Hardware tag characterization is one of the most critical steps in RFID and zeropower IoT development flow. However, the measurement process and its respective setup can be long and cumbersome. This paper describes how to use basic but uncharted VNA modes to yield simple, fast and flexible measurements without any spectrum analyser, SDR, oscilloscope, or anechoic chamber. A simple case study is presented, with transponders that are based on simple rotating scatterers. They are handcrafted from metallic tape, so they can be easily replicated by enthusiastic researchers. The VNA allows to estimate both magnitude and phase of frequency components around the illuminating carrier frequency (i.e. the intermodulations) backscattered by the transponder. It can also measure the modulated backscattered power as a function of the carrier frequency. These modes of operation can eventually be used to realize both identification and sensing of linear time-variant (LTV) transponders at a significant range.