Techzone/HackRF One

HackRF One

3 min readArticle

HackRF One is an open-source SDR (Software Defined Radio) hardware peripheral that can both transmit and receive radio signals from 1 MHz to 6 GHz. It's the most popular affordable SDR for active RF security testing — unlike the RTL-SDR which can only receive, HackRF can transmit, enabling replay attacks and signal injection.

Specs

  • Frequency range: 1 MHz – 6 GHz
  • Max sample rate: 20 million samples/sec
  • Resolution: 8-bit
  • Half-duplex: Can TX or RX, not simultaneously
  • Price: ~$300 (or ~$50 for clone, lower quality)
  • Interface: USB
  • Open source: both hardware and firmware

Installation and Setup

bash 
# Install HackRF tools
sudo apt install hackrf

# Test device detection
hackrf_info

# Update firmware
hackrf_update --write hackrf_one_usb.bin

# Check that it's working
hackrf_info
# Should show Serial number, firmware version, etc.

hackrf_transfer - Raw Signal Capture/Replay

bash 
# Capture raw IQ samples from 433.92MHz
hackrf_transfer -r capture.iq -f 433920000 -s 2000000

# Parameters:
# -r <file>  = receive to file
# -t <file>  = transmit from file  
# -f <Hz>    = center frequency
# -s <Hz>    = sample rate
# -a <0|1>   = amp enable (use carefully!)
# -x <0-47>  = TX VGA gain

# Replay the captured signal
hackrf_transfer -t capture.iq -f 433920000 -s 2000000

# Replay with amplifier enabled (more range, be careful)
hackrf_transfer -t capture.iq -f 433920000 -s 2000000 -a 1 -x 20

Replay Attack Example (RF Remote)

Classic attack on 433MHz fixed-code key fobs:

bash 
# 1. Capture the remote signal
hackrf_transfer -r keyfob.iq -f 433920000 -s 2000000
# Press the remote button while capturing

# 2. Analyze the capture (optional)
inspectrum keyfob.iq

# 3. Replay the signal
hackrf_transfer -t keyfob.iq -f 433920000 -s 2000000
# The lock/garage should open

GNU Radio with HackRF

For more complex signal processing:

python 
# Simple receive in GNU Radio Python
from gnuradio import gr, blocks
from gnuradio import uhd

# Use GNU Radio Companion (GRC) for visual flow graphs
# File → New → Drag blocks → configure HackRF source

Common Attack Scenarios

Garage Door / RF Remote Replay

  • Capture signal at 315MHz or 433.92MHz
  • Replay to trigger the device
  • Ineffective against rolling code systems

Sub-GHz Protocol Analysis

bash 
# Analyze smart meter transmissions
hackrf_transfer -r meter.iq -f 868000000 -s 2000000
# Then process with inspectrum or gnu radio

# Baby monitor frequencies (check what's transmitting)
hackrf_transfer -r baby.iq -f 2400000000 -s 20000000

Jamming (DoS) — Educational Only

bash 
# Broad spectrum noise generation (ONLY in isolated environment / authorized)
# This is illegal without authorization

GSM / Cellular Analysis

bash 
# Capture GSM downlink (with legal authorization)
hackrf_transfer -r gsm.iq -f 935000000 -s 2000000
# Process with gr-gsm or grgsm_livemon

Useful Companion Tools

  • Inspectrum — visual analysis of IQ captures
  • GNU Radio — signal processing framework
  • URH (Universal Radio Hacker) — analyze and replay RF protocols
  • GQRX — general purpose SDR receiver GUI
  • rtl_433 — decode common 433MHz protocols
bash 
sudo apt install inspectrum gqrx
# URH: pip install urh

Legal Considerations

  • Transmitting on most frequencies requires a license (FCC, Ofcom, etc.)
  • Replaying signals you don't own is illegal in many jurisdictions without authorization
  • Jamming is illegal essentially everywhere
  • Use in authorized pen tests or shielded environments (RF cage)

See Also

  • software-defined-radio-sdr - SDR overview and RTL-SDR (RX only)
  • rfid-nfc-tools - Close-range RF tools
  • bluetooth-hacking - Bluetooth attacks
techzonesite.comUnlock Your IT Potential