Bluetooth Pentesting Tools (HW/SW)

Summary

This article describes various tools for bluetooth penetration testing and aims to provide an overview to choose the right tool for a use case.

Requirements

• Operating system: Kali Linux amd64 2019.2
• Packages: Individual shown for each tool

In order to use hardware pentesting devices a dedicated installation of kali linux is recommended but it is also possible to use hypervisors which are capable of passing USB devices from the host- to the guestsystem e.g. VMWare Workstation or the free hypervisor VirtualBox.

Information gathering

The offical linux bluetooth protocol stack BlueZ is already installed on kali linux but can be installed on other linux maschines with:

apt install -y bluez bluez-utils
systemctl start bluetooth.service
systemctl status bluetooth.service

hcitool

To start with penetration testing we need to gather information about our environment, for this purpose scan for available bluetooth devices with the included packages 'hcitool' or 'bluetoothctl'.

First check if your bluetooth device is available:

hciconfig

Scan for BR/EDR Bluetooth devices with hcitool:

hcitool scan

In order to scan for BLE devices use:

hcitool lescan

bluetoothctl

Alternatively you can use bluetoothctl which is also included in the bluez-utils package:

bettercap

In order to complete these steps, you must have followed Install_Bettercap_on_Kali_Linux before.

Bettercap is a powerful tool for Wifi, Bluetooth LE or ethernet hijacking and provides tools for MITM attacks. Bettercap can also be used to gather informations about bluetooth devices like shown below:

Start bettercap with:

bettercap

Scanning for BLE devices:

ble.recon on

Show a formatted output of found BLE devices:

ble.show

bluelog

Another great tool for bluetooth device discovery is 'bluelog'. It is extremly lightweight and can be automated for background usage without user intervention. Bluelog is already preinstalled on kali linux but can be installed with:

apt install -y bluelog

To start scanning for bluetooth devices use:

bluelog -nmtc

(n=log device names;m=log manufacturer;t=log timestamps of discovery;c=log device class)

Capturing bluetooth traffic

btmon

With the preinstalled package 'btmon' it is possible to capture traffic between the HCI and the controller:

btmon --write ~/Documents/bttraffic.snoop

These files can be viewed and analysed with 'Wireshark' which is also preinstalled on kali linux.

Wireshark

Alternatively you can capture bluetooth traffic directly with Wireshark. Start Wireshark with...

wireshark -w ~/Documents/bttraffic.snoop

...and select your bluetooth interface e.g. bluetooth0 or bluetooth1.

Bluetooth Pentesting Software

In the following chapter we will present some software pentesting tools which are used for ethical bluetooth device hacking.

BlueMaho

BlueMaho is a tool suite for bluetooth device pentesting and provides various exploits. Although it is still listed in the kali linux tool list, it has to be manually installed:

apt install autoconf build-essential build-dep git python-wxtools 
git clone https://github.com/zenware/bluemaho
cd bluemaho/config
./build.sh

In order to run the GUI use:

./bluemaho.py

Bluetooth Pentesting Hardware

For hardware pentesting devices like the Ubertooth one please see following documentations:

• Bluetooth_Sniffing_with_Ubertooth:_A_Step-by-step_guide
• Bluetooth_Hacking_Ubertooth

Another BLE penetration testing example with the powerful GATT Tool can be found here:

• Bluetooth_GATT_Tool_Basics_with_the_MiPow_Playbulb_Candle

References

• https://wikipedia.org
• https://google.com