# Offensive Bluetooth Classic

Bluetooth Classic (BR/EDR) attack methodology, device discovery, service enumeration...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Media
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-classic -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-classic -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-classic -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-classic -g -a gemini-cli -y`

## Description

Bluetooth Classic (BR/EDR) attack methodology, device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR), common in legacy car kits, industrial sensors, older medical devices, and audio accessories.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Bluetooth Classic (BR/EDR) Attacks

Older than BLE, less commonly attacked today, but still present in cars, industrial sensors, audio gear, and legacy enterprise hardware. Many of the well-known historic attacks (BlueSnarf, BlueBug) are mitigated; KNOB and the BlueBorne family remain relevant against unpatched devices.

## Quick Workflow

1. Discover devices with `hcitool` / `bluetoothctl` / `redfang`
2. Enumerate exposed services via SDP
3. Test each service profile for unauth access
4. Check pairing crypto (KNOB applicability)
5. Proximity-physical attacks for legacy / unpatched

---

## Discovery

```bash
# Modern adapter (built-in or USB Bluetooth 4.0+)
sudo hciconfig hci0 up
sudo hcitool inq                       # inquiry
sudo hcitool scan --length=12          # 12-second scan

# bluetoothctl interactive
bluetoothctl
> scan on
> devices

# Discoverable-mode-only devices appear; non-discoverable need address brute
sudo redfang -r 00:00:00:00:00:00-FF:FF:FF:FF:FF:FF
# (very slow, ~7 hours per OUI prefix)
```

## Service Discovery (SDP)

```bash
# List all services on a device
sdptool browse AA:BB:CC:DD:EE:FF
sdptool records AA:BB:CC:DD:EE:FF
```

Common profiles and their attack relevance:

| Profile | UUID | Attack |
|---|---|---|
| OBEX Object Push (OPP) | 0x1105 | BlueSnarf/BlueBug on legacy phones (mostly extinct) |
| OBEX File Transfer (FTP) | 0x1106 | Browse / write filesystem on legacy devices |
| Headset (HSP/HFP) | 0x1108 / 0x111E | Eavesdrop active call audio |
| Serial Port Profile (SPP) | 0x1101 | Industrial/IoT debug ports, often unauthenticated |
| HID | 0x1124 | Keyboard/mouse impersonation |
| Audio Sink/Source (A2DP) | 0x110B / 0x110A | Audio injection/eavesdrop |

## SPP Abuse

The Serial Port Profile (SPP) tunnels arbitrary data over Bluetooth as a virtual COM port. Industrial / IoT devices use it for debug or telemetry, often without authentication.

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/wireless/offensive-bluetooth-classic/SKILL.md