Bluetooth Pentesting guide 101

Just interesting in daily life that we cant see properly called signals that we can't see with our own eyes

but devices can do there many wireless communication are there like

Wireless Communication protocols in IoT:

  1.  wifi (wireless fidelity)
  2.  bluetooth 
  3.  zigbee
  4.  zwave 
  5.  LoRA
  6.  GSM
But let's get into the topic Mostly relevant 

Vulnerabilities in Bluetooth:

  1.  Authentication and authorization issues
  2.  MiTM
  3.  DoS
  4.  MAC Spoofing
  5.  PIN Cracking
  6.  Brute force

In android Bluetooth mostly we will get this type vulnerability:

  1.  RCE        Remote code Execution
  2.  EoP        Elevation of Privilege
  3.  ID         Information Disclosure
  4.  DoS        Denial of Service
  5.  PAIR       Pairing without Auth

In major level: 

  1.  Hardware
  2.  Memory Leakage 

Well same procedure what we scan the surrounding devices and start attacks from the write-ups available in google

Let’s see little difference right now we need to know how Bluetooth works

Lets start with Required installation tools: 

A written bash script for the BLE Pentesting tools to install in a Ubuntu or debian OS 
just download from here


And give the permission to run chmod +x


Will install requirement tools with dependencies as well.All good with tools what i need to do just need to understand what to do before we need to start hacking , fuzzing and MiTM on BLE devices

ESP32 - Espressif Device
Smartband bought from flipkart - 359 /- Rupees - or we can buy from the banggood or any other online sellers

ESP32      Smartband

Bluetooth Pentest Guide:


1. Flashing the codes to ESP32
2. Understanding BLE with Mobile App Configuration
3. Recon Techniques 
4. Finding the Vulnerabilities 
5. Python & easy bash scripts 
6. Cheatsheet

General Cheat Sheet

dmesg | egrep -i 'blue|firm'

Hcitool tool:

hciconfig - sudo apt-get install bluez

For Non LE Devices:

hcitool scan - to scan the basic bluetooth devices
hcitool info <baddr> - 

For LE Devices :

hcitool lescan - for scanning the LE devices 
hcitool leinfo <baddr> - for getting the info of the LE Devices

Install bleak 

sudo pip3 install bleak
sudo pip install service_identity

Usage : sudo bleak-lescan


sudo sdptool browse --tree --raw <baddr> : Browse all available services on the device specified by a Bluetooth address as a parameter


Popular posts from this blog

VR Model P1 - 360 degree camera

Buspirate v3.6 firmware upgrade from USB

Dumping the Firmware from the device Using buspirate - SPI