|
Back for 2019 greetz to old friends! I have build a handful of these devices originally built by samyk design. I have taken the design from his build and made a much more powerful version with large mag coils for increased range and usability. Also we have all the coding present and working for all bypass methods for EMV and card prediction generation... Allows you to store all of your credit cards and magstripes in one device Works on traditional magstripe readers wirelessly (no NFC/RFID required) Can disable Chip-and-PIN Correctly predicts Amex credit card numbers + expirations from previous card number or canceled card! Supports all three magnetic stripe tracks, and even supports Track 1+2 simultaneously Larger coil design As with samyk design we have improved the range of the device and we have all functioning modules working and present. One of the primary issues I've found is that some of the new forms of security (well, new in the US) are set in the "service code" portion of the magstripe, most specifically Chip-and-PIN. The service code within a credit card magstripe defines several attributes of the card, including whether the card can dispense cash, where it can work (nationally, internationally), and most interestingly, whether the card has a built in IC (Chip) and if it has a pin (Chip-and-PIN / EMV). If your card has a chip inside and you go to a retailer that supports Chip but swipe just your magstripe, the point of sale (PoS) system will ask you to dip your card/chip for additional security if it supports it. the bits stating the card has Chip-and-PIN can be turned off from the magstripe. it mean if you take a card to a retailer that would normally request you to dip, you can actually get away with not dipping your chip at all while performing a successful transaction, evading the security measures altogether. Code: <pre class="alt2" dir="ltr" style=" margin: 0px; padding: 6px; border: 1px solid rgb(0, 0, 0); width: 640px; height: 34px; text-align: left; overflow: auto; background: rgb(37, 37, 37) none repeat scroll 0% 0%; border-radius: 5px; font-size: 11px; text-shadow: none;">#include <avr/sleep.h> #include <avr/interrupt.h> #define PIN_A 0 #define PIN_B 1 #define ENABLE_PIN 3 // also green LED #define SWAP_PIN 4 // unused #define BUTTON_PIN 2 #define CLOCK_US 200 #define BETWEEN_ZERO 53 // 53 zeros between track1 & 2 #define TRACKS 2 // consts get stored in flash as we don't adjust them const char* tracks[] = { "%B123456781234567^LASTNAME/FIRST^YYMMSSSDDDDDDDDDDDDDDDDDDDDDDDDD?\0", // Track 1 ";123456781234567=YYMMSSSDDDDDDDDDDDDDD?\0" // Track 2 }; char revTrack[41]; const int sublen[] = { 32, 48, 48 }; const int bitlen[] = { 7, 5, 5 }; unsigned int curTrack = 0; int dir; void setup() { pinMode(PIN_A, OUTPUT); pinMode(PIN_B, OUTPUT); pinMode(ENABLE_PIN, OUTPUT); pinMode(BUTTON_PIN, INPUT_PULLUP); // blink to show we started up blink(ENABLE_PIN, 200, 3); // store reverse track 2 to play later storeRevTrack(2); } void blink(int pin, int msdelay, int times) { for (int i = 0; i < times; i++) { digitalWrite(pin, HIGH); delay(msdelay); digitalWrite(pin, LOW); delay(msdelay); }</pre> I noticed many of the amex digits were similar. I pulled up the numbers to several other Amex cards I had, and then compared against more than 20 other Amex cards and replacements and found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. Code: <pre class="alt2" dir="ltr" style=" margin: 0px; padding: 6px; border: 1px solid rgb(0, 0, 0); width: 640px; height: 34px; text-align: left; overflow: auto; background: rgb(37, 37, 37) none repeat scroll 0% 0%; border-radius: 5px; font-size: 11px; text-shadow: none;">MasterCard: ^(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$ MasterCard numbers either start with the numbers 51 through 55 or with the numbers 2221 through 2720. All have 16 digits. American Express: ^3[47][0-9]{13}$ American Express card numbers start with 34 or 37 and have 15 digits. Diners Club: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$ Diners Club card numbers begin with 300 through 305, 36 or 38. All have 14 digits. There are Diners Club cards that begin with 5 and have 16 digits. These are a joint venture between Diners Club and MasterCard, and should be processed like a MasterCard. Discover: ^6(?:011|5[0-9]{2})[0-9]{12}$ Discover card numbers begin with 6011 or 65. All have 16 digits. JCB: ^(?:2131|1800|35\d{3})\d{11}$ JCB cards beginning with 2131 or 1800 have 15 digits. JCB cards beginning with 35 have 16 digits.</pre> The CID (aka CVV2 on Visa) printed on the card is protected by a secret 3DES key that encrypts the PAN (Primary Account Number, aka credit card number), service code (see table above), and expiration. The service code can be easily determined as most cards will contain the same service code. I also determined that the CSC (essentially behaves like a CID or CVV2 on the magstripe) for a lost or stolen card continues to work for a newer, predicted card. An attacker would be able to use a stolen card's CSC with the predicted card number and expiration to make actual purchases. To actually perform the transaction without arousing suspicion, an attacker would be able to use a magstripe writer (e.g., the well known MSR605), or a device like MagSpoof, to "load" the newly devised card information onto a card like Coin. Coin itself does not actually verify the CID (CVV2), thus allowing an attacker to load data, and then use the Coin card in person without knowing the CID and exploiting these various issues, as well as disabling Chip-and-PIN. Code: <pre class="alt2" dir="ltr" style=" margin: 0px; padding: 6px; border: 1px solid rgb(0, 0, 0); width: 640px; height: 34px; text-align: left; overflow: auto; background: rgb(37, 37, 37) none repeat scroll 0% 0%; border-radius: 5px; font-size: 11px; text-shadow: none;">void sleep() { GIMSK |= _BV(PCIE); // Enable Pin Change Interrupts PCMSK |= _BV(PCINT2); // Use PB3 as interrupt pin ADCSRA &= ~_BV(ADEN); // ADC off set_sleep_mode(SLEEP_MODE_PWR_DOWN); // replaces above statement MCUCR &= ~_BV(ISC01); MCUCR &= ~_BV(ISC00); // Interrupt on rising edge sleep_enable(); // Sets the Sleep Enable bit in the MCUCR Register (SE BIT) sei(); // Enable interrupts sleep_cpu(); // sleep cli(); // Disable interrupts PCMSK &= ~_BV(PCINT2); // Turn off PB3 as interrupt pin sleep_disable(); // Clear SE bit ADCSRA |= _BV(ADEN); // ADC on sei(); // Enable interrupts</pre> Payment BTC Only. Price 2.5 BTC - Device + Source code + Pin Generation Device only - 1.5 BTC Device loaded with firmware no source. Device only comes with firmware loaded competent coder could write in around 10/15 day possibly also supplied are resources related to our own project with device. ===========Payments & Delivery & Rules=========== Understand that delivering this device world wide security of is paramount we ship via UPS / FEDEX / Or selected shipping of your choice to any location. We also require when buying and sending your deliver address you encrypt this with PGP this is for your safety! knock in the jabber for our PGP Key Delivery times can depending where in the world the device is being shipped. All payments are final No Refund If device post intercepted. We will however reship if this happens and can be PROVED. ================================================== = Jabber - mailto:[email protected] OTR Required! Knock only for sales. ===List Of Tested Devices NFC=== http://pastebin.com/du0uT8a4 ====== MAGSPOOF MEDIA======= https://anonfile.com/5bMed8Zdme/MagSpoofD_mp4 https://anonfile.com/bfMfd3Zbma/Build2_jpg https://anonfile.com/UeL6d4Z6mf/build1_jpg Greetz - 414s,https://txgate.io/images/smilies/mosking.gif Long term service 2017-2019 FuckAV - http://fuckavu4wxxtemao.onion/showth...840#post174840 https://forum.exploit.in/topic/155409/ ******** UPDATE *********** https://nofile.io/f/WAMK5PUBVpn/MAGSPOOF.mp4 Only add in the jabber when ready to work to many cardboard cut out carders here wanting free or poke for how to do this I will not tell or share methods so don't waste breath or time asking. If you add and send spam and waste my time you will be blocked.. Real cards apply only.. Not know what this tool is go read. Not babysitter or teacher.. UP - mailto:[email protected] |
device not work on video |
aka_k4, а про шо он там ?) че то пиздец текста, полюбому разводос какой нибудь наверное за емв девайс |
да развод какой то беспантовый |
the tool is great but the price is not same is not working from dump for all cards.... more proof is asked? possible? how pin get bypass? https://www.fuzecard.com/ card used is same as this? https://krebsonsecurity.com/2019/01/...to-fuze-cards/ more info? </br></br></br></br></br></br></br></br> |
this tool not work it is scamm!!11111 |
Quote:
why you throw this in our sales.. Throw in the jabber for sales. Long term seller 2017 both FKav and Exploit.in.. Добавлено через 1 минуту 44 секунды Device is working is copy's from SammyK design we have full source for devices. read up on device before throwing in the jabber questions. Limited supply like 2017 run. sold out 5 days. Price is high but tool is worth of price. no where else can you find with source., anyone other selling is false. |
Quote:
......лишнее - ТС даже в тему не углублялся... |
To throw the transaction contact-less is only need the load of the fresh card information. it is not verify the CID (CVV2), So allow the full loading and then use the card without knowing the CID , and disabling of the Chip-and-PIN direct. You can also remove the status to "dip" card and still make valid payment. My post on FuckAV look at the date... 2017... Stop looking for holes... the KING is back.. |
Вот отсюда копипраст https://github.com/samyk/magspoof Статья 2015 года, читайте внимательно про пинкоды, какой платежной системы это касалось и прочии нюансы. Включайте думалку пока вас этот "король" не облопошил.https://txgate.io/images/smilies/trollface.png |
|
ok now i see more clear so he pretend to bypass the pin: it can happened only if a .cap file is read by chip reader and the exploit was upgrade on pos!!!!! he pretend to bypass the dip insert for emv: all this done just with a spoofed radio signal of a track 2 that's why i ask more proof and your explain give no answer to what happened in reality, your affirmation are beautifull but give more proof of what you claiming now is a limited sell, like do it fast buy and dont ask too much look suspicious if no more proof or argument give to explain i think is not the tool you claim to have peace |
Device is confirmed from 2017 have no issue discuss device with buyer. Yes can bypass PIN removed ability for chip+pin yes can trick most devices into think card has been swiped with RF near sensors. And no you do not need modified POS terminal to use this working on standard POS terminal. https://anonfile.com/S3P8z6Z3mc/Build2_jpg Device build with SammyK design updated coil size and with full source. Not know what SammyK device is? Go search and come back. Watch https://www.youtube.com/watch?v=UHSFf0Lz1qc 41 sec... Understand... Throw in the jabber for info. Sales - mailto:[email protected] |
you always on same point........ samy kamkar tool i know mister MillWorm i already build it.... you not answer on how the pin is bypassed with argument??? what make bypass the pin? if is only a dump, how is happening???? so give real argument, not just say yes it work!!!! 2017, we in 2019 and pos get updated on the .cap exploit!!! plus i dont see you use it for your tool!!!! so from where you bypass the pin, something have to do it and in your explain nothing do it!!! track is read over rf, ok and what? how is bypassing 201 code, because is repeated more than 3 time!!!! give more argument because until now is no answer on it... ps: pin bypass or pin altered can happened only over some process on pos and is not the same on atm, it happened when pin is verified offline, so how your tool work with bin who do only online pin???? |
If you are familiar with it, ask to make a video, where you can see the operation of the device, and not the one it shows |
understanding that device has been updated since 2017 yes fully know of .cap assume communication is betweekn reader + smartcard and is ISO7816 defined in the standard of EMV is VERIFY and GENERARE_AC the communication form. Code: <pre class="alt2" dir="ltr" style=" margin: 0px; padding: 6px; border: 1px solid rgb(0, 0, 0); width: 640px; height: 178px; text-align: left; overflow: auto; background: rgb(37, 37, 37) none repeat scroll 0% 0%; border-radius: 5px; font-size: 11px; text-shadow: none;">ASK-PIN 01 03 04 00 00 00 00 00 SIGNDATA-DATA-LOGIN 01 03 05 06 00 00 00 00 SIGNDATA-DATA-TRANSACTION 01 03 05 16 00 00 00 00 SIGNDATA-TEXT 01 03 05 46 00 00 00 00 GENERATE-AC 01 03 06 00 00 00 00 00</pre> gives the instruction to generate the ACs, without waiting for the user to press OK cryptograms to the reader. so the transaction show only on the display for less than a seconds. approve defeating one of the key objectives of WYSIWYS ( What You See Is What You Sign) no longer has to enter pin and after this no more interaction is needed from the user to sign malicious transactions. Please throw the jabber for info. Добавлено через 2 минуты 21 секунду @aka_k4 - Not know what your issue is. Service is valid since 2017 no reports of scams or false on any forum. you should DYOR..... |
ok can you make a video on a real pos during operation? |
can you make a video on a real pos during operation only there should be a piece of paper with your nickname? ASK-PIN 01 03 04 00 00 00 00 00 SIGNDATA-DATA-LOGIN 01 03 05 06 00 00 00 00 SIGNDATA-DATA-TRANSACTION 01 03 05 16 00 00 00 00 SIGNDATA-TEXT 01 03 05 46 00 00 00 00 GENERATE-AC 01 03 06 00 00 00 00 00 what is it? 01 03 06 00 00 00 00 00 this is not GENERATE-AC command man Добавлено через 3 минуты 13 секунд if you understand, show your transaction on bytecode, you can change or hide the most secret places that you wouldn’t want to show, but show how you choose PDOL show how you read AFL show how you do signature generation come on scammer |
@ aka no we do not card live we are vendor of hardware and software only we do not "card" to prove only selling of hardware of codebase. Generate-AC is not command? really?? DYOR... Добавлено через 1 минуту 21 секунду I think its you who need to continue to learn.. And stop spamming scam in topic.. You are speculating and making false posts... Go read above is valid command you just don't know it yet... |
Quote:
|
Quote:
<pre class="alt2" dir="ltr" style=" margin: 0px; padding: 6px; border: 1px solid rgb(0, 0, 0); width: 640px; height: 146px; text-align: left; overflow: auto; background: rgb(37, 37, 37) none repeat scroll 0% 0%; border-radius: 5px; font-size: 11px; text-shadow: none;">[9F02 06 (Amount, authorized, numeric)]: 000000001000 (that's 1.00) [9F03 06 (Amount, other, numeric)]: 000000000000 (that's 0.00) [9F1A 02 (Terminal country code)]: 0040 (Austria) [95 05 (Terminal verification results)]: 0000000000 (or whatever TVR you need) [5F2A 02 (Transaction currency code)]: 0978 (Euro) [9A 03 (Transaction date)]: 150528 (2015-05-28) [9C 01 (Transaction type)]: 00 (whatever transaction type need) [9F37 04 (Unpredictable number)]: 12345678</pre> You would then wrap that data into the DATA field of the GENERATE AC command APDU: 80 AE 5000 1D 000000001000 000000000000 0040 0000000000 0978 150528 00 12345678 00 In this response you will get a response msg data field wrapped in tag [77] (format 2) that is of several data objects Добавлено через 26 секунд it was example...... Добавлено через 41 секунду Not have time for arguments over who has bigger brain or balls.... Ready buyers throw in the jabber... time wasters please move on.. |
ok this is valid comand but need some proofs for device working USE ESCROW WITH THIS MEMBER!!!! |
AKA.. have no clue why you bash a service that is live since 2017 with NO ISSUES on any forum. But we accept use of the ГАРАНТ |
Quote:
margin: 0px; padding: 6px; border: 1px solid rgb(0, 0, 0); width: 640px; height: 146px; text-align: left; overflow: auto; background: rgb(37, 37, 37) none repeat scroll 0% 0%; border-radius: 5px; font-size: 11px; text-shadow: none;">[9F02 06 (Amount, authorized, numeric)]: 000000001000 (that's 1.00) [9F03 06 (Amount, other, numeric)]: 000000000000 (that's 0.00) [9F1A 02 (Terminal country code)]: 0040 (Austria) [95 05 (Terminal verification results)]: 0000000000 (or whatever TVR you need) [5F2A 02 (Transaction currency code)]: 0978 (Euro) [9A 03 (Transaction date)]: 150528 (2015-05-28) [9C 01 (Transaction type)]: 00 (whatever transaction type need) [9F37 04 (Unpredictable number)]: 12345678</pre> You would then wrap that data into the DATA field of the GENERATE AC command APDU: 80 AE 5000 1D 000000001000 000000000000 0040 0000000000 0978 150528 00 12345678 00 In this response you will get a response msg data field wrapped in tag [77] (format 2) that is of several data objects Добавлено через 26 секунд it was example...... Добавлено через 41 секунду Not have time for arguments over who has bigger brain or balls.... Ready buyers throw in the jabber... time wasters please move on.. is no time waster, is asking for proof, nothing else people ask you question just to verify what you saying dont think someone flood or hate you.... make a video of it you would sell it every day, nothing else on what card it work ? or it work on all card the same? or is just amex? only emv and signature can be bypass with swipe and signature so can you be clear and you would be raise as legit, no one hate you we just ask proof of what you are claiming, nothing else ps: you ask 2.5 btc so is normal people ask, what's the problem if you legit give more proof, like a live video that's simple |
I have no issue people asking but I have issue when someone come and start posting Scam scam scam warning the only to make accusation of no such thing as Generate_AC only to be told yes is indeed command.. I busy very busy if serious people interested then come speak in the jabber. Escrow accept here fuckav and exploit so no issues. Questions are fine accusations are blocked.. Treat others how you should like to be treated. is all we ask. |
Quote:
if you were smarter you would know that you have thrown off only two photos from the internet and a video where the work of the device is not visible |
Quote:
I understand and I said happy to answer questions AKA but you throw "scam" claim at us before you ask question this is not how things should be. No one cares what you say either AKA and from looks of it you made scam claim before even ask questions about device so no why put up with people like you who make claims then ask questions.. is backwards my friend. very backwards. If you want proofs throw in the jabber AKA. Добавлено через 1 минуту 14 секунд https://anonfile.com/t2v826Zcm0/Untitled_Project_mp4 Добавлено через 20 секунд Just for you AKA https://txgate.io/images/smilies/smile.gif Добавлено через 1 минуту 29 секунд Thirsty anyone? https://txgate.io/images/smilies/dntknw.gif |
Use sendspace man Show at least one review of your device? For a couple of years, there must be at least one Добавлено через 8 минут 11 секунд Bad video can't see all transaction flow |
Video shows working payment for $3 to chase. Valid. 2 times now AKA says not valid... You have beef bro? seems very like you have issues. |
Just want good proofs Добавлено через 10 минут 20 секунд Or show at least one review of your device on any known forum, or you are so private that in two years I haven’t sold it on any forum |
Quote:
If we scammed anyone we would be banned from fuckav and exploit both accounts in good standing.. since 2017.... https://txgate.io/images/smilies/punish.gif |
Quote:
|
I said b4 I am not in the "game" of making payment I ask client to make this and send asap he did what was asked was not asked for payment at terminal was ask of proof of working device which was supplied.. If not sufficient for you move on..... Product is not for you.. |
Темка интересная, но стара как мир. 2015 год. https://habr.com/ru/post/367129/ https://securityaffairs.co/wordpress...e-spoofer.html Амексом, похоже, действительно можно так платить, но ... сколько я не изучал этот вопрос, мне кажется что с ВИЗОй и Мастерком не получится (чисто мое субъективное мнение). Платка эта позор. Я пользуюсь фузикорм (fuze card). Работает великолепно! Кассиры спокойны. Можно купить в ру - тут - http://fuze-card.ru/. Но пока в наличии там ни одной нету ))). |
Quote:
|
Ну если только ты клоун ). Во первых амекс принимают не везде Во вторых - чем больше ты что то прячешь, крутишь и вертишь - кассир понимает сразу, что на...ть хочешь. В случае с фузиком, делаешь все открыто, вот такой вот электронный кошелек можно ответить всегда, и дальше катать дампики (или платить магнитной волной). Емкость реальная - 15 штук. Ржу не могу)) провода внутри манжеты )) А если охранник спросит - отвечать: Я терминатор? Пришел покупать с пустой картой) , а если не получится - взорву все на ...й ))) На физике есть дисплей, можно спокойно сверять карту с чеком, есть Имя Кардхолдера (можно сохранить любое, но я предпочитаю свое), и еще несколько степеней защиты, например, становится бестолковым кирпичом , если отключить блютуз на телефоне, и к другой учетной записи ее тоже никак не подвязать. Безопасность и довольный кассир - это прежде всего. А платки эти - кружок радиолюбителей. |
Rat clown |
aka fuck off our topic!! you are now just troll for no reason ** admin ** please remove AKA from topic non constructive questions and abuse.. |
|
Quote:
read back... sales were on FUCKAV link in main topic and ps..... check the date... oh 2017 https://txgate.io/images/smilies/smile.gif |
| All times are GMT. The time now is 11:43 PM. |
Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2025, vBulletin Solutions, Inc.