This tool is a modified version of scapy that aims at providing an quick and efficient pentest tool with RF capabilities.
It includes:
- A modified version of scapy that can leverage GNU Radio to handle a SDR card
- GNU Radio flow graphs (GRC files) we have build that allows full duplex communication
- GNU Radio blocks we have written to handle several protocols
- Bluetooth LE (advertising only)
- 802.15.4 (used by Zigbee and 6LoWPAN)
- ZWave (European frequency, 868MHz)
- Sigfox (European frequency, 868MHz)
- W-MBus (European frequency, 868MHz)
You need to have a full working GNU Radio 3.7 installation.
Note: It has only been tested with GNU Radio 3.7.5 so far.
The provided GRC files have been fully tested with an Ettus B210 SDR but they should work just as fine with any other UHD compatible device.
You can also edit the GRC files to replace UHD Sink/Source blocks by the corresponding Osmocom blocks. Don't forget to set the parameters correctly.
Note: Unless the installation path is modified, the extra blocks we have
written will be installed into /usr/local/share/gnuradio/grc/blocks
, you
must therefore first set local_blocks_path in grc.conf with this path.
Beforehand, the following dependencies must also be installed:
- gnuradio-dev
- libboost-dev
- liblog4cpp5-dev
- lib-uhd-dev
- doxygen
- swig
- cmake
Then, if you want to install everything, just launch:
$ ./install.sh
The script will prompt you for your password to install the tools system-wide
using sudo
command.
Usage:
$ ./install.sh [blocks|grc|scapy] ...
This will build all the extra blocks we have written for GNU Radio and install
them into /usr/local/share/gnuradio/grc/blocks
.
This will copy all the GRC files into $HOME/.scapy/radio/
and it will also
convert them automatically into Python files using grcc
command.
This will install or update scapy installation. This option is useful when you have added/modified layers and want to make them available in your system
The tool can be launched by using the following command:
$ scapy-radio
One in the scapy interactive shell, switching between radio protocols is as simple as:
>>> switch_radio_protocol("zwave")
You can also specify the radio protocol directly to some "radio-enabled" functions:
>>> sniff_radio(radio="zwave")
switch_radio_protocol(layer, *args, **kargs)
: change the current radio protocolsniffradio(opened_socket=None, radio=None, *args, **kargs)
: works likesniff()
srradio(pkts, inter=0.1, *args, **kargs)
: works likesr()
srradio1(pkts, *args, **kargs)
: works likesr1()
gnuradio_get_vars(*args, **kargs)
: get variables for the running GRCgnuradio_set_vars(host="localhost", port=8080, **kargs)
: set variable for the running GRCgnuradio_start_graph(host="localhost", port=8080)
: resume the running GRCgnuradio_stop_graph(host="localhost", port=8080)
: pause the running GRC
The tool allows writing and reading back PCAP files with the usual scapy
command:
>>> wrpcap("pcap-file.pcap", pkts)
>>> pkts2 = rdpcap("pcap-file.pcap")
This script is a scapy Automaton that will send a switch off ZWave packet each times it listens a switch on ZWave packet.
The script has been used to successfully disable a ZWave siren alarm automatically.
This script intends to passively scan and map ZWave automation network.