Sectors 2–15 are empty, meaning that all the crucial data that allows the user to enter the building is in Sector 1. After reading Sectors 2–15 using: pm3 -> hf mf rdsc

Sector 0 is a read-only sector with the UID (a unique card ID number that normally is not changeable) and manufacturers data.

Surprisingly, all sectors except for sector 1 use a default key. UID : 5A C3 1C 10 ATQA : 00 04 SAK : 08 TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1 proprietary non iso14443-4 card found, RATS not supported Answers to magic commands: NO Prng detection: WEAK Valid ISO14443-A tag found # Now that we know it's a Mifare card, lets try using the default # key list: pm3 -> hf mf fchk keys.dic No key specified, trying default keys Running strategy 1 Chunk: 0.8s | found 31/32 keys (23) Running strategy 2 #db# ChkKeys_fast: Can't select card (ALL) Chunk: 0.2s | found 0/32 keys (23) Time in checkkeys (fast): 1.0s |-|-|-|-|-| |sec|key A |res|key B |res| |-|-|-|-|-| |000| a0a1a2a3a4a5 | 1 | b578f38a5c61 | 1 | |001| - | 0 | - | 1 | |002| ffffffffffff | 1 | ffffffffffff | 1 | |003| ffffffffffff | 1 | ffffffffffff | 1 | |004| ffffffffffff | 1 | ffffffffffff | 1 | |005| ffffffffffff | 1 | ffffffffffff | 1 | |006| ffffffffffff | 1 | ffffffffffff | 1 | |007| ffffffffffff | 1 | ffffffffffff | 1 | |008| ffffffffffff | 1 | ffffffffffff | 1 | |009| ffffffffffff | 1 | ffffffffffff | 1 | |010| ffffffffffff | 1 | ffffffffffff | 1 | |011| ffffffffffff | 1 | ffffffffffff | 1 | |012| ffffffffffff | 1 | ffffffffffff | 1 | |013| ffffffffffff | 1 | ffffffffffff | 1 | |014| ffffffffffff | 1 | ffffffffffff | 1 | |015| ffffffffffff | 1 | ffffffffffff | 1 | |-|-|-|-|-| # First, let's make sure that out key fob is a Mifare card: pm3 -> hf search Checking for known tags. After confirming they were Mifare Classic fobs (the most widespread 13.56MHz RFID chip) the first step was to simply try reading the card using default keys, that conveniently Proxmark already has built-in. The most obvious implementation of RFID were the key fobs used to enter my residential building. Proxmark3 RDV4 Verification and testing for default keysĪfter installing all the software/drivers and flashing the Proxmark with the latest firmware ( GitHub), all of which was quite straightforward thanks to well documented installation guides it was time to choose my target.

Mifare cracker