Use when the target has a non-Wi-Fi radio attack surface — Bluetooth/BLE (GATT, pairing, KNOB/BIAS/BleedingTooth), Zigbee/Thread/Matter & Z-Wave mesh (Touchlink, S0 downgrade), LoRaWAN/Sub-GHz LPWAN, SDR capture/replay/rolljam, smart locks/medical/IoT radios. For Wi-Fi/WPA/evil-twin see network-attack.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Radio attack surface beyond Wi-Fi: Bluetooth (BLE + Classic), 802.15.4 mesh (Zigbee/Thread/Matter),
Z-Wave, and LPWAN/Sub-GHz (LoRaWAN, ISM rolling-code / OOK-ASK). For Wi-Fi, WPA2/WPA3, evil-twin and
802.1X, use network-attack (references/wireless-attacks.md, which also now carries KRACK/FragAttacks
and WPS). Adapted in part from Claude-Red (MIT, Kai Aizen/SnailSploit) — see THIRD-PARTY-NOTICES.md.
scope.json and the physical/RF authorization before transmitting. Jamming,
deauth-style disruption, and replay against safety/medical systems can be illegal and dangerous —
see OPSEC & Detection.| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| BLE GATT enum + unauth characteristic R/W | T1040 / T1592 | CWE-306 | references/bluetooth.md | scripts/rf_recon.sh |
| BLE LE-Legacy Just-Works LTK recovery (crackle) | T1557 | CWE-322 | references/bluetooth.md | - |
| BLE sniffing / active MITM (Sniffle/btlejack) | T1040 / T1557 | CWE-319 | references/bluetooth.md | scripts/rf_recon.sh |
| BT Classic key-entropy downgrade (KNOB, CVE-2019-9506) | T1557 | CWE-326 | references/bluetooth.md | - |
| BT Classic impersonation (BIAS, CVE-2020-10135) | T1557 | CWE-287 | references/bluetooth.md | - |
| BlueZ/stack RCE (BleedingTooth CVE-2020-12351/12352) | T1200 | CWE-787 | references/bluetooth.md | - |
| Bluetooth data exfiltration | T1011.001 | CWE-319 | references/bluetooth.md | - |
| Zigbee Touchlink commissioning abuse / reset | T1557 | CWE-284 | references/mesh-iot-radio.md | scripts/rf_recon.sh |
| Zigbee/ZLL key transport in clear + replay | T1040 / T1557 | CWE-319 | references/mesh-iot-radio.md | scripts/rf_recon.sh |
| Z-Wave S0 key-exchange downgrade ("Z-Shave") | T1557 | CWE-757 | references/mesh-iot-radio.md | - |
| LoRaWAN join-accept / uplink replay | T1602 | CWE-294 | references/lpwan-subghz.md | - |
| LoRaWAN ABP counter / nonce reuse | T1040 | CWE-323 | references/lpwan-subghz.md | - |
| Sub-GHz OOK-ASK capture→replay / rolljam | T1557 | CWE-294 | references/lpwan-subghz.md | scripts/rf_recon.sh |
# 0. AUTHORIZATION FIRST — confirm the RF target/band is in scope (RF crosses walls).
python3 ../coding-mastery/scripts/_lib/scope_guard.py --target "<device-id-or-mac>" || exit 3
# 1. BLE recon: discover, enumerate GATT, flag unauthenticated writable characteristics
sudo bash scripts/rf_recon.sh ble-scan
sudo bash scripts/rf_recon.sh ble-enum <BD_ADDR> # services/characteristics + R/W perms
# 2. BLE pairing/crypto: identify pairing method; LE-Legacy Just Works -> crackle recovers LTK
# (capture pairing with Sniffle/Ubertooth to a pcap, then:)
crackle -i pairing.pcap # LTK/STK if LE Legacy
# 3. 802.15.4 mesh recon (KillerBee): find Zigbee networks + channel
sudo bash scripts/rf_recon.sh zb-scan # zbstumbler across channels 11-26
# 4. Sub-GHz capture -> analyze -> replay (RfCat / SDR). rtl_433 first to fingerprint.
sudo bash scripts/rf_recon.sh subghz-id # rtl_433 protocol/mod fingerprint
# then capture+replay in Universal Radio Hacker (URH), watching for rolling codes.
| Technique | Telemetry / IOC | Detection | OPSEC / legal note |
|---|---|---|---|
| BLE scan/enum | connectable advertising probes; repeated GATT connects | BLE WIDS (rare); app-side connection anomaly | passive hcitool lescan/Sniffle is quiet; enumeration is a normal client action |
| BLE MITM / LTK recovery | cloned advertiser; a 2nd device holding the connection | duplicate BD_ADDR; RSSI/2-radio anomaly | LE Legacy Just Works is the weak path; LE Secure Connections (ECDH) defeats crackle |
| KNOB / BIAS (Classic) | renegotiated low-entropy key; unexpected re-pair | patched stacks reject 1-byte entropy / require MITM-protection | needs proximity + a window; patched hosts (post-2019/2020) mitigate |
| BleedingTooth / BlueBorne | target BlueZ/stack crash or reboot | crash telemetry; kernel/stack patch level | memory-corruption = crash/DoS risk; lab-validate, get written sign-off |
| Zigbee Touchlink / key-in-clear | Touchlink scan/identify; devices leaving/rejoining | 802.15.4 IDS (rare); coordinator join logs | Touchlink range abuse can factory-reset lights building-wide — scope tight |
| Z-Wave S0 downgrade | S0 key-exchange when S2 expected | controller S2 bootstrap logs | needs presence during (re)pairing; S2 defeats it |
| LoRaWAN replay | duplicate frame counters at the NS; join floods | NS frame-counter monitoring; join-nonce checks | 1.0.x is weaker than 1.1; downlink replay can toggle actuators |
| Sub-GHz replay / rolljam | jamming energy in-band + delayed replay | RF spectrum monitoring (rare on ISM) | jamming is illegal in most jurisdictions; rolljam defeats rolling codes but needs jam+capture — explicit authorization only |
network-attack (references/wireless-attacks.md).reverse-engineering; mobile app pairing logic → mobile-pentest.scope-discipline before transmitting; finding-discipline before any [CONFIRMED]
(an advertised characteristic is not impact — you must read/write it or recover the key). Authorized only (TERMS.md).No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
The English summary is being prepared. Showing the original description.
Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
The English summary is being prepared. Showing the original description.
Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
The English summary is being prepared. Showing the original description.
Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains
The English summary is being prepared. Showing the original description.
Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance
The English summary is being prepared. Showing the original description.
Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse
The English summary is being prepared. Showing the original description.