronicCats/bombercat-tools
- Configure the NFCGate relay over USB-serial: set the nfcgate-server host:port (default TCP 5566), a matching session byte (1–255) on both peers, and the role (reader or card). Config persists in flash.
- Stand up the nfcgate-server yourself following the repo deployment guide (Docker or systemd), and pair the second peer (another BomberCat or the NFCGate Android app) on the same WiFi.
- Start the relay from the CLI and capture the APDUs to Wireshark with :apdu + bombercat capture (classic pcap, DLT_ISO_14443).
- To switch modes, run bombercat flash DetectReaders (or DetectTags / MagSpoof) — resets to UF2 automatically, no Arduino toolchain required.
| Weight | 0.050 g |
|---|---|
| Dimensions | 18 × 12.5 × 2 cm |
| MCU | RP2040 (dual-core ARM Cortex-M0+, 133 MHz) |
| NFC chip | PN7150 (NXP) |
| WiFi + BLE | ESP32 co-processor — WiFi (WiFiNINA), BLE (ArduinoBLE) |
| MagSpoof | TC4424 driver, embedded coil (30 turns / 30 mm) since HW v1.3 |
| Operating voltage | 3.3 V I/O · 5 V input over USB-C |
| External flash | 16 Mbit (2 MB) QSPI (W25Q16JV) |
| RAM / ROM | 264 kB SRAM · 16 kB boot ROM |
| Connector | USB-C 2.0 (USB, Serial/UART, NFC) |
| Bootloader | UF2 (double-tap reset to enter) |
| Battery | 3.7 V LiPo/Li-Ion, not included (onboard MCP73831 charger, green CHG LED) |
| RF protocols | NFCIP-1/2, ISO 14443A/B, FeliCa, MIFARE Classic 1K/4K, NFC Forum tags 1–5, ISO 15693/ICODE |
| Dimensions / weight | ~65 × 38.5 mm board · 10 g (40 g with 3D-printed case) |
| Programming | Arduino · CircuitPython · MicroPython |
| Open hardware | CERN-OHL v1.2 (hardware) · GPL-3.0 (firmware) |
| Feature | BomberCat | Hunter Cat NFC (retired) | MagSpoof V5 | NFCGate + 2 Android phones |
|---|---|---|---|---|
| What it does | NFC read/emulate, magstripe spoof, WiFi relay, reader detection — one board | Detected NFC readers/skimmers (defensive sensor) | Emulates magnetic-stripe cards | Relays NFC/APDUs between two phones via a server |
| NFC read / emulate | Yes (PN7150) | Detection only | No | Yes (phone NFC) |
| Relay over network | Yes — NFCGate-compatible over WiFi/TCP (~4.5 s) | No | No | Yes (the reference app) |
| Magstripe (MagSpoof) | Yes — embedded coil, Track 1+2 | No | Yes (its whole purpose) | No |
| Reader / terminal detection | Yes — DetectReaders firmware | Yes — its core function | No | No |
| What you need | One board (+ a second peer & server for board-to-board relay) | The board | The board | Two Android phones (with NFCGate’s rooted module) + a server |
