> For the complete documentation index, see [llms.txt](https://mtools.gitbook.io/pn532killer/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mtools.gitbook.io/pn532killer/sniffer.md).

# Sniffer overview

PN532Killer provides capture workflows for supported RFID research and authorized security testing.

## Choose a workflow

| Workflow      | Original tag present | Typical output                                        |
| ------------- | -------------------- | ----------------------------------------------------- |
| MFKey32v2     | No                   | Multiple MIFARE Classic authentication records        |
| MFKey64       | Yes                  | Complete authentication records for offline analysis  |
| Static Nested | Yes                  | Nonces for a supported static-nonce recovery workflow |

## General capture procedure

1. Obtain explicit authorization and define the reader and tag in scope.
2. Clear or export old capture data so sessions are not mixed.
3. Select the correct Sniffer type.
4. Position PN532Killer as described for that workflow.
5. Trigger only the authorized authentication attempts.
6. Exit Sniffer mode normally to save records.
7. Transfer the records to supported software for analysis.

Capture results can contain access credentials. Treat them as secrets and delete them when the authorized assessment is complete.