Most GNU Radio modules focus on the physical layer and less on creating standard compliant data payloads. In this talk, we'll show how easy it is to combine GNU Radio implementations of WLAN and ZigBee with Scapy, a powerful interactive packet manipulation program. Using Scapy, we can quickly craft our own packets and poke at other stations (e.g., by sending deauths) or fuzzing its network stack (e.g, to test an IoT device).
Most GNU Radio modules focus on the physical layer and less on creating standard compliant data payloads. In this talk, we'll show how easy it is to combine GNU Radio implementations of WLAN and ZigBee with Scapy, a powerful interactive packet manipulation program. Using Scapy, we can quickly craft packets that encapsulate protocols from the whole network stack, including WLAN, ZigBee, and higher layers like IP and TCP. Thanks to GNU Radio's socket interface, we can forward these packets into the flow graph and send them out through our PHY. With this setup, it becomes trivial to broadcast WLAN beacons, deauth WLAN devices, or even fuzz protocols by sending frames with randomized, not necessarily standard compliant data. The latter is possible, since Scapy allows to fill all fields of a protocol header that are not explicitly set with random data. This might trigger all kinds of interesting behavior.
Speakers: Bastian Bloessl