wireless▌

### offensive-krack-fragattacks - KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-bluetooth-ble - Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forc - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-lorawan-sub-ghz - LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-zigbee-thread-matter - Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, Kille - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-evil-twin - Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-wpa-enterprise - WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-bluetooth-classic - Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-wifi-recon - Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspa - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-wps - WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, Media - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-deauth-disassoc - Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.