forked from cclabsInc/RFCrack
-
Notifications
You must be signed in to change notification settings - Fork 0
/
README
81 lines (65 loc) · 3.58 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
___ _ ___ _
/ __|___ _ _ ___ ___| |___ / __|_____ __ _| |__ ___ _ _ ___
| (__/ _ \ ' \(_-</ _ \ / -_) | (__/ _ \ V V / '_ \/ _ \ || (_-<
\___\___/_||_/__/\___/_\___| \___\___/\_/\_/|_.__/\___/\_, /__/
|__/
___ ___ ___ _
___ | _ \ __/ __|_ _ __ _ __| |__
|___| | / _| (__| '_/ _` / _| / /
|_|_\_| \___|_| \__,_\__|_\_\
Welcome to RFCrack - A Software Defined Radio Attack Tool
Developer: @Ficti0n - CCLabs.io / ConsoleCowboys.com
Blog: console-cowboys.blogspot.com
YouTube Tutorial: https://www.youtube.com/watch?v=H7-g15YZBiI
Release: 1.0
RFCrack is my personal RF test bench, it was developed for testing RF communications
between any physical device that communicates over sub Ghz frequencies. IoT devices,
Cars, Alarm Systems etc... Testing was done with the Yardstick One on OSX, but
RFCrack should work fine in linux. Support for other RF related testing will be
added as needed in my testing. I am currently researching keyless Entry bypasses.
Keyless entry functionality will be added in the future with additional hardware
requirements for advanced attacks.
Feel free to use this software as is for personal use only. Do not use this code
in other projects or in commercial products. I hold no liability for your actions
with this code. Your life choices are your own.
Current supported Functionality:
---------------------------------
- Replay attacks -i -F
- Send Saved Payloads -s -u
- Rolling code bypass attacks -r -F -M
- Targeted -t -F
- Jamming -j -F
- Scanning incrementally through frequencies -b -v -F
- Scanning common frequencies -k
Future Functionality(Currently Researching)
-------------------------------------------
- Keyless Entry/EngineStart bypass with SDR
- Any Suggestions based on realistic use-cases you want me to add??
- Add in more configuration for changing timing and logging
Usage Examples:
---------------
Live Replay: python RFCrack.py -i
Rolling Code: python RFCrack.py -r -M MOD_2FSK -F 314350000
Adjust RSSI Range: python RFCrack.py -r -U "-75" -L "-5" -M MOD_2FSK -F 314350000
Jamming: python RFCrack.py -j -F 314000000
Scan common freq: python RFCrack.py -k
Scan with your list: python RFCrack.py -k -f 433000000 314000000 390000000
Incremental Scan: python RFCrack.py -b -v 5000000
Send Saved Payload:: python RFCrack.py -s -u ./files/test.cap -F 315000000 -M MOD_ASK_OOK
Useful arguments:
------------------------
-M Change modulation, usually MOD_2FSK or MOD_ASK_OOK
-F Change the frequency used in attacks
-U upper_rssi signal strength value for rolling Code
-L lower.rssi signal strength value for rolling code
-a Jamming frequency variance from sniffer
-s Send packet from a file source
Other Notes:
------------------------
Captures get saved to ./files directory by default!
Rolling code is hit or miss due to its nature with jamming and sniffing at the same time,
but it works. Just use the keyfob near the yardsticks. It will also require 2 yardsticks,
one for sniffing while the other one is jamming.
And a final note, this is my own test bench for doing research and dev, if you have ideas
to make it better based on realistic use case scenarios, feel free to reach out to me.
Right now I am working on keyless entry attacks which I will implement into this later.