/wireless-rf

name: wireless-rf
description: Use when the target has a non-Wi-Fi radio attack surface — Bluetooth/BLE (GATT, pairing, KNOB/BIAS/BleedingTooth), Zigbee/Thread/Matter & Z-Wave mesh (Touchlink, S0 downgrade), LoRaWAN/Sub-GHz LPWAN, SDR capture/replay/rolljam, smart locks/medical/IoT radios. For Wi-Fi/WPA/evil-twin see network-attack.
metadata:
  type: offensive
  phase: exploitation
  tools: bettercap, bluetoothctl, hcitool, gatttool, bleak, crackle, Sniffle, Ubertooth, btlejack, KillerBee, zbstumbler, RfCat, HackRF, rtl_433, Universal-Radio-Hacker, gr-lora, Scapy-radio
  mitre: TA0009
kill_chain:
  phase: [recon, exploit, actions]
  step: [1, 4, 7]
  attck_tactics: [TA0043, TA0001, TA0006, TA0009, TA0040]
  attck_techniques: [T1200, T1040, T1557, T1011, T1011.001, T1592, T1602]
depends_on: [recon-osint]
feeds_into: [network-attack, mobile-pentest, reverse-engineering, exploit-development]
inputs: [rf_target_inventory, device_class, radio_captures]
outputs: [recovered_keys, replayed_commands, sniffed_traffic, device_control, firmware_pull_hints]
references:
  - references/bluetooth.md
  - references/mesh-iot-radio.md
  - references/lpwan-subghz.md
scripts:
  - scripts/rf_recon.sh

Wireless / RF (non-Wi-Fi radio)

Radio attack surface **beyond Wi-Fi**: Bluetooth (BLE + Classic), 802.15.4 mesh (Zigbee/Thread/Matter), Z-Wave, and LPWAN/Sub-GHz (LoRaWAN, ISM rolling-code / OOK-ASK). For Wi-Fi, WPA2/WPA3, evil-twin and 802.1X, use `network-attack` (`references/wireless-attacks.md`, which also now carries KRACK/FragAttacks and WPS). Adapted in part from Claude-Red (MIT, Kai Aizen/SnailSploit) — see `THIRD-PARTY-NOTICES.md`.

When to Activate

• Auditing a **BLE** device (smart lock, wearable, medical, tracker): GATT enumeration, unauthenticated

characteristic R/W, pairing-mode identification, LTK recovery, sniffing, companion-app RE.

• **Bluetooth Classic** targets: encryption-key entropy downgrade (KNOB), impersonation (BIAS), BlueZ/stack

memory-corruption (BlueBorne / BleedingTooth).

• **Zigbee / Thread / Matter / Z-Wave** home/building automation: Touchlink commissioning abuse, key

transport in the clear, S0 key-exchange downgrade, replay/AiTM on mesh commands.

• **LoRaWAN / Sub-GHz**: join-accept / uplink replay, ABP counter & nonce reuse, and generic ISM

capture→replay / rolljam of OOK-ASK remotes (garage, gate, some auto keyfobs).

• You have (or can request) the right radio: a dual-mode BT adapter + BLE sniffer (Sniffle/Ubertooth),

a KillerBee-supported 802.15.4 stick, an RfCat dongle (CC1111), and/or an SDR (RTL-SDR, HackRF).

• **STOP if the RF target or its band is out of scope.** RF is trivially cross-boundary (you will hear

neighbours). Confirm `scope.json` and the physical/RF authorization before transmitting. Jamming, deauth-style disruption, and replay against safety/medical systems can be illegal and dangerous — see OPSEC & Detection.

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | BLE GATT enum + unauth characteristic R/W | T1040 / T1592 | CWE-306 | references/bluetooth.md | scripts/rf_recon.sh | | BLE LE-Legacy Just-Works LTK recovery (crackle) | T1557 | CWE-322 | references/bluetooth.md | - | | BLE sniffing / active MITM (Sniffle/btlejack) | T1040 / T1557 | CWE-319 | references/bluetooth.md | scripts/rf_recon.sh | | BT Classic key-entropy downgrade (KNOB, CVE-2019-9506) | T1557 | CWE-326 | references/bluetooth.md | - | | BT Classic impersonation (BIAS, CVE-2020-10135) | T1557 | CWE-287 | references/bluetooth.md | - | | BlueZ/stack RCE (BleedingTooth CVE-2020-12351/12352) | T1200 | CWE-787 | references/bluetooth.md | - | | Bluetooth data exfiltration | T1011.001 | CWE-319 | references/bluetooth.md | - | | Zigbee Touchlink commissioning abuse / reset | T1557 | CWE-284 | references/mesh-iot-radio.md | scripts/rf_recon.sh | | Zigbee/ZLL key transport in clear + replay | T1040 / T1557 | CWE-319 | references/mesh-iot-radio.md | scripts/rf_recon.sh | | Z-Wave S0 key-exchange downgrade ("Z-Shave") | T1557 | CWE-757 | references/mesh-iot-radio.md | - | | LoRaWAN join-accept / uplink replay | T1602 | CWE-294 | references/lpwan-subghz.md | - | | LoRaWAN ABP counter / nonce reuse | T1040 | CWE-323 | references/lpwan-subghz.md | - | | Sub-GHz OOK-ASK capture→replay / rolljam | T1557 | CWE-294 | references/lpwan-subghz.md | scripts/rf_recon.sh |

Quick Start

# 0. AUTHORIZATION FIRST — confirm the RF target/band is in scope (RF crosses walls).
python3 ../coding-mastery/scripts/_lib/scope_guard.py --target "<device-id-or-mac>" || exit 3

# 1. BLE recon: discover, enumerate GATT, flag unauthenticated writable characteristics
sudo bash scripts/rf_recon.sh ble-scan
sudo bash scripts/rf_recon.sh ble-enum <BD_ADDR>      # services/characteristics + R/W perms

# 2. BLE pairing/crypto: identify pairing method; LE-Legacy Just Works -> crackle recovers LTK
#    (capture pairing with Sniffle/Ubertooth to a pcap, then:)
crackle -i pairing.pcap                                # LTK/STK if LE Legacy

# 3. 802.15.4 mesh recon (KillerBee): find Zigbee networks + channel
sudo bash scripts/rf_recon.sh zb-scan                  # zbstumbler across channels 11-26

# 4. Sub-GHz capture -> analyze -> replay (RfCat / SDR). rtl_433 first to fingerprint.
sudo bash scripts/rf_recon.sh subghz-id                 # rtl_433 protocol/mod fingerprint
#    then capture+replay in Universal Radio Hacker (URH), watching for rolling codes.

OPSEC & Detection (summary)

| Technique | Telemetry / IOC | Detection | OPSEC / legal note | |-----------|-----------------|-----------|--------------------| | BLE scan/enum | connectable advertising probes; repeated GATT connects | BLE WIDS (rare); app-side connection anomaly | passive `hcitool lescan`/Sniffle is quiet; enumeration is a normal client action | | BLE MITM / LTK recovery | cloned advertiser; a 2nd device holding the connection | duplicate BD_ADDR; RSSI/2-radio