Bluetooth Pentesting Guide

TL;DR

This guide shows you how to test your Bluetooth security. We’ll cover scanning for devices, attempting connections, and common attack methods. Warning: Only test devices you own or have permission to test. Unauthorized testing is illegal.

1. Setting up Your Environment

You’ll need a Linux distribution (Kali Linux is popular) and a Bluetooth adapter that supports packet injection. Most built-in adapters work, but an external one might be better for range and power.

• Install necessary tools: Open a terminal and run:

  sudo apt update && sudo apt install bluetoothctl bluez hcitool

2. Scanning for Bluetooth Devices

Use bluetoothctl to find nearby devices.

1. Enter the Bluetooth control interface:

   sudo bluetoothctl

2. Power on the adapter:

   power on

3. Start scanning:

   scan on

4. List discovered devices: You’ll see MAC addresses and device names. Note the target’s MAC address.

   devices

5. Stop scanning:

   scan off

3. Connecting to a Device

Attempt to pair with the target device.

1. Pair with the device (replace XX:XX:XX:XX:XX:XX with the MAC address):

   pair XX:XX:XX:XX:XX:XX

2. Trust the device: This prevents repeated pairing prompts.

   trust XX:XX:XX:XX:XX:XX

3. Connect to the device:

   connect XX:XX:XX:XX:XX:XX

4. Common Attack Methods

These attacks require more advanced tools and understanding of Bluetooth protocols.

• Bluejacking: Sending unsolicited messages to nearby devices. Tools like bluejack can be used.
• Bluesnarfing: Accessing data from a device without authorization (contacts, calendar, etc.). Requires exploiting vulnerabilities in the Bluetooth stack.
• Bluebugging: Gaining control of a device remotely. This is more complex and requires significant knowledge of the target’s firmware.
• MITM Attacks: Intercepting communication between devices. Tools like gatt-tool can be used to interact with GATT services.

5. Using hciconfig for Adapter Control

hciconfig allows you to configure your Bluetooth adapter.

• Get adapter information:

  hciconfig -a hci0

• Set the adapter into inquiry mode (discoverable):

  sudo hciconfig hci0 up; sudo hciconfig hci0 leaded

6. Important Considerations

• Range: Bluetooth has a limited range. Get closer to the target device for better signal strength.
• Device Compatibility: Not all devices are vulnerable to the same attacks.
• Legal Implications: Always obtain permission before testing someone else’s device.