SubGhz Bruteforce Attack with Flipper Zero

[@dubhead_dena]

Finally someone explained it properly and showed it! Thank you for this tutorial!!!

[@PenTestTuner]

So happy to help.

[@timothyjones4058]

Omg thank you so much lol

[@PenTestTuner]

Absolutely.

[@Brou15O]

whats with the other options though? are they even more frequencies to brute force? also rip some neighbors garage door, the sub-ghz range is surprisingly far lol

[@PenTestTuner]

The other options are protocols for all sorts of stuff. The person/people that work on the bruteforce app update it sometimes, adding new protocols or bug fixes.

[@brunoaduarte]

Just one note: this is an old and very weak security system, not used in most places nowadays. This security system is based on setting the "secret" by selecting dip switches in the electronic board, the "secret" is fixed and will only change if the owner changes the dip switches of the gate and the remote. Then you will have to brute force again. But most gates today are based on much more complex rolling codes, 1 brute force can take days and even if you manage to open it, the next code will be different. Totally not pratical. But very cool video anyway. Thanks.

[@PenTestTuner]

I agree with all of this, however, most garage door and gate systems still use this technology because they have yet to purchase a new system. Weakness is still prevalent even though new tech is available. A chain is only as good as its weakest link.

[@Thadopeera]

It’s about time someone was out in the field showing Flippers capabilities instead of another “ This is how you update firmware “ video 🤣

[@PenTestTuner]

The field is the best way to learn.

[@lllIlIIllIlll]

Looks legit respect to this man🎉

[@PenTestTuner]

Thank you.

[@WPGinterceptor460Interceptor]

this is a real bruteforce video, not like the other cloning videos on youtube

[@PenTestTuner]

Thank you.

[@badorgoodismine8963]

We need more testing videos you are the goat best explained videos ever man ⭐️⭐️⭐️⭐️⭐️

[@PenTestTuner]

Thank you.

[@badorgoodismine8963]

@@PenTestTuner i got a question the board you using looks like the fluxcapacitor if im not mistaken are you able to do any frequency between 300 mhz to 800 mhz?

[@PenTestTuner]

@@badorgoodismine8963 ​​⁠ ​​⁠it is a Flux, yes. Flux Capacitor is best between 300MHz and 450MHz.

[@AndyDeiu]

Good tutorial. Hopefully it gets more views because it shows that it’s not a fake video. This is a genuine method ! Thanks ❤

[@PenTestTuner]

Thank you for the support.

[@elmalinois3767]

What kind of upper board are using? Thanks

[@PenTestTuner]

I’m using the Rabbit-Labs Flux Capacitor. kzbin.info/www/bejne/a5iwdoqKop6Kq7ssi=0ouzkXeQ02JKdHR0

[@MarcellsWorldJjr]

this is helpful. more vids like this please

[@PenTestTuner]

Thank you.

[@ggonmar]

How do you know what option of the bruteforce list you should use? you went straight for the linear 10bit, but how did you know that was the one to use?

[@PenTestTuner]

I have done allot of testing.

[@Tiwy1001]

Thanks PenTest!

[@PenTestTuner]

Anytime.

[@matthew7296]

you find any good tables for brands and there protocols? i use this in emergency situations in areas with no cell signal and my clients forget to tell me their ranch gate code so i don't have to drive an hour back towards the nearest cell tower just for them to tell me they forgot because they always use their remote. or worse when i get locked in a gated community that shuts their sensors and keypads off after midnight to prevent poachers.

[@PenTestTuner]

I have not.

[@cybercriminal1985]

very nice video , +1 question can you do something with supermarkets? i mean i see some of them play with wallgreens and some of them but if you can do what is the procedure to capture signal from supermarket i mean need to use read hoping with bin raw? or read raw?

[@PenTestTuner]

I haven’t had enough experience with markets. Vulnerabilities are everywhere.

[@norman157]

Do I have to use Linear 10 bit? Or is there any other way I can figure out which one works, without actually just trying all of them one by one.

[@PenTestTuner]

Each protocol has vendors that are using it. You have to know or figure out what vendor uses what protocol. Please keep in mind that not every protocol that vendors use is listed in the Bruteforce app.

[@dandobi]

Awesome video. Thanks for this. Can I ask how you knew to be on the linear 10 bit 300? Thanks!

[@PenTestTuner]

I knew to use that protocol because I have spent hours trying all the different protocols.

[@dandobi]

@@PenTestTuner amazing thanks. So is it pretty much a guess and check situation? Or is there some kind of magical document somewhere that tells ya which protocols do what? Thanks again man

[@PenTestTuner]

With me, it is kind of a guessing game. It really comes down to what is used in an area or country. There has to be a document or a way to determine what protocols manufacturers used in there products, but I have yet to find it. I’m still looking though.

[@mpmiroslavpenev555]

Super video tanks man !👍

[@PenTestTuner]

No problem.

[@rikuspistorius1355]

Does doing this interfere with any other remotes that are assigned to that gate? Great video btw

[@PenTestTuner]

No, running this type of attack does not disrupt the use of other remotes paired to the gate.

[@pureh2oh92]

How does one even find out which sub ghz frequency and transmitter/ brand version a gate is using in order to brute-force it in the first place ?????

[@PenTestTuner]

1. Allot of trail and error. 2. Allot of trial and error.

[@PenTestTuner]

3. Try again.

[@betterfresh3397]

Can I use every antenna like an antenna from a USB WLAN Adapter like Alfa awus or do I need a special antenna?

[@PenTestTuner]

You should be using an antenna appropriate for the type of signal you want to use or receive. Some antennas are designed for 433Mhz signals while others are tuned for 900Mhz signals. It sounds like the antennas you describe in your question are WIFI 2.4Ghz or 5Ghz. 2.4Ghz and 5Ghz antennas will not help with what is done in this video.

[@betterfresh3397]

@@PenTestTuner thank you very much. Yes, it's a wifi antenna for WLAN Adapter I tried. I ordered immediately the right antenna today on Amazon. Same day delivery 😄. Thanks a lot my friend! Your videos are very very interesting!

[@alejandropages3943]

How Can i install that bruteforcer on my flipper ?

[@PenTestTuner]

It comes standard with the “Momentum” firmware. That’s how I currently use it.

[@SADBOY-vf6qx]

Where do I go to download the brute force for my Flipper zero

[@PenTestTuner]

It is already in most Custom Firmwares.

[@MultiGreenbuds]

did you specifically inspect the gate to see what protocols it might be running ? is that how you chose the linear 300 ?

[@PenTestTuner]

I did not.

[@PenTestTuner]

I have been testing for a long time and have figured out what protocols are needed.

[@txontoptxisdaddy3141]

Is there a video on how to install this software

[@PenTestTuner]

In this video I was using the XTREME firmware. Now I use Momentum, most of the time. If you are referring to the Bruteforce attacks, they are in the Momentum firmware by default.

[@alejandropages3943]

You know how to use marauder atack (deuth) at the same time that make an evil portal? So the people doesn’t connect to the wifi, and have to Connect to evil portal

[@PenTestTuner]

That is not something I have covered in this video.

[@alejandropages3943]

@@PenTestTuner i know, but i think that you know a lot of flipper zero, so maybe could you help me

[@PenTestTuner]

@@alejandropages3943I tend to keep to the subject. Perhaps it will be a video I make someday.

[@mattwashington83]

what gpio board are you using?

[@PenTestTuner]

In this video, I am using the Flux Capacitor by Rabbit-Labs.

[@hovanboyajian3643]

how did u figure out which Bruteforce program does it?

[@PenTestTuner]

Most codes where I am, use this protocol. I have spent many hours figuring it out.

[@Erks89]

would the same be for flat doors?

[@PenTestTuner]

If it can be “Brute Force” attacked.

[@GrowLearnShare]

What mod do you have on top with 2 antenna?

[@PenTestTuner]

I am using a board called the “Flux-Capacitor”. It is using 1 antenna in this video.

[@Pinoy420Mike]

Sheeessssh! Goodshit bro !!! lol

[@PenTestTuner]

Thank you.

[@Tiwy1001]

Do you need the thing on top for it to work?

[@PenTestTuner]

You don’t have to use the module on the flipper to use Sub-GHz. It extends the range quite a bit, though.

[@Spiri2]

I can confirm that this does work. Just tried it 😂

[@PenTestTuner]

Nice.

[@quing]

What firmware?

[@PenTestTuner]

I am currently using Momentum, but in this video I believe I am using XTreme.

[@quing]

@@PenTestTuner Which is better?

[@PenTestTuner]

I have not used XTreme in a while, so I would not be able to give you a great answer on that. Try both.

[@quing]

@@PenTestTuner Спасибо)

[@Demonic676]

but how do i get the bruteforce app

[@PenTestTuner]

It is already part of most custom firmwares. Try using the “Momentum” firmware.

[@mrcrunches2750]

Whats the extension

[@PenTestTuner]

In that video I am using the Rabbit-Labs Flux-Capacitor.

[@fxh0113]

Do I need the Antenna?

[@PenTestTuner]

It extends range quite a bit.

[@fxh0113]

@@PenTestTuner Oh ok

[@paul.0]

what antenna do you use? link pls

[@PenTestTuner]

In this video, I used this one. www.tindie.com/products/tehrabbitt/rabbit-labstm-flux-capacitor-amplified-cc1101/

[@kilosierra1560]

great vid for the culture

[@PenTestTuner]

Thanks you.

[@raylo91]

Do I need to use the flux cap if I’m in the garage and not trying to brute force any of my neighbors? 😂

[@PenTestTuner]

You don’t. But try to get out a little more. Hahaha.