Aether-U — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Aether-U is a multi-phase UWB (Ultra-Wideband / IEEE 802.15.4z) and Real-Time Location System (RTLS) penetration testing orchestrator. It targets the network, application, and physical layers of UWB-based positioning and tracking systems used in asset tracking, access control, and industrial environments.

The assessment progresses through five phases: Phase 1 (Survey) discovers RTLS infrastructure including anchors, tags, servers, and MQTT brokers on the network. Phase 2 (Protocol Analysis) passively examines MQTT topics and UWB protocol traffic to understand the system's messaging architecture, data formats, and security configurations without alerting the system. Phase 3 (Active Interaction) performs active testing against RTLS APIs and MQTT brokers, including authentication testing, authorization bypass attempts, and message injection to evaluate whether location data can be spoofed or manipulated.

Phase 4 (Physical Attacks) assesses physical-layer vulnerabilities that require specialized UWB hardware, including relay attacks (extending the perceived range of a UWB tag), distance manipulation, and anchor impersonation. Phase 5 (Network & Application) tests the broader network and application layer of the RTLS deployment, including web management interfaces, API security, and integration points with other systems.

Aether-U integrates with Crucible v2 via __CRUCIBLE_* protocol tokens (using the __SPECTRE_* variant for backward compatibility with the Spectre management UI) and writes findings to the universal pr0t31n schema. It supports pause/resume and structured output including RTLS-specific metadata in findings.

Phase Pipeline

Phase 1 — Survey & Discovery
Phase 2 — USB Device Enumeration
Phase 3 — Protocol Analysis
Phase 4 — Vulnerability Assessment
Phase 5 — Attack Execution

Security

CLI tool. Phase 4 (physical-layer UWB testing) requires specialized hardware. Network phases test MQTT brokers and RTLS APIs.

Features

Active Testing

RTLS API Security Testing

Phase 3: Tests RTLS management APIs for authentication bypass, authorization flaws, and injection vulnerabilities that could allow unauthorized access to location data or system configuration.

MQTT Message Injection

Phase 3: Attempts to inject crafted MQTT messages to spoof device locations, trigger false geofence alerts, or manipulate tracking data.

Integration

Crucible/Spectre Management

Full integration with Crucible v2 via __SPECTRE_* protocol tokens for real-time status tracking, log streaming, and finding emission.

Network/Application

Web Interface Assessment

Phase 5: Tests RTLS web management interfaces for standard web application vulnerabilities including authentication flaws, XSS, and API security issues.

Physical Attacks

UWB Relay Attack Testing

Phase 4: Tests UWB ranging implementations for relay attack susceptibility where an attacker extends the apparent proximity of a UWB tag to bypass distance-based access controls.

Distance Manipulation

Phase 4: Evaluates whether UWB time-of-flight measurements can be manipulated to report incorrect distances, potentially defeating secure ranging protocols.

Protocol Analysis

MQTT Topic Enumeration

Phase 2: Passively monitors MQTT broker communications to enumerate topics, understand data formats, and identify location data streams and control channels.

UWB Protocol Examination

Phase 2: Analyzes UWB ranging and positioning protocol traffic to understand the system's security posture, encryption usage, and integrity protection mechanisms.

Reliability

Pause & Resume

Supports graceful pause via pr0t31n_pause, allowing interruption and resumption of long-running RTLS assessments.

Survey

RTLS Infrastructure Discovery

Phase 1: Discovers UWB anchors, tags, RTLS servers, and MQTT brokers on the network through active scanning and service fingerprinting.

Use Cases

UWB Access Control Assessment

Test UWB-based physical access control systems (car key fobs, building access, secure areas) for relay attacks and distance manipulation that could bypass proximity-based authentication.

Industrial RTLS Security Review

Assess industrial asset tracking systems for unauthorized location data access, position spoofing that could mask equipment theft or personnel location, and MQTT broker security.

Healthcare RTLS Assessment

Evaluate hospital real-time location systems used for patient tracking, equipment management, and staff safety for data privacy, position manipulation, and unauthorized access risks.

Smart Building UWB Assessment

Test UWB-based indoor positioning systems in smart buildings for location privacy leaks, unauthorized tracking, and manipulation of occupancy-based automation triggers.

Automotive UWB Key Fob Testing

Assess automotive UWB digital key implementations for relay attack resilience, verifying that IEEE 802.15.4z secure ranging properly prevents distance fraud.

CLI Reference

Command Examples

Run with Config

python3 aether_u.py --config config.json --project uwb_test

Run UWB/RTLS assessment with configuration specifying infrastructure details.

Survey Phase Only

python3 aether_u.py --phase survey --project uwb_recon

Run only the infrastructure survey phase.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

nmap

Network discovery of RTLS infrastructure components including anchors, servers, and MQTT brokers

nmap -sV -p 1883,8883,80,443 192.168.1.0/24

mosquitto_sub

MQTT topic subscription for passive monitoring and active testing of RTLS message brokers

mosquitto_sub -h broker.local -t '#' -v

mosquitto_sub -h broker.local -t 'rtls/location/#'

mosquitto_pub

MQTT message publishing for injection testing against RTLS data streams

mosquitto_pub -h broker.local -t 'rtls/location/tag001' -m '{"x":100,"y":200}'

curl

HTTP/HTTPS testing of RTLS management APIs and web interfaces

curl -sk https://rtls-server.local/api/v1/tags

curl -X POST https://rtls-server.local/api/v1/geofences

Finding Nomenclature

Aether-U findings use the AE- prefix in their catalogue IDs, shared with the Aether wireless family. RTLS-specific findings include metadata in the wireless_data field:

rtls_vendor — the RTLS system vendor and product name
component_type — anchor, tag, server, or broker
protocol — UWB, MQTT, HTTP, or combined

Risk levels: successful location spoofing or relay attacks that bypass access controls are CRITICAL; unauthorized access to location data streams is HIGH; weak MQTT authentication is MEDIUM; informational infrastructure discovery is INFO.

Action Items

Aether-U generates action items for physical UWB testing — e.g., "Conduct distance spoofing test with UWB transceiver", "Test relay attack against ranging protocol".

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`findings_catalogue.json`	JSON	Findings catalogue

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Aether-U && python3 aether_u.py` Run directly with command-line arguments.
CLI — Settings File	`cd /opt/pr0t31n/Aether-U && python3 aether_u.py --config config.json` Configure via config.json (JSON), then run.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Used By

Crucible (manages)
Prometheus (reports)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
nmap	Gordon Lyon (Fyodor)	system	https://github.com/nmap/nmap
tshark / Wireshark	Gerald Combs / Wireshark Foundation	system	https://github.com/wireshark/wireshark
mosquitto-clients	Eclipse Foundation / Roger Light	system	https://github.com/eclipse/mosquitto
sqlmap	Bernardo Damele / Miroslav Stampar	system	https://github.com/sqlmapproject/sqlmap
curl	Daniel Stenberg	system	https://github.com/curl/curl
paho-mqtt	Eclipse Foundation	python	https://github.com/eclipse/paho.mqtt.python

Metadata

Name	Aether-U
Category	Wireless
Version	1.5.1
Install Path	`/opt/pr0t31n/Aether-U`
Main File	`aether_u.py`
GitHub	https://github.com/pr0t31n/Aether-U.git