I'm trying to test an authentication process using NFC reader as a medium. The scenario is like this, I need to go to a certain website but in order to get there, I need to verify myself using my ID which I need to scan through the NFC reader which will then authenticate me and eventually leads going to the place I want to be.

My problem is, I tried burp for intercepting the process, but it seems the burp doesn't catch the traffic that was passing through. The reader is directly connected to my laptop and the web app when I press enter a popup comes out where I think the authentication is being done, but that popup window doesn't have options or anything so I supposed it's using the same process as the normal browser.

Any insights/suggestion on how to do this stuff properly would be appreciated.

  • 1
    Burp does not intercept NFC. You will have to figure out the relationship between the NFC reader and the site. – schroeder Sep 10 '18 at 13:55
  • can u give me a reference to read if possible? im totally lost in this...like how they are communicating? – rockStar Sep 10 '18 at 18:25

I'm assuming you're NFC reader is a peripheral device?

Burp can be set up as a MITM but you'll need to direct any traffic from that peripheral to be aware of the Burp HTTP proxy if you want to intercept the traffic.

You'll have to review the settings for your specific device after setting up your Burp proxy.

  • yup it is a peripheral, but it's plug n play so i dont think there's even a setting but i'll check on it tomorrow, i was thinking of making burp listen to traffic coming from certain port and forcibly forwarding the traffic that the nfc generates to that port. which at this point i just need to think of ways on forwarding all of the traffic to that port – rockStar Sep 10 '18 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.