offensive-zigbee-thread-matter
Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abuse for door locks and bulbs, Thread network credential theft, Matter commissioning chain analysis, and 6LoWPAN/IPv6 routing exploitation. Use when targeting smart-home or commercial mesh deployments, Zigbee-based door locks, lighting, or sensor networks.
npx skills add SnailSploit/Claude-Red --skill offensive-zigbee-thread-matter --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Zigbee / Thread / Matter Attacks 802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls. ## Quick Workflow 1. Sniff target frequency (channels 11–26 in 2.4 GHz) 2. Identify network coordinator and joining devices 3. For Zigbee: try Touchlink commissioning with the well-known key 4. Capture join-key exchange when devices commission 5. Replay or inject ZCL/ZHA cluster commands --- ## Hardware | Adapter | Use | |---|---| | TI CC2531 USB stick | Cheap, works with Zigbee2MQTT, KillerBee | | TI CC2540 / CC2652 | Zigbee + Thread + BLE | | Sonoff Zigbee Dongle E (CC2652P) | Modern, well-supported | | ApiMote (KillerBee dev) | Multi-channel, scapy-dot15d4 | | HackRF + appropriate firmware | Lower-level RF flexibility | ## Discovery + Sniffing ```bash # KillerBee suite zbstumbler -i 0 # find Zigbee networks zbid # ID coordinators zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap # scapy-dot15d4 for crafted frames python3 >>> from scapy.contrib.dot15d4
- Quick Workflow
- Hardware
- Discovery + Sniffing
- Touchlink Commissioning Abuse
- Network Key Capture During Joins
- ZCL / ZHA Cluster Command Abuse
- Thread Specifics
- Matter Commissioning
- Detection
- Engagement Cheatsheet
- Key References
KillerBee suite zbstumbler -i 0 # find Zigbee networks zbid # ID coordinators zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap scapy-dot15d4 for crafted frames python3 z3sec — Zigbee 3 commissioning attack toolkit git clone https://github.com/IoTsec/Z3sec python z3sec_inter_pan.py --command "factory_reset_request" --device <addr> python z3sec_inter_pan.py --command "join_network" --network <PANID>
What does the offensive-zigbee-thread-matter skill do?
Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abuse for door locks and bulbs, Thread network credential theft, Matter commissioning chain analysis, and 6LoWPAN/IPv6 routing exploitation. Use when targeting smart-home or commercial mesh deployments, Zigbee-based door locks, lighting, or sensor networks.
How do I install it?
Run `npx skills add SnailSploit/Claude-Red --skill offensive-zigbee-thread-matter --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SnailSploit/Claude-Red, a repository with 2,808 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.