Salvador Mendoza · Security research training
Payment card security, read byte by byte
The payment systems course is the training I teach at Black Hat USA, extended with the material that did not fit in the room. It is built on real transactions, captured from real cards and sanitized so they can be published. More courses are being written.
The first module of each course, the workbench and the decoder are free, and none of them needs an account.
Terminal to card · 20 bytes
00 A4 04 00 0E 32 50 41 59 2E 53 59 53 2E 44 44 46 30 31 00
SELECT by name. The name is
2PAY.SYS.DDF01: the contactless payment directory.Card to terminal · 95 bytes
- 6FFile Control Information (FCI) Template
- 84“2PAY.SYS.DDF01”Dedicated File Name
- A5FCI Proprietary Template
- BF0CFCI Issuer Discretionary Data
- 61Application Template
- 4FA0 00 00 00 03 10 10Application Identifier (AID)
- 50“VISA DEBIT”Application Label
- and 3 more fields
- 61Application Template
- 4FA0 00 00 00 98 08 40Application Identifier (AID)
- 50“US DEBIT”Application Label
- and 3 more fields
Normal processing
The card lists the payment applications it carries, each with its identifier and its label.
What the payment systems course contains
- Modules written
- 22
- Hours of material
- 31
- Diagrams
- 187
- Graded exercises
- 54
- Cited sources
- 32
About this dataThese captures were recorded from real cards and then sanitized. Card numbers sit on published test ranges, track data was rebuilt to match, and certificates were replaced. No live cardholder data is served here.
What one payment crosses
A single tap runs through four technologies. Each has its own failure modes, and each still carries the one before it. That accumulation is where most of the interesting work is, and it is what the payment systems course is organized around.
01
The magnetic stripe
Seventy-year-old plaintext, unsigned and trivially copied. It is still encoded on most cards, and still carried inside the chip as track 2 equivalent data. "We moved to chip" did not delete the stripe. It duplicated it.
02
The chip
Contact EMV: command APDUs, a certificate chain rooted in a key the terminal already holds, and an application cryptogram only the issuer can check. Most of what a terminal decides, it decides alone.
03
Contactless
NFC, competing kernels that read the same tag differently, and the qualifier bytes that settle whether a reader ever asks for a PIN. Two of those bits are attacker-reachable in published work.
04
Tokens and newer rails
Wallets, network tokens that are real card numbers by another name, phones acting as terminals, and account-to-account payments where the cryptography holds and the fraud moved above it.
Payment Systems: Magstripe, Tokenization, NFC and EMV
22 modules, from the stripe to the issuer
Four levels, from knowing security but not payments to looking for something nobody has published. Module 1 is free and needs no account; the rest come with the course.
Level 1
Foundations
Starts from: I know security. I don't know payments.
Level 2
Practitioner
Starts from: I can read a trace. Now interpret it.
Level 3
Operator
Starts from: Show me the attack, end to end.
Level 4
Researcher
Starts from: I want to find something new.
Security status not satisfiedWith the course
- 01Payment systems and securityThe fundamentals: how a transaction is verified and processed against the terminal, why the APDU protocol is not encrypted, and what protects the transaction instead.Foundations60 minFree
- 02Toolset environments, With the courseThe laboratory: how it is organized, how to navigate it, and which tool suits each payment technology.Foundations120 min
- 04Communication process for EMV transactions, With the courseThe APDU protocol end to end: packet generation, commands, responses, and the structure at the core of every transaction.Practitioner150 min
- 05EMV technology, With the courseContact transactions and the advanced APDU mechanisms behind them: the certificate chain a card carries, offline data authentication, and the cryptogram only the issuer can check.Practitioner120 min
- 13Cloning, replay and downgrade attacks, With the courseReversing transactions to understand attacks seen in the wild, and building proofs of concept for each.Operator120 min
- 14The unpredictable number and pre‑play, With the courseTag 9F37 is the terminal's only contribution of freshness, and some terminals supplied a counter. What that made possible, why it is neither a replay nor a clone, and how to measure a terminal for yourself.Operator90 min
- 21The authorization leg: from cryptogram to decision, With the courseThe card signs an amount it cannot verify, and the message that carries it restates that amount in a second place nobody signed. Following one cryptogram out through field 55 to the issuer and back as an ARPC, and a real message that admits nineteen different readings.Researcher120 min
- 22Research in progress, With the courseThree strands of original work that are not in the course yet, written as questions rather than results, each one saying plainly what has been demonstrated and what has only ever run in a unit test. The module is expected to change.Researcher30 min
- NextAI for Security AutomationIn preparation8 modules · 15 hours
Open to everyone
None of these needs an account or a purchase. They are how most researchers arrive, and the fastest way to judge the course before paying for it.
APDU workbench
Step through a real transaction one command at a time, every field named and every status word explained.
APDU decoder
Paste your own APDU or hex dump and read it. It runs in your browser, and nothing you paste is uploaded.
Study plan
Tell it what hardware you have, or that you have none, and it lays out what you can do with it, module by module.
Setup guides
Which reader to buy, how to get a first read from a card, and what to do with a capture.
References
Every paper, standard and talk the course cites, with what each one could and could not show.
Open for enrollment
Payment Systems: Magstripe, Tokenization, NFC and EMV
22 modules · 31 hours · four levels
Every module is built on captured traffic from real cards and real terminals, sanitized before it was ever stored. Most of the course is text and graded exercises you can practice against those captures. You read the actual bytes, decode them in the workbench beside the text, and where a step can be reproduced on real hardware, the module tells you which tool does it and how, so you can extract, emulate or replay it yourself on a card you own.
One payment. Yours for life, updates and new research included.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
What is being researched now, and what lands next- One payment, one course
- The price buys this course, not a subscription. There is nothing to renew and nothing to cancel.
- Access for life
- Every module, capture, exercise and lab in the course stays open to you for as long as the course exists.
- Updates and new research included
- When a module is revised or a new research strand lands in this course, it is yours at no further cost. The price you paid is the last one you pay for it.
Where to start
New to payment security
Begin with the study plan: tell it what hardware you have, and it shows what you can do with it and which guide gets a reader working. Then read module 1, which is free and opens on a device you can build for the price of lunch. No hardware is needed for the first several modules.
Build your study planAlready working in this field
Start at the references and pick the paper you have not read. Then go straight to the module that walks it at protocol level: the exact bits, the status words, the setups, and what each group could and could not ground. The workbench and the decoder need no account.
See the references