offensive-bluetooth-classic

# Bluetooth Classic (BR/EDR) Attacks Older than BLE, less commonly attacked today, but still present in cars, industrial sensors, audio gear, and legacy enterprise hardware. Many of the well-known historic attacks (BlueSnarf, BlueBug) are mitigated; KNOB and the BlueBorne family remain relevant against unpatched devices. ## Quick Workflow 1. Discover devices with `hcitool` / `bluetoothctl` / `redfang` 2. Enumerate exposed services via SDP 3. Test each service profile for unauth access 4. Check pairing crypto (KNOB applicability) 5. Proximity-physical attacks for legacy / unpatched --- ## Discovery ```bash # Modern adapter (built-in or USB Bluetooth 4.0+) sudo hciconfig hci0 up sudo hcitool inq # inquiry sudo hcitool scan --length=12 # 12-second scan # bluetoothctl interactive bluetoothctl > scan on > devices # Discoverable-mode-only devices appear; non-discoverable need address brute sudo redfang -r 00:00:00:00:00:00-FF:FF:FF:FF:FF:FF # (very slow — ~7 hours per OUI prefix) ``` ## Service Discovery (SDP) ```bash # List all services on a device sdptool browse AA:BB:CC:DD:EE:FF sdptool records AA:BB:CC:DD:EE:FF ``` Common profiles and their attack relevance: | Profile | UUID | Attack | |---|---|---| | OBEX Object Push (OPP) | 0x1105 | BlueSnarf/BlueBug on legacy phones (mostly extinct) | | OBEX File Transfer (FTP) | 0x1106 | Browse / write filesystem on legacy devices | | Headset (HSP/HFP) | 0x1108 / 0x111E | Eavesdrop active call audi...