RF Hacking with SDR
Four days on software-defined radio for security. Beyond running public tools, you learn how they work and build your own to analyse and attack systems, using real cases from our pentests and red team engagements, and the method to approach targets nobody has documented yet.
- Understand how radio works and the technologies that use it today
- Find, analyse, modulate and demodulate a signal from scratch
- Interface with a signal using SDR devices and software
- Capture, generate, replay and analyse signals with SDR
- Encode and decode data carried over the air
- Apply SIGINT and COMINT fundamentals to offensive security
- Measure and characterise antennas for reception and transmission
- Build your own tools with GNU Radio and its alternatives
- Get the first reflexes to attack embedded and IoT systems
- Attack 2G to 4G, RFID/NFC, LoRa, wireless mice, keyboards and presenters, sub-GHz remotes and alarms, and custom technologies
- Pentesters and red teamers adding radio to their toolkit
- Product and embedded security engineers
- Researchers moving from wired to wireless
- SDR owners who want to go beyond receiving
Conferences where we have taught
Our courses have run at these conferences, and most of them can also run privately for your team.
Four days, day by day
Roughly a third theory, two thirds hands-on. The content adapts to the group and the days available.
Day 1RF preliminaries
Day 1 is an introduction to radio that will help students to learn its concepts and the techniques used today to receive and transmit signals, but also the constraints that we have to deal with in heterogeneous environments:
- Introduction to Radio
- History, evolution, and EU regulations
- Radio waves
- Digital Signal Processing
- Software-Defined Radio
- Antennas
- Antenna types and selection
- Amplifiers and connectors
- Antenna measurement tips
- Using a VNA (NanoVNA and others)
- SWR/VSWR measurement and impedance matching
- Reading and interpreting radiation patterns
- Practical gain verification
- Field measurement best practices
- Software-Defined Radio devices
- Specifications
- How to choose them
- Few tips and hacks
- Observations
- Waterfall and spectrum analyzers
- Signal identification
- Modulation/Demodulation
- Encoding/Decoding
- SIGINT & COMINT fundamentals
- Introduction to Signals Intelligence and Communications Intelligence
- RF spectrum survey and reconnaissance methodology
- Signal classification and fingerprinting
- Direction finding basics
- Traffic analysis principles
- Legal and ethical framework
- Faraday cages and how to design a very cheap one
- Use of attenuators and software gain parameters
Day 2Hands-on radio
Day 2 will put the student in the playground of the Software-Defined Radio, where every idea can be written on software to be simulated and then concretized to realize receivers and transmitters depending on the chosen hardware limitations:
- Introduction to GNU Radio
- Software-Defined Radio processing in the chain
- Practice with GNU Radio Companion
- Block schemas
- Parameters
- Generators
- Sinks and sources
- Operators
- Simulations
- Modules
- Executing a block in a real SDR device
- Listening to simple AM and FM signals
- Transferring a simple signal
- Optimizing samples processing
- Features to process samples
- Creating your own block
- Applied SIGINT with SDR
- Building a wideband spectrum scanner
- Automated signal detection and logging
- COMINT: intercepting and decoding communication protocols
- Building a direction-finding flowgraph
- Investigation and handy tools
- Alternatives to GNU Radio (RedhawkSDR, etc.)
Day 3Attacking physical intrusion systems
Day 3 resumes and applies previous chapters to study physical intrusion systems and brings useful tricks for Red Team tests as well as pentests:
- Common sub-GHz Remotes
- Introduction
- Capturing data
- Replaying saved samples
- Analyzing samples (manually and with powerful tools)
- Rolling codes security
- nRF devices
- Introduction
- Analyzing nRF-based devices with GNU Radio like mice, keyboards, and presenters
- Capturing strokes
- Hijacking vulnerable devices
- Some feedback on connected locks
- Red Team tips
Day 4Unexpected implants, industrial systems, and arsenals
Last day will focus on unexpected implants vendors introduced in some technologies, custom and industrial systems, and the development of handy radio prototypes to use during a mission:
- Attacking Custom devices
- Introduction
- Identification (looking at devices' references, components, etc.)
- Sniffing signals
- Decoding signals
- LoRa
- Introduction
- Detect used bands
- Capture signal
- Optimize the interception process
- Decode data and payloads
- Security of LoRa
- Transmit packets
In a private session
The content is arranged around your needs, and we can add:
- GPS: decoy attacks, their limits and defences
- Bluetooth: attacks, fuzzing and defences
- Wi-Fi: attacking the different protocols, fuzzing the protocol stack and analysing the radio signal
- RFID and NFC: additional content and advanced techniques with SDR
- Hardware: more practice attacking embedded systems
- Power-line communications (PLC) hacking
- Mobile: attacking 2G to 5G communications
- Advanced SIGINT and COMINT: extended interception scenarios, ELINT and multi-sensor correlation
What every attendee takes home
Attendees keep the kit, the tools and the captures, so they can keep practising after the course.
- Hardware kit
- Full-duplex TX/RX SDR, kept by the attendee
- Docker container
- RF Swift, with the toolchain preloaded
- Slides, flowgraphs and scripts
- Full deck, the GNU Radio flowgraphs and the tools used in class
- Captures
- Real signals from assessments, cleared for teaching
Prerequisites
A capable laptop
Linux with 8 GB of RAM minimum, USB 3.0 and administrator rights
Programming and Linux
Knowledge of Linux and a language such as C, C++, C# or Python
Radio knowledge
Basic radio theory helps but is not required
Pentest or red team experience
A plus, not required
Your trainer
Wireless and hardware security specialist. Published research on 5G security, Open RAN, baseband fuzzing, interception and mapping, and power-line communication (HomePlug AV, domestic PLC, electric vehicles and charging stations). Practical work across Wi-Fi, RFID and other wireless systems.
PublicationsHow it runs and what to know
How it is taught
Hands-on from the start: you work on real radios and real hardware, with the same tools and signal captures we use on engagements. Live courses include a hardware kit you keep; on-demand courses run at your own pace, on this site.
How progress is assessed
Progress is checked through the practical exercises done during the course. A certificate of completion is issued to each participant.
How and when to enrol
Live and tailored sessions are scheduled with you after a short scoping call, usually within a few weeks. On-demand courses start as soon as your purchase is confirmed.
Accessibility
Penthertz is a registered French training organisation (no. 11788588278). If a participant has a disability or a specific need, tell us when scoping and we will adapt the setup where we can.
Public dates
All trainings| Nov 16-18, 2026 | Hardwear.io NL 2026SDR Hacking Advanced: reversing and exploiting wireless communications |
Run it privately for your team
Priced per group, with content adapted to your needs. Remotely, on your site or at our offices near Paris.