offensive-bluetooth-classic
starsforks
How to install offensive-bluetooth-classic?
snailsploit/claude-red/offensive-bluetooth-classic
$npx -y skills add SnailSploit/Claude-Red --skill offensive-bluetooth-classicBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance
SKILL.md
| 1 | # Bluetooth Classic (BR/EDR) Attacks |
| 2 | |
| 3 | Older than BLE, less commonly attacked today, but still present in cars, industrial sensors, audio gear, and legacy enterprise hardware. Many of the well-known historic attacks (BlueSnarf, BlueBug) are mitigated; KNOB and the BlueBorne family remain relevant against unpatched devices. |
| 4 | |
| 5 | ## Quick Workflow |
| 6 | |
| 7 | 1. Discover devices with `hcitool` / `bluetoothctl` / `redfang` |
| 8 | 2. Enumerate exposed services via SDP |
| 9 | 3. Test each service profile for unauth access |
| 10 | 4. Check pairing crypto (KNOB applicability) |
| 11 | 5. Proximity-physical attacks for legacy / unpatched |
| 12 | |
| 13 | --- |
| 14 | |
| 15 | ## Discovery |
| 16 | |
| 17 | ```bash |
| 18 | # Modern adapter (built-in or USB Bluetooth 4.0+) |
| 19 | sudo hciconfig hci0 up |
| 20 | sudo hcitool inq # inquiry |
| 21 | sudo hcitool scan --length=12 # 12-second scan |
| 22 | |
| 23 | # bluetoothctl interactive |
| 24 | bluetoothctl |
| 25 | > scan on |
| 26 | > devices |
| 27 | |
| 28 | # Discoverable-mode-only devices appear; non-discoverable need address brute |
| 29 | sudo redfang -r 00:00:00:00:00:00-FF:FF:FF:FF:FF:FF |
| 30 | # (very slow — ~7 hours per OUI prefix) |
| 31 | ``` |
| 32 | |
| 33 | ## Service Discovery (SDP) |
| 34 | |
| 35 | ```bash |
| 36 | # List all services on a device |
| 37 | sdptool browse AA:BB:CC:DD:EE:FF |
| 38 | sdptool records AA:BB:CC:DD:EE:FF |
| 39 | ``` |
| 40 | |
| 41 | Common profiles and their attack relevance: |
| 42 | |
| 43 | | Profile | UUID | Attack | |
| 44 | |---|---|---| |
| 45 | | OBEX Object Push (OPP) | 0x1105 | BlueSnarf/BlueBug on legacy phones (mostly extinct) | |
| 46 | | OBEX File Transfer (FTP) | 0x1106 | Browse / write filesystem on legacy devices | |
| 47 | | Headset (HSP/HFP) | 0x1108 / 0x111E | Eavesdrop active call audio | |
| 48 | | Serial Port Profile (SPP) | 0x1101 | Industrial/IoT debug ports — often unauthenticated | |
| 49 | | HID | 0x1124 | Keyboard/mouse impersonation | |
| 50 | | Audio Sink/Source (A2DP) | 0x110B / 0x110A | Audio injection/eavesdrop | |
| 51 | |
| 52 | ## SPP Abuse |
| 53 | |
| 54 | The Serial Port Profile (SPP) tunnels arbitrary data over Bluetooth as a virtual COM port. Industrial / IoT devices use it for debug or telemetry, often without authentication. |
| 55 | |
| 56 | ```bash |
| 57 | # Connect to SPP service, channel typically 1 |
| 58 | sudo rfcomm bind /dev/rfcomm0 AA:BB:CC:DD:EE:FF 1 |
| 59 | sudo screen /dev/rfcomm0 9600 |
| 60 | # Then interact with the device's CLI / debug menu |
| 61 | ``` |
| 62 | |
| 63 | ## KNOB (CVE-2019-9506) |
| 64 | |
| 65 | Forces Bluetooth pairing to negotiate a 1-byte encryption key — making the link key trivially brute-forceable. |
| 66 | |
| 67 | ```bash |
| 68 | # Test with internalblue (requires Broadcom firmware patch) |
| 69 | git clone https://github.com/seemoo-lab/internalblue |
| 70 | internalblue |
| 71 | > log keys |
| 72 | # Patch firmware to allow 1-byte key; pair with target; observe weak key |
| 73 | ``` |
| 74 | |
| 75 | Patched in firmware on most modern devices. Still works against: |
| 76 | - Older Broadcom-based devices (pre-2019 BCM chipsets) |
| 77 | - Embedded automotive Bluetooth stacks |
| 78 | - Cheap consumer audio gear |
| 79 | |
| 80 | ## BlueBorne (CVE-2017-1000251 et al.) |
| 81 | |
| 82 | A family of buffer overflows / info leaks in major Bluetooth stacks (Linux BlueZ, Android, Windows, iOS). Mostly patched 2017–2018, but unpatched embedded Linux devices are common. |
| 83 | |
| 84 | ```bash |
| 85 | # Armis blueborne-scanner — checks for patch-level |
| 86 | git clone https://github.com/ArmisSecurity/blueborne |
| 87 | python blueborne_scanner.py AA:BB:CC:DD:EE:FF |
| 88 | ``` |
| 89 | |
| 90 | ## HID Spoofing (PoC) |
| 91 | |
| 92 | If pairing succeeds via Just Works or weak PIN, you can register as a HID device — keystroke injection on an unattended Bluetooth-paired host. |
| 93 | |
| 94 | ```bash |
| 95 | # bdaddr + HID example — register custom HID on rfcomm |
| 96 | hcitool dev |
| 97 | hciconfig hci0 class 0x000540 # HID device class |
| 98 | sdptool add HID |
| 99 | # Use a HID descriptor crafted as keyboard, send keystrokes |
| 100 | ``` |
| 101 | |
| 102 | ## Audio Eavesdropping |
| 103 | |
| 104 | If a target has Bluetooth headset paired and active, and you can re-pair (PIN brute or KNOB): |
| 105 | |
| 106 | - HSP/HFP profiles let you become the peer and receive audio |
| 107 | - Some firmware allows simultaneous peer connections — eavesdrop without disrupting |
| 108 | |
| 109 | ## Engagement Cheatsheet |
| 110 | |
| 111 | ```bash |
| 112 | # 1. Discover |
| 113 | sudo hcitool inq |
| 114 | |
| 115 | # 2. Enumerate services per device |
| 116 | sdptool browse <MAC> |
| 117 | |
| 118 | # 3. SPP (industrial/IoT) — connect and explore |
| 119 | sudo rfcomm bind /dev/rfcomm0 <MAC> 1 |
| 120 | sudo screen /dev/rfcomm0 9600 |
| 121 | |
| 122 | # 4. Patch-level scan |
| 123 | python blueborne_scanner.py <MAC> |
| 124 | |
| 125 | # 5. KNOB testing (with adapter that supports internalblue) |
| 126 | internalblue → log keys → re-pair target |
| 127 | |
| 128 | # 6. Document profiles, auth state, exposed commands per device |
| 129 | ``` |
| 130 | |
| 131 | ## Detection |
| 132 | |
| 133 | - No native Bluetooth Classic IDS in most environments |
| 134 | - Active inquiry visible to nearby Bluetooth-aware monitoring (rare) |
| 135 | - Re-pairing prompts on target devices may surface to users |
| 136 | |
| 137 | ## Reporting |
| 138 | |
| 139 | - Identify chipset + firmware version per device (often visible in service reco |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
