Platform Note: This framework is designed and tested primarily on Linux (Debian/Ubuntu/Kali). Most hardware-dependent modules (wireless adapters, USB devices, raw socket access, firmware tools) require Linux. Running on Windows or macOS may cause errors or limited functionality in many modules. Linux is strongly recommended for maximum compatibility.
WirelessXPL-Forge
Modular wireless security research framework for 802.11 (WPA2/WPA3/WPE/EAPOL), Bluetooth Classic, BLE, Zigbee, RFID and ESP32 lab workflows — designed for authorised penetration testing, research, and education.
Version: 2.0.3 | License: BSD-3-Clause | Python: 3.8 - 3.13
Language: English (en-US) — default · Português (pt-BR): README.pt-BR.md
Instalacao / Installation
Basico / Basic (clone)
git clone https://github.com/mrhenrike/WirelessXPL-Forge.git
cd WirelessXPL-Forge
python3 -m pip install -r requirements.txt
cp pyproject.toml.example pyproject.toml # opcional — editable install
pip install -e ".[wifi]"
python wxf.py
pyproject.toml é local (não versionado no GitHub). Use o template pyproject.toml.example.
Por tecnologia / By technology (editable, após pyproject.toml local)
| Extra |
Tecnologia |
Pacotes incluidos |
Tamanho estimado |
[wifi] |
WiFi 802.11 (WPS, WPA, evil twin, PMKID...) |
scapy, dnslib, cryptography |
+45 MB |
[bt] |
Bluetooth BLE + Classic (KNOB, BLESA, GATT...) |
bleak, pybluez |
+8 MB |
[cellular] |
Celular / SIM / LTE / 5G (IMSI, SS7, SIMjacker...) |
pyscard, pytlv, pyserial |
+5 MB |
[rf] |
RF / SDR / SubGHz (RTL-SDR, replay, jam...) |
pyrtlsdr, pyserial, pyusb, numpy |
+50 MB |
[drone] |
Drones / UAV / MAVLink (skyjack, spoof, deauth...) |
pymavlink, dronekit |
+20 MB |
[ir] |
Infrared (blaster, replay...) |
pyserial, pyusb |
+3 MB |
[gps] |
GPS / Wardriving (GPSD, GPX export...) |
gpsd-py3, gpxpy |
+3 MB |
[iot] |
IoT / Zigbee / RFID (Killerbee, Zigator...) |
pyserial, pyusb |
+3 MB |
[all] |
Todos os extras acima |
(tudo acima) |
~135 MB |
# Exemplos (com pyproject.toml local):
pip install -e ".[wifi]"
pip install -e ".[wifi,bt,cellular]"
pip install -e ".[all]"
Nota: Ferramentas externas (aircrack-ng, hashcat, hcxdumptool) não são instaladas via pip.
Consulte PREREQUISITES.md para requisitos de hardware e software externos.
By technology (English)
Same extras as the table above; use pip install -e ".[wifi]" etc. after creating local pyproject.toml from pyproject.toml.example.
| Extra |
Technology |
Included packages |
Estimated size |
[wifi] |
WiFi 802.11 (WPS, WPA, evil twin, PMKID...) |
scapy, dnslib, cryptography |
+45 MB |
[bt] |
Bluetooth BLE + Classic (KNOB, BLESA, GATT...) |
bleak, pybluez |
+8 MB |
[cellular] |
Cellular / SIM / LTE / 5G (IMSI, SS7, SIMjacker...) |
pyscard, pytlv, pyserial |
+5 MB |
[rf] |
RF / SDR / SubGHz (RTL-SDR, replay, jam...) |
pyrtlsdr, pyserial, pyusb, numpy |
+50 MB |
[drone] |
Drones / UAV / MAVLink (skyjack, spoof, deauth...) |
pymavlink, dronekit |
+20 MB |
[ir] |
Infrared (blaster, replay...) |
pyserial, pyusb |
+3 MB |
[gps] |
GPS / Wardriving (GPSD, GPX export...) |
gpsd-py3, gpxpy |
+3 MB |
[iot] |
IoT / Zigbee / RFID (Killerbee, Zigator...) |
pyserial, pyusb |
+3 MB |
[all] |
All extras above |
(all above) |
~135 MB |
Note: External tools (aircrack-ng, hashcat, hcxdumptool) are not installed via pip.
See PREREQUISITES.md for hardware and external software requirements.
About
WirelessXPL-Forge (WXF) is an interactive shell and module framework for wireless security research. It provides:
- A Metasploit-like CLI (
use, set, run, search device=wifi) for wireless attack and analysis workflows
- Native Python modules for FragAttacks, KRACK, WPA3/Dragonblood, BLE pairing attacks, Braktooth, BlueBorne, AWDL, Zigbee/KillerBee, and more
- Bridge modules for external tools:
aircrack-ng, hcxdumptool, mdk4, wifiphisher, eaphammer, airgeddon, bettercap, btlejack, opendrop
- Serial orchestration for Bruce firmware (ESP32 Marauder) with semiautonomous flow profiles
- Upstream catalogs tracking incorporation of community issues/PRs across 15+ security research repos
- PCAP analysis pipelines: EAPOL 4-way, PMKID, TKIP, Dragonblood, WPE, BLE, PCAP SQL workspace
Siblings: RouterXPL-Forge (routers/switches) · FirewallXPL-Forge (NGFW/UTM, private)
Lineage: threat9/routersploit → RouterXPL-Forge → wireless fork
Maintainer: André Henrique (@mrhenrike) | União Geek
System prerequisites (host tools)
The Python package and its declared dependencies install from the repo clone. The table below lists host tools and firmware that are not bundled: they are normal OS-level installs (apt, brew, upstream installers).
| Tool |
Role |
| aircrack-ng suite |
aircrack-ng, airodump-ng, aireplay-ng — PCAP / wifi_lab workflows |
| hcxtools / hcxdumptool |
PMKID capture and hash conversion for hashcat |
| hashcat |
WPA2/WPA3 offline cracking (modes 22000/22001) |
| tshark (optional) |
BLE / 802.11 dissection when Scapy layers are thin |
| mdk4 / mdk3 (optional) |
Deauth storms, beacon floods, mesh flooding |
| hostapd + dnsmasq (optional) |
Rogue AP / evil-twin + DHCP/DNS for captive portal flows |
| wifiphisher (optional) |
Phishing via bridge (generic/external/wifiphisher_bridge) |
| eaphammer (optional) |
EAP/PEAP capture via bridge |
| airgeddon (optional) |
Menu-driven attacks via bridge |
| btlejack (optional) |
BLE sniff/jam/hijack via bridge |
| opendrop / owl (optional) |
AWDL/AirDrop lab via bridge |
| Bruce ESP32 firmware (optional) |
BruceDevices/firmware — device image; export PCAP to generic/pcap/* |
| pyserial (optional) |
Serial to Bruce (pip install -e ".[serial]" with local pyproject.toml) |
Run use generic/external/wireless_tool_prereq_audit after install to verify your PATH.
Quick Install
git clone https://github.com/mrhenrike/WirelessXPL-Forge.git
cd WirelessXPL-Forge
pip install -r requirements.txt
cp pyproject.toml.example pyproject.toml # local only — not on GitHub
pip install -e ".[wifi]"
python wxf.py
WSL2 / Kali (recommended for capture tools)
sudo apt install aircrack-ng hcxtools hcxdumptool mdk4 hostapd dnsmasq tshark
pip install -r requirements.txt
pip install -e ".[wifi]"
Quick Start
$ python wxf.py
wxf > help
wxf > show modules
wxf > search device=wifi
wxf > search device=bluetooth
wxf > use generic/wifi_lab/handshake_snooper
wxf (HandshakeSnooper) > show options
wxf (HandshakeSnooper) > set interface wlan0mon
wxf (HandshakeSnooper) > set target_bssid AA:BB:CC:DD:EE:FF
wxf (HandshakeSnooper) > run
Non-interactive (scripting)
python wxf.py -m generic/wifi_lab/handshake_snooper \
interface=wlan0mon target_bssid=AA:BB:CC:DD:EE:FF
Module Reference
Wi-Fi / 802.11 (generic/wifi_lab)
| Module |
Description |
fragattacks |
FragAttacks (CVE-2020-26140+) — frame injection + 802.11ax detection |
handshake_snooper |
PMKID-first + deauth handshake capture pipeline |
wpa3_attack_suite |
Dragonblood SAE flood, CSA+harvest, Double SSID, downgrade |
auth_flood |
Auth/EAPOL flood, amok mode, mesh flood (mdk4 backend) |
beacon_flood |
Beacon spam with custom SSIDs |
evil_twin_workflow |
Full evil-twin with verify-on-capture (aircrack-ng) |
captive_portal_modern_lab |
Modern captive portal with HTML/JS credential collector |
mitm_wifi_bridge |
ARP/DNS spoofing + Ghost combo (bettercap) |
adaptive_harvest |
Score-driven channel/PMKID adaptive harvesting |
wardriving_deauth_loop |
Automated wardriving scan/deauth/capture cycles |
wireless_ids |
Lightweight IDS: BSSID baseline + rogue AP detection |
awdl_attack |
AWDL/AirDrop (opendrop + owl) — discover, send, DoS |
momo_integrated_attack |
KARMA + PMKID-first + downgrade orchestration |
research_ecosystem_status |
Status of all research submodule integrations |
gps_wardriving_ndjson |
GPS NMEA → NDJSON wardriving log |
wifi_sniffer |
Multi-backend sniffer (tcpdump/scapy/tshark) |
PCAP Analysis (generic/pcap)
| Module |
Description |
pcap_handshake_extractor |
Extract WPA2 handshakes from capture |
pcap_eapol_survey |
EAPOL 4-way handshake survey and analysis |
pcap_pmkid_extractor |
PMKID extraction for offline cracking |
pcap_dragonblood |
WPA3 Dragonblood SAE PCAP patterns |
pcap_sql_workspace |
SQLite workspace for PCAP ingestion and analyst notes |
Bluetooth / BLE / Zigbee (generic/bluetooth)
| Module |
Description |
bt_hid_injection |
Bluetooth HID keyboard injection (Broadcom fallback) |
bt_baseband_attack |
BrakTooth / SweynTooth via ESP32 serial |
bt_session_attack |
KNOB, BIAS, BLUFFS session-layer attacks |
blueborne_attack |
BlueBorne L2CAP overflow (kernel offset profiles) |
ble_btlejack |
BTLEJack BLE sniff/jam/hijack |
ble_crackle |
BLE Legacy Pairing key recovery |
knob_native_cve_2019_9506 |
CVE-2019-9506 — BT BR/EDR key entropy downgrade para 1 byte |
zigbee_touchlink_factory_reset |
Zigbee ZLL Touchlink Factory Reset sem autenticação (Hue, TRADFRI) |
zigbee_network_key_extract |
novo v1.7.0 — Extração de Network Key Zigbee via decrypt de Transport Key com TC Link Key pública |
zigbee_rejoin_hijack |
novo v1.7.0 — Zigbee Rejoin Hijack: beacon spoof → desassociação → captura Transport Key |
ble_gatt_enum_unauth |
novo v1.7.0 — BLE GATT enumeration sem autenticação (serviços, características, writable handles) |
ble_spoofing_impersonation |
novo v1.7.0 — BLE device cloning via advertising data replay (nome, UUIDs, manufacturer data) |
IoT Protocols (generic/iot_proto) — novo v1.3.0+
| Module |
Description |
mqtt_broker_enum_inject |
MQTT — acesso anônimo, enumeração de tópicos e injeção de payload |
mqtt_lateral_pivot |
MQTT — pivot via broker para alcançar dispositivos IoT internos |
mqtt_broker_dos |
novo v1.7.0 — CVE-2017-7651 DoS por CONNECT/DISCONNECT cycling com LWT oversized |
mqtt_sys_acl_bypass_cve_2020_13849 |
novo v1.7.0 — CVE-2020-13849 Mosquitto ACL bypass via $SYS/# subscription |
coap_resource_enum |
CoAP — discovery .well-known/core + fator de amplificação UDP |
coap_block_overflow |
novo v1.7.0 — CVE-2019-9750 CoAP Block2 option heap overflow em stacks embarcados |
upnp_ssdp_attack |
UPnP/SSDP — descoberta de dispositivos + CVE-2020-12695 CallStranger SSRF |
upnp_ssdp_rce_inject |
novo v1.7.0 — CVE-2013-0229 SOAP action injection + AddPortMapping sem auth |
upnp_ssdp_amplification |
novo v1.7.0 — SSDP amplification/reflection 20-50x via spoofed M-SEARCH |
mdns_poisoning |
mDNS — enumeração passiva de serviços + envenenamento de respostas |
mdns_amplification |
novo v1.7.0 — mDNS amplification 5-30x via QTYPE=ANY queries (Bonjour/Avahi) |
dds_rtps_attack |
DDS/RTPS — enumeração de participantes ROS2/automotivo (unauthenticated R/W) |
tftp_firmware_attack |
TFTP — download/upload de firmware sem autenticação em dispositivos embarcados |
LoRaWAN (generic/lorawan) — novo v1.3.0
| Module |
Description |
lorawan_adr_bitflip_cve_2022_39274 |
CVE-2022-39274 — ADR bit-flip para degradação de sinal/DoS em end-devices |
lorawan_join_replay |
Join Accept Replay — session hijack por falta de replay protection (LoRaWAN 1.0.x) |
Automotive / CAN bus (generic/automotive) — novo v1.3.0+
| Module |
Description |
can_bus_attack |
CAN bus — enumeração ECU via OBD-II, fuzzing de IDs, UDS ECU reset, frame replay |
mercedes_mbux_bt_rce_cve_2023_37462 |
novo v1.7.0 — CVE-2023-37462 Mercedes MBUX NTG6 Bluetooth RCE (scan, info, probe) |
Z-Wave (generic/zwave) — novo v1.7.0
| Module |
Description |
zwave_s0_key_extract |
CVE-2019 — Z-Wave S0 pairing sniff: temp key all-zeros → network key extraction |
zwave_replay_attack |
Z-Wave command replay sem S2 (door_unlock, switch, thermostat) via SDR |
Bluetooth / BLE - WhisperPair (generic/bluetooth) - NEW v2.1.0
| Module |
Description |
whisperpair_fast_pair_cve_2025_36911 |
CVE-2025-36911 WhisperPair: Google Fast Pair pairing-mode bypass; scan for 0xFE2C devices + KBP injection + Account Key inject + BR/EDR MAC extraction |
Wearables BLE (generic/wearables) — novo v1.7.0
| Module |
Description |
xiaomi_miband_ble_breakmi |
Xiaomi Mi Band 3-7: advertising clone, auth key replay, biometric exfil (passos, HR, bateria) |
IoT Lateral Movement (generic/lateral_iot) — novo v1.3.0
| Module |
Description |
arp_spoof_iot_pivot |
ARP Spoofing — MitM entre dispositivos IoT e gateway para interceptação |
uart_shell_detect |
UART — detecção de console serial embarcado (multi-baud: 9600→921600) |
fake_dhcp_server |
Rogue DHCP — servidor desonesto para redirecionar tráfego IoT (gateway/DNS control) |
Wi-Fi Lab - SweynTooth BLE (generic/bluetooth/sweyntooth) - NEW v1.8.0
| Module |
Description |
sweyntooth_scanner |
Passive BLE scanner detecting SweynTooth-vulnerable firmware signatures |
sweyntooth_cve_2019_16336 |
CVE-2019-16336 - BLE Link Layer length overflow (Texas Instruments) |
sweyntooth_cve_2019_17517 |
CVE-2019-17517 - BLE data channel PDU overflow (Microchip) |
sweyntooth_cve_2019_17519 |
CVE-2019-17519 - BLE slave connection reject bypass (Dialog Semiconductor) |
sweyntooth_cve_2019_17520 |
CVE-2019-17520 - BLE public key crash on pairing (Telink) |
Wi-Fi / 802.11 - Mesh FragAttacks (generic/wifi/fragattacks) - NEW v2.1.0
| Module |
Description |
fragattacks_amsdu_mesh_cve_2025_27558 |
CVE-2025-27558 - FragAttacks A-MSDU mesh bypass: injects arbitrary packets into 802.11s mesh via crafted MSDU that bypasses the ad-hoc mitigation (companion: CVE-2025-38512 Linux patch) |
Wi-Fi Lab - FragAttacks (generic/wifi_lab/fragattacks) - NEW v1.8.0
| Module |
Description |
fragattacks_scanner |
Passive scanner detecting FragAttacks-vulnerable APs by beacon flags |
fragattacks_cve_2020_26140 |
CVE-2020-26140 - Plaintext data injection in non-strict WPA2 APs |
fragattacks_cve_2020_26141 |
CVE-2020-26141 - Fragment cache abuse / non-contiguous fragment injection |
fragattacks_cve_2020_26143 |
CVE-2020-26143 - Mixed plaintext/encrypted fragment acceptance |
Wi-Fi Lab - KRACK (generic/wifi_lab/krack) - NEW v1.8.0
| Module |
Description |
krack_scanner |
Passive scanner for KRACK nonce-reuse indicators (CVE-2017-13077..13088) |
krack_4way_retransmit |
CVE-2017-13077 - PTK reinstallation via Msg3 retransmission |
krack_group_key_retransmit |
CVE-2017-13080 - GTK reinstallation via group key handshake replay |
Wi-Fi Lab - Kr00k (generic/wifi_lab)
| Module |
Description |
wifi_kr00k_cve_2019_15126 |
CVE-2019-15126 KR00K: deauth + CCMP zero-TK decryption (Broadcom/Cypress chips) |
CVE / Exploits (generic/cve)
| Module |
Description |
zigbee_attack |
Zigbee / IEEE 802.15.4 via KillerBee (Sewio driver) |
krack_attack |
KRACK (WPA2 4-way replay + msg3 collection) |
ssid_confusion |
SSID Confusion attack |
pmkid_attack |
PMKID clientless attack |
Sub-GHz Attack Suite (generic/subghz) - NEW v1.8.0
LEGAL WARNING: Transmitting on licensed Sub-GHz bands without authorization
is illegal in most jurisdictions. Use only on your own licensed equipment,
inside RF-shielded enclosures, or in authorized red team engagements.
Garage/gate spoofing without property owner consent is a criminal offense.
Supported Protocols
| Protocol |
Bits |
Frequency |
Security |
Module |
HW Required |
| EV1527 |
24 |
433 MHz |
None |
subghz/static_code_replay |
HackRF / CC1101 |
| Princeton/PT2262 |
24 |
315/433 MHz |
None |
subghz/static_code_replay |
HackRF / CC1101 |
| CAME |
12 |
303-868 MHz |
None |
subghz/debruijn_bruteforce |
HackRF |
| NICE Flo |
12 |
433/868 MHz |
None |
subghz/debruijn_bruteforce |
HackRF |
| KeeLoq |
64 |
433/868 MHz |
Rolling code |
subghz/keeloq_* |
HackRF |
| TPMS |
var |
315/433 MHz |
CRC only |
subghz/tpms/* |
RTL-SDR |
Module Reference
| Module |
Description |
static_code_replay |
EV1527/Princeton/CAME/NICE/Holtek/Chamberlain static code replay |
debruijn_bruteforce |
DeBruijn sequence bruteforce for 12-bit garage door protocols |
keeloq_decoder |
KeeLoq rolling code frame decoder and analyzer |
keeloq_replay |
KeeLoq rolling code replay within counter window |
ev1527_vehicle_cve_2025_70994 |
CVE-2025-70994 - EV1527 vehicle remote keyless entry replay |
subghz_jammer |
Sub-GHz selective jammer (authorized testing only) |
br_gate_scanner |
Brazilian gate/garage protocol scanner and recorder |
tpms/tpms_decoder |
TPMS tire pressure sensor passive decoder |
tpms/tpms_spoof |
TPMS spoofed tire pressure alert injection |
tools/ook_analyzer |
OOK signal analyzer: preamble, bit timing, protocol identification |
Usage Example - DeBruijn Bruteforce (CAME garage doors)
wxf > use generic/subghz/debruijn_bruteforce
wxf (DeBruijn) > set protocol CAME
wxf (DeBruijn) > set frequency 433.92
wxf (DeBruijn) > set output_sub /tmp/came_brute.sub
wxf (DeBruijn) > run
[*] Generating DeBruijn sequence for CAME 12-bit at 433.92 MHz
[*] Total codes to test: 4096
[*] Estimated time at 287ms/code: ~4.8 minutes
[+] Generated: /tmp/came_brute.sub (Flipper Zero compatible)
[*] Load on Flipper: Sub-GHz -> Saved -> came_brute.sub -> Send
Usage Example - EV1527 Static Replay
wxf > use generic/subghz/static_code_replay
wxf (StaticCodeReplay) > set protocol EV1527
wxf (StaticCodeReplay) > set code 0xA3F21B
wxf (StaticCodeReplay) > set frequency 433.92
wxf (StaticCodeReplay) > set interface hackrf
wxf (StaticCodeReplay) > set simulate true
wxf (StaticCodeReplay) > run
[SIMULATE] Would transmit EV1527 code 0xA3F21B at 433.92 MHz
[SIMULATE] OOK pulse sequence: 24 bits, 350us/bit
[!] Set simulate=false and interface=hackrf to transmit live
Drone/UAV Security (generic/drones) - NEW v1.8.0
LEGAL WARNING: Unauthorized drone interference (deauth, disarm, GPS spoof,
command injection) violates aviation law in all jurisdictions.
In many countries it constitutes a federal criminal offense with severe penalties.
Use ONLY on drones you own, in shielded environments, or under explicit
written authorization from both the drone owner and relevant aviation authority.
| Module |
Description |
drone_scanner |
Drone discovery by WiFi SSID fingerprint (DJI, Parrot, Holy Stone, FPV) |
mavlink/mavlink_scanner |
MAVLink device scanner on UDP 14550 / TCP 5760 |
mavlink/mavlink_force_disarm |
Force disarm command via MAV_CMD_COMPONENT_ARM_DISARM |
mavlink/mavlink_gps_spoof |
Inject spoofed GPS NMEA to ground station / GCS |
mavlink/mavlink_waypoint_inject |
Overwrite active mission waypoints |
mavlink/mavlink_geofence_disable |
Disable geofence parameters via PARAM_SET |
mavlink/mavlink_param_dump |
Dump all autopilot parameters (read-only audit) |
mavlink/mavlink_flood_dos |
MAVLink message flood DoS |
dji/dji_wifi_scan |
DJI drone SSID scanner and version extractor |
dji/dji_deauth |
DJI WiFi deauthentication (landing interruption) |
dji/dji_quicktransfer_exfil_cve_2023_6951 |
CVE-2023-6951 - DJI QuickTransfer unauthenticated file exfil |
parrot/parrot_anafi_deauth_cve_2019_3944 |
CVE-2019-3944 - Parrot ANAFI WiFi deauth |
parrot/parrot_anafi_webcrash_cve_2019_3945 |
CVE-2019-3945 - Parrot ANAFI REST API crash |
parrot/parrot_anafi_udp_cmd_inject |
Parrot ANAFI UDP command injection |
parrot/parrot_bebop_dhcp_exhaust_cve_2022_46416 |
CVE-2022-46416 - Parrot Bebop DHCP pool exhaustion |
holystone/hsrid01_ble_dos_cve_2024_52876 |
CVE-2024-52876 - Holy Stone HSRID01 BLE DoS |
fpv/eachine_e52_tcp_takeover |
Eachine E52 TCP replay takeover |
Drones/UAV - New CVEs v2.1.0 (generic/drones)
| Module |
Description |
mavlink/mavlink_serial_control_shell_cve_2026_1579 |
CVE-2026-1579 PX4 MAVLink missing auth: send unsigned SERIAL_CONTROL (msg_id=126) for interactive NSH shell on flight controller (CVSS 9.8) |
px4/px4_log_stack_overflow_cve_2026_32743 |
CVE-2026-32743 PX4 MavlinkLogHandler sscanf stack overflow: create deep FTP path then request log list to crash MAVLink task (DoS) |
dji/dji_ble_duml_cred_sniff_cve_2026_77812 |
CVE-2026-77812 DJI BLE DUML cleartext credential exposure: passively sniff Wi-Fi PSK/SSID/UUID from BLE traffic during DJI Fly connection |
dji/dji_bt_duml_unauth_cve_2026_78306 |
CVE-2026-78306 DJI Bluetooth DUML unauthenticated command: modify Wi-Fi config / overwrite PSK / disable wireless interfaces (CVSS 8.5) |
SubGHz - New CVE v2.1.0 (generic/subghz)
| Module |
Description |
rkes_rollback_replay_cve_2026_49319 |
CVE-2026-49319 Alps Alpine R53R0 RKES rollback-replay: record two consecutive 433 MHz fob transmissions to replay pair for vehicle lock/unlock (Suzuki Swift 2024) |
Zigbee - New CVE v2.1.0 (generic/iot_proto/zigbee)
| Module |
Description |
zigbee_ezsp_green_power_bof_cve_2025_8414 |
CVE-2025-8414 Silicon Labs EZSP Green Power host buffer overflow scanner: detect EZSP hosts, query SDK version, probe with crafted oversized GP frame |
LoRaWAN - New CVE v2.1.0 (generic/iot_proto/lorawan)
| Module |
Description |
lorawan_frag_transport_oob_cve_2026_12363 |
CVE-2026-12363 Zephyr RTOS frag_transport OOB write: DATA_FRAGMENT with frag_index_n=0 underflows array index in FragDecoderProcess() corrupting FUOTA session |
Cellular / 5G - New v2.1.0 (generic/cellular)
| Module |
Description |
fiveghoul_5gnr_dos |
5Ghoul (CVE-2023-33042/43/44, CVE-2024-20003/04): orchestrator for 5G NR pre-auth DoS attacks via rogue gNB (USRP B210 + srsRAN prereq) |
llfuzz_baseband_cve_scanner |
LLFuzz (CVE-2025-21477, CVE-2025-20659, CVE-2025-26780/81/82): baseband CVE catalog + USB modem fingerprint + chipset vulnerability assessment |
sni5gect_5gnr_sniff_inject |
Sni5Gect: 5G NR sniffing, injection, downgrade, auth bypass, and fingerprinting orchestrator (USRP B210 prereq) |
Usage Example - MAVLink Force Disarm
wxf > use generic/drones/mavlink/mavlink_force_disarm
wxf (MAVForceDisarm) > set rhost 192.168.1.100
wxf (MAVForceDisarm) > set rport 14550
wxf (MAVForceDisarm) > set simulate true
wxf (MAVForceDisarm) > run
[SIMULATE] Would send MAV_CMD_COMPONENT_ARM_DISARM (param1=0, param2=21196)
[SIMULATE] To: udp://192.168.1.100:14550 sysid=1 compid=1
[!] Set simulate=false to send live command
[!] PREREQ: Network access to drone on UDP 14550
[!] WARNING: Force disarm on airborne drone causes crash
Usage Example - DJI QuickTransfer Exfil (CVE-2023-6951)
wxf > use generic/drones/dji/dji_quicktransfer_exfil_cve_2023_6951
wxf (DJIQuickTransferExfil) > set rhost 192.168.2.1
wxf (DJIQuickTransferExfil) > set output_dir /tmp/dji_exfil
wxf (DJIQuickTransferExfil) > set simulate true
wxf (DJIQuickTransferExfil) > run
[SIMULATE] CVE-2023-6951: DJI QuickTransfer unauthenticated file access
[SIMULATE] Target: http://192.168.2.1:80
[SIMULATE] Would enumerate /DCIM/ and download media files
[!] Set simulate=false for live exfil - requires WiFi association to DJI drone
Maritime Security (generic/maritime) - NEW v1.8.0
LEGAL WARNING: AIS and NMEA spoofing at sea is illegal under SOLAS and
maritime law in all jurisdictions. It creates navigation safety hazards.
Use only in authorized lab environments or closed RF chambers.
| Module |
Description |
nmea_spoof |
NMEA 0183 GPS/navigation sentence injection (TCP multiplexer) |
ais_spoof |
AIS vessel position report spoofing with Type 1 bit encoding |
Usage Example - AIS Vessel Spoof
wxf > use generic/maritime/ais_spoof
wxf (AISSpoofAttack) > set target_host 192.168.1.100
wxf (AISSpoofAttack) > set target_port 10110
wxf (AISSpoofAttack) > set simulate true
wxf (AISSpoofAttack) > run
[SIMULATE] AIS Type 1 sentence for MMSI 123456789 (PHANTOM)
[SIMULATE] Position: 1.264N / 103.826E at 12.0kn COG 90
[SIMULATE] Sentence: !AIVDM,1,1,,A,15NN...
[!] Set simulate=false + network access to AIS multiplexer (TCP 10110) to inject
[!] WARNING: AIS spoofing is a maritime criminal offense
Vehicular Radar (generic/vehicular_radar) - NEW v1.8.0
LEGAL WARNING: Active radar jamming or spoofing is illegal in most
jurisdictions and creates road safety hazards. Use ONLY in shielded
anechoic chambers or authorized test tracks with controlled access.
| Module |
Description |
traffic_enforcement_scanner |
Kapsch RSU / Motorola Vigilant / Selea ANPR fingerprint scanner |
fmcw_radar_attack |
FMCW automotive radar signal parameter calculator (MadRadar/mmSpoof) |
Usage Example - Traffic Enforcement Scanner
wxf > use generic/vehicular_radar/traffic_enforcement_scanner
wxf (TrafficEnforcementScanner) > set target_cidr 10.0.1.0/24
wxf (TrafficEnforcementScanner) > run
[*] Scanning 10.0.1.0/24 for traffic enforcement devices...
[+] 10.0.1.42: Kapsch TrafficCom RSU | ports: 443,8443
CVEs: CVE-2025-25734, CVE-2025-25735, CVE-2025-25736
[+] 10.0.1.67: Motorola Vigilant LPR | ports: 80,443
CVEs: CVE-2024-51023, CVE-2024-51024
[*] Scan complete: 2 devices found
Forensics, Wardriving and Session Management (generic) - v1.8.0
| Module |
Description |
evidence_vault/evidence_vault |
Hash-chained tamper-evident audit ledger (ISO/IEC 27037 chain-of-custody) |
wardrive/wardrive_logger |
GPS-tagged WiFi discovery logger with CSV/JSON/KML export |
wids/wifi_ids |
Native Python WIDS: deauth flood, evil twin, rogue AP, beacon flood detection |
session_manager/session_manager |
SQLite-backed pentest session manager with JSON export |
bluetooth/bt_hid_keyboard_inject |
Bluetooth HID keyboard injection (Broadcom/BlueZ) |
Usage Example - Evidence Vault
wxf > use generic/evidence_vault/evidence_vault
wxf (EvidenceVault) > set session_id pentest_office_2026
wxf (EvidenceVault) > set vault_dir /evidence
wxf (EvidenceVault) > run scan --ssid "OfficeWiFi" --bssid AA:BB:CC:DD:EE:FF --channel 6 --rssi -65 --security WPA2
[+] Evidence recorded: #0001 type=scan sha256=abc123...
[+] Chain head: abc123...
wxf (EvidenceVault) > verify
[+] Chain VALID (3 records)
[+] ISO/IEC 27037 chain-of-custody maintained
Usage Example - WIDS
wxf > use generic/wids/wifi_ids
wxf (WirelessIDS) > set interface wlan0mon
wxf (WirelessIDS) > set simulate true
wxf (WirelessIDS) > run
[SIMULATE] WIDS scenario: DEAUTH_FLOOD detected
BSSID: AA:BB:CC:DD:EE:FF | client: 11:22:33:44:55:66 | frames: 45/10s
Alert: DEAUTH_FLOOD severity=HIGH
[SIMULATE] EVIL_TWIN detected - SSID 'OfficeWiFi' on new BSSID
[*] To start live monitoring: set simulate false
External Bridges (generic/external)
| Module |
Description |
bruce_serial_bridge |
ESP32 Bruce firmware serial flow engine (15+ profiles) |
bruce_esp32_lab_notes |
Bruce/Marauder lab operational reference |
bruce_upstream_tracker |
Bruce firmware issues/PRs catalog viewer |
airgeddon_bridge |
Airgeddon multi-mode subprocess bridge |
wifiphisher_bridge |
Wifiphisher bridge with inline sniffer |
eaphammer_bridge |
EAPHammer bridge (Win11 PEAP + HTTP coercion) |
mdk4_bridge |
mdk4 bridge (all modes including mesh) |
wifipumpkin3_bridge |
WifiPumpkin3 bridge (URL sanitization) |
wireless_tool_prereq_audit |
Dependency check for all system tools |
Bruce / ESP32 Marauder Integration
WXF includes a full serial flow engine for BruceDevices/firmware:
wxf > use generic/external/bruce_serial_bridge
wxf (BruceSerialBridge) > set serial_port /dev/ttyACM0
wxf (BruceSerialBridge) > set flow_profile capture_handshake_flow
wxf (BruceSerialBridge) > run
# Available flow profiles:
# baseline_status_flow capture_handshake_flow
# wifi_menu_navigation_flow deauth_clone_verify_flow
# sniffer_capture_flow evil_portal_karma_flow
# wifi_attack_lab_flow raw_sniffer_probe_flow
# wifi_bruteforce_recon_flow navigation_recovery_flow
# captive_portal_endpoint_config_flow
# repeater_wisp_setup_flow external_adapter_probe_flow
# webui_password_flow target_attack_stability_flow
# ble_recon_spam_flow ble_badble_recovery_flow
# rf_spectrum_scan_flow rf_jammer_stability_flow
Custom declarative flows via flow_json:
wxf (BruceSerialBridge) > set flow_json [{"command":"wifi scan","expect":"#","wait_ms":1200},{"command":"nav back","repeat":2,"expect":"#"}]
wxf (BruceSerialBridge) > run
Documentation & Wiki
Full syntax reference, module usage samples, and configuration guides:
Contributing
See CONTRIBUTING.md and CONTRIBUTORS.md.
Please read our Code of Conduct and Security Policy.
License
BSD 3-Clause License — see LICENSE for details.
WirelessXPL-Forge is intended for authorised security research and education only.
Use against systems you do not own or have explicit written permission to test is illegal.
Contact
Support / general inquiries: security.research@uniaogeek.com.br
Security issues: SECURITY.md
André Henrique
União Geek
License: BSD-3-Clause License - Copyright (c) 2026 União Geek
Created by: André Henrique (@mrhenrike) | União Geek
Leia em Português - Command coverage - Wiki
