offensive-lorawan-sub-ghz

# LoRaWAN & Sub-GHz Attacks LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS — most with weak or no crypto. ## Quick Workflow 1. Identify the band + modulation (LoRa CSS vs. simple OOK/FSK) 2. Capture transmissions with appropriate hardware (HackRF / RTL-SDR / Flipper Zero) 3. For LoRaWAN: capture join + uplinks; analyze key derivation 4. For proprietary sub-GHz: demodulate, identify packet format, replay or craft --- ## Hardware | Tool | Range | Use | |---|---|---| | RTL-SDR | RX only, 24 MHz–1.7 GHz | Cheap reconnaissance | | HackRF One | RX/TX, 1 MHz–6 GHz | Full transceiver | | Flipper Zero | RX/TX, sub-GHz | Quick replays, fixed-code attacks | | LimeSDR / BladeRF | RX/TX, wider band | Higher fidelity for LoRaWAN | | YARD Stick One | TX-focused sub-GHz | Targeted replays | | LoRa-specific gateway (RAK / Heltec) | LoRaWAN dual-direction | Standards-compliant LoRaWAN testing | ## LoRaWAN LoRaWAN is a MAC layer over LoRa physical (chirp spread spectrum). Devices either: - **OTAA** (Over-the-Air Activation) — derive session keys at join - **ABP** (Activation By Personalization) — pre-flashed keys ### OTAA Join Capture ```bash # Capture LoRa packets with HackRF + Inspectrum hackrf_transfer -r capture.iq -f 868000000 -s 1000000 -n 60000000 # Or LoRa-specific: rak_common...