Visa · Replay

EMV replay session

Step through a transaction one command at a time. Every field named, every status word explained.

Taught in modules

Step 3 of 196

Response2 bytes

61 20

Status word

6120Completed, with 32 more bytes waiting. The terminal must send GET RESPONSE to collect them.

Decoded objects

No TLV objects in this response.

Exercises

Answer from the capture above. The explanation is worth reading either way.

Level 1
Which instruction byte (INS) starts a transaction by asking the card for its processing options?
Level 3
The first CVM rule on this card is 42 01. The method is enciphered PIN verified online. Under what condition does the rule apply?
Level 3
The DDOL (tag 9F49) on this card is three bytes: 9F 37 04. What is the card asking the terminal for, and why that specifically?
Level 3
The Issuer Public Key Exponent (tag 9F32) is 03, and the ICC Public Key Exponent (tag 9F47) is also 03. What does that value mean, and why would a payment card choose it?
Level 2
Tag 8F on this card holds a single byte. What is that byte for?
Level 3
This card's CVM list is 42 01, 41 03, 5E 03, 1F 03. The first three rules all have bit 7 set. What happens at a terminal that cannot satisfy any of them?
Level 3
The second rule in this card's CVM list is 41 03. Strip the continue bit and identify the verification method: the one whose result a wedge device can forge with a single status word.
Level 2
The terminal sends 80 CA 9F 17 00 and the card answers 6C 04. The terminal immediately sends 80 CA 9F 17 04. What happened?
Level 3
This capture contains a VERIFY command: 00 20 00 80 08 followed by eight bytes. The P2 byte is 80. What does that value specify?
Level 3
The plaintext offline PIN block in this capture begins with the nibbles 2 and 4, and ends in a run of F. What do the first two nibbles mean? Do not give the PIN.
Level 3
Tag 9F17 is the PIN Try Counter. In the man-in-the-middle attack where a wedge answers 90 00 without passing the PIN to the card, what happens to this counter?
Level 4
This capture holds two GENERATE AC commands built from CDOL1, and the card's response to both is byte-identical. The amounts are not. Read the amount out of the second command and write it the way a person would: two decimal places, no currency symbol.

Where this capture is taught

Every module below practices on this exact capture.

Decode your own bytes

Other capturesMastercard contactless, full session EMV contact transaction Mastercard business card Visa debit