Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion scripts/seed-tools.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ const tools = [
},
{
slug: 'alfa-awus036ach', name: 'ALFA AWUS036ACH', vendor: 'Alfa Network', type: 'hardware',
protocols: ['Wi-Fi'], homepage: 'https://alfa-network.com/products/awus036ach',
protocols: ['Wi-Fi'], homepage: 'https://www.alfa.com.tw/products/awus036ach_1',
software: ['aircrack-ng', 'bettercap', 'wireshark'],
note: 'RTL8812AU dual-band Wi-Fi adapter with monitor mode and injection, the workhorse 802.11 capture/injection radio for surveys and handshake capture.',
},
Expand Down
2 changes: 1 addition & 1 deletion src/content/controls/rfsam-ble-cr-01.md
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ references:
authors: 'D. Antonioli, N. O. Tippenhauer, K. Rasmussen'
venue: 'ACM Transactions on Privacy and Security (TOPS), Vol. 23, No. 3'
year: 2020
url: 'https://francozappa.github.io/publication/knob-ble/paper.pdf'
url: 'https://francozappa.github.io/publication/2020/knob-ble/paper.pdf'
type: paper
- key: cve-2019-9506
title: 'CVE-2019-9506: Bluetooth encryption key negotiation (KNOB)'
Expand Down
4 changes: 2 additions & 2 deletions src/content/controls/rfsam-subg-cr-01.md
Original file line number Diff line number Diff line change
Expand Up @@ -114,9 +114,9 @@ references:
- key: indesteege2008keeloq
title: 'A Practical Attack on KeeLoq'
authors: 'S. Indesteege, N. Keller, O. Dunkelman, E. Biham, B. Preneel'
venue: EUROCRYPT 2008 (KU Leuven COSIC project page)
venue: EUROCRYPT 2008 (IACR archive)
year: 2008
url: 'https://www.cosic.esat.kuleuven.be/keeloq/'
url: 'https://www.iacr.org/archive/eurocrypt2008/49650001/49650001.pdf'
type: paper
- key: benadjila2017hitag2
title: 'One Car, Two Frames: Attacks on Hitag-2 Remote Keyless Entry Systems Revisited'
Expand Down
6 changes: 3 additions & 3 deletions src/content/controls/rfsam-wifi-sp-01.md
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,8 @@ references:
- key: radiotap
title: 'Radiotap: the de facto standard header for 802.11 frame injection and reception'
authors: D. Young et al.
venue: radiotap.org
url: 'https://www.radiotap.org/'
venue: Linux wireless documentation (kernel.org)
url: 'https://wireless.docs.kernel.org/en/latest/en/developers/documentation/radiotap.html'
type: spec
- key: wireshark-wlan
title: 'CaptureSetup/WLAN: capturing 802.11 traffic and enabling monitor mode'
Expand Down Expand Up @@ -96,7 +96,7 @@ references:
title: 'WPA3 Specification: 6 GHz band constraints (WPA3/OWE only, PMF mandatory, no transition mode)'
authors: Wi-Fi Alliance
venue: Wi-Fi Alliance
url: 'https://www.wi-fi.org/system/files/WPA3%20Specification%20v3.4.pdf'
url: 'https://www.wi-fi.org/file/wpa3-specification'
type: spec
tools:
- kismet
Expand Down
2 changes: 1 addition & 1 deletion src/content/tools/alfa-awus036ach.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ vendor: Alfa Network
type: hardware
protocols:
- Wi-Fi
homepage: 'https://alfa-network.com/products/awus036ach'
homepage: 'https://www.alfa.com.tw/products/awus036ach_1'
software:
- aircrack-ng
- bettercap
Expand Down
3 changes: 2 additions & 1 deletion src/content/tools/quectel-rm500q.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@ type: hardware
protocols:
- 5G NR
spec: 5G NR Sub-6 (FR1) module · Qualcomm Snapdragon X55 (SDX55) · NSA/SA
homepage: 'https://www.quectel.com/product/5g-rm500q-gl/'
homepage: >-
https://web.archive.org/web/20220214114911/https://www.quectel.com/product/5g-rm500q-gl
software:
- qcsuper
note: >-
Expand Down
2 changes: 1 addition & 1 deletion src/data/protocol-tools/nr5g.json
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,5 @@
{ "slug": "5gsniffer", "name": "5GSniffer", "vendor": "Sprite Lab (Northeastern University)", "type": "software", "protocols": ["5G NR"], "note": "Open-source 5G NR Physical Downlink Control Channel (PDCCH) blind decoder: passively recovers the Downlink Control Information (DCI) and the RNTIs active in a cell, exposing scheduling/identity activity for traffic analysis. Written in C++ on srsRAN libraries; FDD, FR1 sub-6 GHz. Research-grade, the current release recommends working from a recorded I/Q file rather than live SDR, and live capture needs extra setup.", "repo": "https://github.com/spritelab/5GSniffer" },
{ "slug": "sni5gect", "name": "Sni5Gect", "vendor": "ASSET Research Group (SUTD)", "type": "software", "protocols": ["5G NR"], "spec": "USRP B210/X310 · Ubuntu 22.04 · 12-core/16 GB host", "note": "Open-source 5G NR sniffer and downlink injector framework built on srsRAN. Passively captures unencrypted MAC-NR messages between a gNB and a UE (with Wireshark support) and can inject crafted MAC-NR packets to a target at specific post-connection states (registration/authentication/RRC), used for modem crashes, downgrades, fingerprinting and auth-bypass research without a rogue base station. Heavy host requirements; FR1 sub-6 GHz on a USRP.", "repo": "https://github.com/asset-group/Sni5Gect-5GNR-sniffing-and-exploitation", "homepage": "https://sni5gect.com" },
{ "slug": "5ghoul", "name": "5Ghoul", "vendor": "ASSET Research Group (SUTD)", "type": "software", "protocols": ["5G NR"], "note": "5G NR attack and fuzzing suite that disrupts COTS smartphones (Qualcomm, MediaTek basebands) from a malicious gNB: a set of pre-authentication RRC/NAS vulnerabilities plus a 5G fuzzer, run on top of an OpenAirInterface gNB. For authorised, RF-contained testing of a UE's resilience to a hostile base station.", "repo": "https://github.com/asset-group/5ghoul-5g-nr-attacks", "homepage": "https://5ghoul.com" },
{ "slug": "quectel-rm500q", "name": "Quectel RM500Q-GL", "vendor": "Quectel", "type": "hardware", "protocols": ["5G NR"], "spec": "5G NR Sub-6 (FR1) module · Qualcomm Snapdragon X55 (SDX55) · NSA/SA", "homepage": "https://www.quectel.com/product/5g-rm500q-gl/", "software": ["qcsuper"], "note": "Commercial 5G NR Sub-6 (FR1) modem module built on the Qualcomm Snapdragon X55 (SDX55). Being Qualcomm-based it exposes a DIAG interface, so QCSuper can pull raw 5G/LTE signalling off it into Wireshark, a no-SDR route to 5G control-plane frames (5G frame coverage is modem/firmware-dependent)." }
{ "slug": "quectel-rm500q", "name": "Quectel RM500Q-GL", "vendor": "Quectel", "type": "hardware", "protocols": ["5G NR"], "spec": "5G NR Sub-6 (FR1) module · Qualcomm Snapdragon X55 (SDX55) · NSA/SA", "homepage": "https://web.archive.org/web/20220214114911/https://www.quectel.com/product/5g-rm500q-gl", "software": ["qcsuper"], "note": "Commercial 5G NR Sub-6 (FR1) modem module built on the Qualcomm Snapdragon X55 (SDX55). Being Qualcomm-based it exposes a DIAG interface, so QCSuper can pull raw 5G/LTE signalling off it into Wireshark, a no-SDR route to 5G control-plane frames (5G frame coverage is modem/firmware-dependent)." }
]
Loading