RF Hacking with SDR

Day 1 - RF preliminaries

Day 1 is an introduction to radio that will help students to learn its concepts and the techniques used today to receive and transmit signals, but also the constraints that we have to deal with in heterogeneous environments:

• Introduction to Radio
  • History, evolution, and EU regulations
  • Radio waves
  • Digital Signal Processing
  • Software-Defined Radio
• Antennas
  • Antenna types and selection
  • Amplifiers and connectors
  • Antenna measurement tips
    • Using a VNA (NanoVNA and others)
    • SWR/VSWR measurement and impedance matching
    • Reading and interpreting radiation patterns
    • Practical gain verification
    • Field measurement best practices
• Software-Defined Radio devices
  • Specifications
  • How to choose them
  • Few tips and hacks
• Observations
  • Waterfall and spectrum analyzers
  • Signal identification
  • Modulation/Demodulation
  • Encoding/Decoding
• SIGINT & COMINT fundamentals
  • Introduction to Signals Intelligence and Communications Intelligence
  • RF spectrum survey and reconnaissance methodology
  • Signal classification and fingerprinting
  • Direction finding basics
  • Traffic analysis principles
  • Legal and ethical framework
• Faraday cages and how to design a very cheap one
• Use of attenuators and software gain parameters

Day 2 - Hands-on radio

Day 2 will put the student in the playground of the Software-Defined Radio, where every idea can be written on software to be simulated and then concretized to realize receivers and transmitters depending on the chosen hardware limitations:

• Introduction to GNU Radio
• Software-Defined Radio processing in the chain
• Practice with GNU Radio Companion
  • Block schemas
  • Parameters
  • Generators
  • Sinks and sources
  • Operators
  • Simulations
  • Modules
  • Executing a block in a real SDR device
  • Listening to simple AM and FM signals
  • Transferring a simple signal
  • Optimizing samples processing
  • Features to process samples
  • Creating your own block
• Applied SIGINT with SDR
  • Building a wideband spectrum scanner
  • Automated signal detection and logging
  • COMINT: intercepting and decoding communication protocols
  • Building a direction-finding flowgraph
• Investigation and handy tools
• Alternatives to GNU Radio (RedhawkSDR, etc.)

Day 3 - Attacking physical intrusion systems

Day 3 resumes and applies previous chapters to study physical intrusion systems and brings useful tricks for Red Team tests as well as pentests:

• Common sub-GHz Remotes
  • Introduction
  • Capturing data
  • Replaying saved samples
  • Analyzing samples (manually and with powerful tools)
  • Rolling codes security
• nRF devices
  • Introduction
  • Analyzing nRF-based devices with GNU Radio like mice, keyboards, and presenters
  • Capturing strokes
  • Hijacking vulnerable devices
• Some feedback on connected locks
• Red Team tips

Day 4 - Unexpected implants, industrial systems, and arsenals

Last day will focus on unexpected implants vendors introduced in some technologies, custom and industrial systems, and the development of handy radio prototypes to use during a mission:

• Attacking Custom devices
  • Introduction
  • Identification (looking at devices’ references, components, etc.)
  • Sniffing signals
  • Decoding signals
• LoRa
  • Introduction
  • Detect used bands
  • Capture signal
  • Optimize the interception process
  • Decode data and payloads
  • Security of LoRa
  • Transmit packets

The content of private trainings can be arranged depending on your needs. As PentHertz is specialized the RF fields, we also provide additional content as follows:

• GPS: decoy attacks, limits, and defenses
• Bluetooth: attacks, fuzzing, and defenses
• Wi-Fi: attacking the different protocols, fuzzing the protocol stack, and analyzing the radio signal
• RFID/NFC: additional content and advanced techniques with SDR
• Hardware: additional content in hardware and practice to attack embedded systems
• PLC: Power-Line Communications hacking
• Mobile: attacking 2G-5G communications
• Advanced SIGINT/COMINT: extended interception scenarios, ELINT, and multi-sensor correlation
• etc.

• Knowledge of Linux and a programming language such as C, C++, C# or Python is necessary
• Understanding of pentesting (network and applications) or Red teaming is also a plus
• All attendees will need to bring a laptop capable of running VMware virtual machine (8GB of RAM is a minimum)
• Basic knowledge of radio is not mandatory but is a plus

Training action within the meaning of article L. 6313-1 of the French Labour Code. Penthertz SAS is a training organisation registered under declaration number 11788588278 with the Île-de-France regional prefect; this registration does not constitute State approval.

Duration
28 hours over 4 days of 7 h. Indicative hours: 9:00–12:30 and 13:30–17:00.

Format
Live sessions, remote (virtual classroom) or on site, open enrolment or private group. Taught in English or French. 1 to 20 participants.

Audience
Pentesters, Red Team members, security researchers, RF and embedded systems engineers, offensive security professionals who want to skill up on radio and SDR.

Price
See the pricing table below: prices are shown excluding VAT (20 % in France), per participant for remote sessions; on-site and tailored content on quote.

Access time
Registration possible up to 10 working days before the session starts, subject to availability. The positioning questionnaire is sent to participants at least 15 days before the first day.

How to register
Contact us at [email protected] or through the contact form. A scoping call lets us collect your needs, check prerequisites and issue a quote. Registration is confirmed on receipt of the signed quote and training agreement.

Teaching methods
Short theory inputs followed by hands-on practice for most of the time, on targets and benches provided. Each participant works on their own workstation and equipment; kit, slides, scripts and captures are provided.

Assessment
Positioning questionnaire before the session; continuous assessment through observation of hands-on exercises and guided tasks; synthesis exercise at the end. Attendance is recorded on a half-day attendance sheet signed by participants and trainer.

Certificate
End-of-training certificate stating objectives, nature, duration and assessment results; completion certificate issued to the client. This course is not a certifying action (no RNCP or RS registration).

Accessibility
Our courses are accessible to people with disabilities. Contact our disability officer at [email protected] or +33 1 73 13 82 77, ideally 15 days before the session, to study adaptations. See our quality and accessibility page.

Documents
Training terms of sale (French original), training rules, privacy policy and results indicators. The detailed programme is the course content above; a PDF version is provided with the quote.

Complaints
Write to [email protected]: acknowledgement within five working days and a reasoned reply within fifteen working days. Individual customers may then refer an unresolved dispute free of charge to our consumer mediator, CM2C (details).

Information updated on 13 October 2026.