flipper-badge-audit - Defensive NFC access-badge security auditor for Fl

项目说明

<p align="center">
<img src="docs/logo.svg" alt="Badge Audit" width="100%">
</p>

<p align="center">
<img src=" alt="platform">
<img src=" alt="language">
<img src=" alt="build">
<img src=" alt="defensive">
<img src=" alt="license">
<img src=" alt="maintainer">
</p>

> Audit the badge, not break into the door. Badge Audit is a *defensi Zero app that tells you how secure an NFC access credential actually is — it identifies the chip, reads the UID, tests MIFARE Classic for factory/default keys, and gives you a clone‑resistance score you can act on.

Almost every Flipper NFC tool exists to read, clone, or emulate a card. Badge Audit does the opposite: it assesses one. Point it at your office/apartment/gym badge and find out — in seconds — whether that credential is wide open or genuinely protected.

<p align="center">
<img src="docs/demo.svg" alt="Badge Audit scanning a card on a Flipper Zero" width="460">
</p>

---

✨ Features

🎮 Controls

| Button | Action |
| :----- | :----- |
| *(tap card to back)* | Detect & analyze the badge |
| OK | Save the scorecard to SD |
| ◀ ▶ ▲ ▼ | Rescan a new card |
| Back | Exit |

🧮 How posture is scored

| Card / protocol | | Why |
| :-- | :-- | :-- |
| MIFARE Classic with default keys | 🔴 CRITICAL | Sectors open with factory keys — effectively unprotected |
| MIFARE Classic (no default keys) | 🟠 WEAK | Crypto1 is broken; keys are reco & card is cloneable |
| ISO14443‑3A/B (UID only), Ultralight, ISO15693, ST25TB | 🟠 WEAK | If the reader trusts the UID, the badge is tri cloneable |
| ISO14443‑4A/4B, FeliCa | 🟡 MEDIUM | Security depends on the application layer |
| MIFARE Plus (SL3), DESFire EV1/2/3 | 🟢 STRONG | AES/3DES mutual authentication |

🛠️ Build & install

Built with the official ufbt toolchain.

No toolchain? Grab badge_audit.fap from the Releases page and copy it to your SD card under apps/NFC/ with qFlipper. It then appears on the device at Apps → NFC → Badge Audit.

📄 Scorecard sample

OK appends a report like this to the SD card:

🗺️ Roadmap

⚠️ Disclaimer

Badge Audit is a read‑only, defensive assessment tool. It does not clone, emulate, write, or bypass anything. Use it only on credentials and systems you own or have explicit written authorization to assess. You are responsible for complying with all applicable laws. Provided as‑is, without warranty of any kind.

📜 License

MIT © (Zakariya Jabbar)

---

<p align="center">_{Made with 🐬 + ☕ by <b></b>}</p>

项目信息

开发语言：C

Star 数：7

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive NFC access-badge security auditor for Flipper Zero — identifies the chip, reads UID, tests MIFARE Classic default keys, and rates clone-resistance.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。