wireless-rf

# Wireless / RF (non-Wi-Fi radio) Radio attack surface **beyond Wi-Fi**: Bluetooth (BLE + Classic), 802.15.4 mesh (Zigbee/Thread/Matter), Z-Wave, and LPWAN/Sub-GHz (LoRaWAN, ISM rolling-code / OOK-ASK). For Wi-Fi, WPA2/WPA3, evil-twin and 802.1X, use `network-attack` (`references/wireless-attacks.md`, which also now carries KRACK/FragAttacks and WPS). Adapted in part from Claude-Red (MIT, Kai Aizen/SnailSploit) — see `THIRD-PARTY-NOTICES.md`. ## When to Activate - Auditing a **BLE** device (smart lock, wearable, medical, tracker): GATT enumeration, unauthenticated characteristic R/W, pairing-mode identification, LTK recovery, sniffing, companion-app RE. - **Bluetooth Classic** targets: encryption-key entropy downgrade (KNOB), impersonation (BIAS), BlueZ/stack memory-corruption (BlueBorne / BleedingTooth). - **Zigbee / Thread / Matter / Z-Wave** home/building automation: Touchlink commissioning abuse, key transport in the clear, S0 key-exchange downgrade, replay/AiTM on mesh commands. - **LoRaWAN / Sub-GHz**: join-accept / uplink replay, ABP counter & nonce reuse, and generic ISM capture→replay / rolljam of OOK-ASK remotes (garage, gate, some auto keyfobs). - You have (or can request) the right radio: a dual-mode BT adapter + BLE sniffer (Sniffle/Ubertooth), a KillerBee-supported 802.15.4 stick, an RfCat dongle (CC1111), and/or an SDR (RTL-SDR, HackRF). - **STOP if the RF target or its band is out of scope.** RF is trivially cross-boundary (you will hear neighbo...