# Offensive Lorawan Sub Ghz

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology, LoRaWAN ABP/OTAA join...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-lorawan-sub-ghz -g -a gemini-cli -y`

## Description

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology, LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# LoRaWAN & Sub-GHz Attacks

LoRaWAN provides long-range low-bitrate communication for IoT, common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS, most with weak or no crypto.

## Quick Workflow

1. Identify the band + modulation (LoRa CSS vs. simple OOK/FSK)
2. Capture transmissions with appropriate hardware (HackRF / RTL-SDR / Flipper Zero)
3. For LoRaWAN: capture join + uplinks; analyze key derivation
4. For proprietary sub-GHz: demodulate, identify packet format, replay or craft

---

## Hardware

| Tool | Range | Use |
|---|---|---|
| RTL-SDR | RX only, 24 MHz, 1.7 GHz | Cheap reconnaissance |
| HackRF One | RX/TX, 1 MHz, 6 GHz | Full transceiver |
| Flipper Zero | RX/TX, sub-GHz | Quick replays, fixed-code attacks |
| LimeSDR / BladeRF | RX/TX, wider band | Higher fidelity for LoRaWAN |
| YARD Stick One | TX-focused sub-GHz | Targeted replays |
| LoRa-specific gateway (RAK / Heltec) | LoRaWAN dual-direction | Standards-compliant LoRaWAN testing |

## LoRaWAN

LoRaWAN is a MAC layer over LoRa physical (chirp spread spectrum). Devices either:
- **OTAA** (Over-the-Air Activation), derive session keys at join
- **ABP** (Activation By Personalization), pre-flashed keys

### OTAA Join Capture

```bash
# Capture LoRa packets with HackRF + Inspectrum
hackrf_transfer -r capture.iq -f 868000000 -s 1000000 -n 60000000
# Or LoRa-specific: rak_common_for_gateway

# Decode with PHY + MAC stack
git clone https://github.com/Lora-net/LoRaMac-node
# Or use ChirpStack as a sniffing gateway
```

The Join-Request and Join-Accept are encrypted with the device's AppKey. With AppKey (extracted from device firmware, see `offensive-iot`):

- Decrypt Join-Accept → recover NwkSKey, AppSKey
- Subsequent traffic decryption + injection

### ABP, Pre-Flashed Keys

ABP devices have NwkSKey + AppSKey flashed at manufacture. Common flaws:

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/wireless/offensive-lorawan-sub-ghz/SKILL.md