CESH 200 Unusual Radio Frequency Penetration Testing Concepts

Concepts · 3 days · Not assessed

About the course

Radio-frequency security covers a lot of ground, and this course walks your team across all of it at working depth, so they can read the whole attack surface before they specialise.

They begin with RF and spectrum fundamentals, antennas and the signal chain, then move through capture, modulation and demodulation, and the slow work of pulling a clean bitstream out of a noisy recording. From there they reverse engineer unfamiliar and proprietary protocols, and get a first go at transmitting, replaying and interfering with signals.

They drive the open SDR toolchain throughout, on real captures rather than tidy lab examples. By the end they can pick up an unknown device, work out what it is saying over the air, and judge where it is weak.

Want to know what to expect in the classroom? Find out more about our training approach and how we turn technical concepts into practical, hands-on skills.

Skills and topics covered

This list shows the various main topics we cover during the course:

RF and spectrum fundamentals
Antennas and the signal chain
Signal capture with SDR
Modulation and demodulation
Recovering the bitstream from noise
Protocol reverse engineering
Transmitting, replaying and interfering
Core tools such as GNU Radio
Reading an unknown device over the air
Attack-surface assessment for RF

What will a new trainee gain?

Your new entrants leave with a working mental model of the whole RF attack surface, so radio stops being a black box and becomes something they can capture, decode and reason about. For your organisation, that means a junior who can hold a sensible conversation about wireless risk and move straight into the deeper RF courses without retraining.

What will an experienced team member gain?

An experienced engineer ties together the skills they may already half-hold (capture, demodulation, protocol work), so RF stops being a set of one-off recipes and becomes a repeatable process. For your team, that turns a capable individual into someone who can scope an unfamiliar wireless target and decide which specialism it actually warrants.

Who this course is for

This course is for security professionals, penetration testers and technical trainees who want to understand and assess radio-frequency attack surfaces. No specialist RF experience is required, although general technical or security knowledge is useful. It provides the practical foundations needed to capture, decode and reason about wireless signals before progressing into the more specialised RF courses.

Not sure where you fit? Find out more about our training audience and prerequisites.

Required equipment, tools, and software

You will need a laptop with at least 8GB RAM, preferably 16GB, an up-to-date and stable operating system, and an Ethernet port or reliable Ethernet dongle. Your laptop must be fully under your control so that you can install tools and dependencies and run arbitrary code.

It is useful to have the ability to run virtual machines. Any VMs provided during the course will be suitable for importing into VirtualBox; if you use a different hypervisor, you should be comfortable importing VMs from OVF file formats.

All specialist RF hardware, SDR equipment and other tools required for the practical exercises will be provided during the course. You do not need to bring any additional radio or analysis equipment.

We put together a goodie bag which directly relates to the activities in the course. The free goodie bag is yours to keep at the end of the course, just make sure you have enough luggage space to take it home. The exact details of what is in it will vary depending on availability but we always make it a useful and interesting collection. We provide any other tools needed to complete all the tasks set, aside from a laptop.

You don’t need to bring anything extra other than your enthusiasm!

Venue and travel information

The classroom

The classroom is well appointed, has good WiFi and hot and cold drinks, it’s spacious, comfortable, has plenty of power sockets, lots of natural light, and is wheelchair friendly. The course is delivered in English and digital versions of slides and handouts will be provided where appropriate.

Food and refreshments

Lunch and morning and afternoon snacks are provided so please make sure you let us know about any dietary needs at least a week before we get started. With the exception of the social night, all other meals are for you to organise. We suggest getting a hotel that provides breakfast, and there are many good restaurants in Manchester for your evening meals. We will try and facilitate additional social arrangements, but, this is down to the individuals present.

Staying in Manchester

There are a number of good and affordable hotels in the Manchester area. We are based in an area called Media City and we are in the same complex as the northern headquarters of the BBC. This means that there are lots of facilities locally and you could choose to not venture into the city centre.

Getting here

If you do choose to look further around there are good tram links that can take you into the city as well as to key travel hubs such as Piccadilly, the national railway station, and Manchester International Airport.

Please check the weather before you travel and bring suitable clothes for the season. If in doubt, assume you will need a waterproof coat and an umbrella. The locals will tell you that Manchester is one of the rainiest places in the world, its not actually true but it does drizzle more than you might expect, even in summer.

Ready to start hacking the airwaves?

Build a practical understanding of the RF attack surface and learn how to investigate unfamiliar wireless devices from first capture to security assessment. Over three days, you’ll work with real signals and SDR tooling to capture, demodulate and decode transmissions, reverse engineer protocols and explore how wireless systems can be attacked.

Back to all courses