Specter: Open-source NFC reader bug sweep for Flipper Zero
Specter is a Flipper Zero app that finds powered NFC readers by listening for the radio field they give off. The readers it hunts work at 13.56 MHz.
The Flipper’s own chip does the sensing
The onboard ST25R3916 carries a hardware external-field detector, the same circuit that lets the device emulate a card and register when a reader starts talking to it. Specter reads that one bit, hundreds of times a second, with its own transmitter dark.
Strength comes out of duty cycle. Over a short window the app measures what fraction of the time a carrier is present, smooths the result, and prints it as FIELD %. A reader lying against the case pegs the meter. A slow-polling one across the room nudges it.
A sensitivity control raises or lowers the noise floor, so an operator can chase faint distant fields or flag only the strong ones underfoot. Contact fires a magenta LED and a vibration, which lets the Flipper ride in a pocket during a sweep. The proximity strip walks from FAINT to NEAR to CLOSE to STRONG.
What Specter misses
The band is the first limit. Specter hears the NFC range used by contactless payment skimmers, most current access readers, transit gates and hotel locks. The 125 kHz world of older HID Prox and EM4100 door panels stays silent to it, because the Flipper’s low-frequency path offers no equivalent field-detect bit.
Some skimmers sleep until a real card wakes them. Others sit behind shielding. “Absence of a reading isn’t a guarantee of absence,” said Kailash Parshad, the creator of Specter.
The tool reports that a reader is live and roughly how near. FIELD % works as a warmer-colder guide across a surface, calibrated against nothing. Specter also seizes the NFC radio for the duration of a sweep, so any other NFC app has to be closed first.
Getting it onto the device
qFlipper drags it into apps/NFC on the SD card. Building from source takes ufbt and a USB cable.
The roadmap lists a timestamped detection logbook written to the SD card, a screen-off buzzer-only sweep mode, and an experiment with coil-based low-frequency sensing.
Specter is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!