BlueToolkit - BlueToolkit is an extensible Bluetooth Classic vu

项目说明

<!-- # BlueToolkit -->

<h1 align="center">
<picture>
<source srcset="/static/bluetoolkit_white.png" media="(prefers-color-scheme: dark)">
<img src="/static/bluetoolkit.png" width="300px" alt="BlueToolkit">
</picture>
</h1>

<h4 align="center">Extensible Bluetooth testing framework for BR/EDR and BLE.</h4>

<p align="center">
<a href=" •
<a href="#install">Installation</a> •
<a href="#usage">Usage</a> •
<a href="#arabilities-and-attacks">Exploits</a> •
<a href="#hardware">Hardware</a> •
<a href="#TODO-list">TODOs </a> •
<a href=" •
<a href="#bluetooth-cks">Bluetooth Resources</a> •
<a href="#license">License</a>
</p>

---

BlueToolkit is a modular, black-box Bluetooth security testing framework for Bluetooth Classic (BR/EDR) and Bluetooth Low Energy (BLE). It supports semi-automated testing and has three main modules:

Recon: gathers Bluetooth capabilities and security configuration.

Exploit: executes tests for (currently) 43 public exploits (MitM, RCE, DoS, etc.). The templates are in the exploits folder. Support for more can be added by TODO.

Report: generates structured, machine- and human-readable JSON reports.

<!-- TODO: talk about extensibility -->

<!-- The framework works in a Black-box fashion, but it is also possible to operate the toolkit in a Gray-box fashion. For that one needs to extend the framework and connect it to the Operating System of the target so that it would be possible to obser logs and guarantee no false positives. -->

We e BlueToolkit on 22 cars from different (Audi, BMW, Che, Honda, Hyundai, Mercedes-Benz, Mini, Opel, Polestar, Renault, Skoda, Toyota, ) and uncovered 128 .

In addition, we show how to Hijack online accounts via MAP for already established connections or with a MitM position.

This work led to a research paper accepted at WOOT 25': *add missing link when we have it*

Installation

BlueToolkit can be installed on bare metal Ubuntu/Debian systems (recommended) or using a Machine. In both cases the installer will prompt to install the specific modules for Braktooth and BluetoothAssistant, which require specific hardware devices to be a and plugged in.
Standalone modules installation can also be done separately by running the installer again.

<details>
<summary>Normal Installation</summary>
Installation:

</details>

<details>
<summary></summary>

Prerequisites:
*
*

After Installation:
* You need to allow the machine to access the Bluetooth module or additional hardware through USB, which requires you to do the following:
* USB support is already switched on, that's why open
* Find a running machine and click on "Show"
* Click on "Devices" -> "USB"
* You will be presented with multiple devices that you can switch on for the machine
* Tick any device that you need (Bluetooth module, hardware, phone) or tick all devices to be sure.

</details>

Usage

Run bluekit -h to display BlueToolkit usage information:

Some usage examples are:

List all a exploits (no root required):

bluekit -l

Run recon:

sudo bluekit -t AA:BB:CC:DD:EE:FF -r

Test connectivity:

sudo bluekit -t AA:BB:CC:DD:EE:FF -ct

Test one or more exploits (space separated):

sudo bluekit -t AA:BB:CC:DD:EE:FF -e in au_rand_flooding internalblue_knob

More documentation is a in our wiki

Hardware

Some attacks require specific hardware:

* ESP-WRO for Braktooth
* Nexus5 phone for Internalblue. Could be replaced with a CYW20735 but two exploits won't work and it would need a new hardware profile.
* CYW920819M2EVB-01 for BIAS, BLUR and BLUFFS attacks.

A Bluetooth and Attacks

BlueToolkit automatically downloads all and hardware templates. BlueToolkit templates repository provides a full list of ready-to-use templates.
Additionally, you can write your own templates and checks as well as add new hardware by following BlueToolkit's templating guide
The YAML reference syntax is a here

We collected and classified Bluetooth in an "Awesome Bluetooth Security" way. We used the following sources - ACM, IEEE SP, Blackhat, DEFCON, Car Hacking , NDSS, and Google Scholars. Looked for the following keywords in Search Engines such as Google, Baidu, Yandex, Bing - Bluetooth security toolkit, Bluetooth exploits github, Bluetooth security framework, bluetooth pentesting toolkit. We also parsed all Github repositories based on the following parameters - topic:bluetooth topic:exploit, topic:bluetooth topic:security.

Currently BlueToolkit check the following and attacks:

For manual attacks refer to the documentation.

| | Category | Type | type | Hardware req. | Tested |
|----------------------------------------------| :---: | :---: | :---: | :---: | :---: |
| Always pairable | Chaining | Chaining | Manual | | ✓ |
| Only can initiate a connection | Chaining | Chaining | Manual | | ✓ |
| Fast reboot | Chaining | Chaining | Manual | | ✓ |
| SC not supported | Chaining | Info | Automated | | ✓ |
| possible check for BLUR | Chaining | Info | Automated | | ✓ |
| My name is keyboard | Critical | RCE | Semi-automated | | ✓ |
| C | Critical | Memory leak | Automated | | ✓ |
| C | Critical | Memory execution | Automated | | ✓ |
| V13 Invalid Max Slot Type | DoS | DoS | Automated | ✓ | ✓ |
| V3 Duplicated IOCAP | DoS | DoS | Automated | ✓ | ✓ |
| NiNo check | MitM | MitM | Semi-automated | | ✓ |
| Legacy pairing used | MitM | MitM | Automated | | ✓ |
| KNOB | MitM | MiTM | Semi-automated | ✓ | ✓ |
| C | MitM | MiTM | Automated | ✓ | ✓ |
| Method Confusion attack | MitM | MiTM | Automated | | ✓ |
| SSP supported <= 4.0 weak crypto or SSP at all | MitM | Info/MitM | Automated | | ✓ |
| C | Critical | DoS | Automated | | ✓ |
| C | Critical | Info leak | Automated | | ✓ |
| C | Critical | RCE/DoS | Automated | | ✓ |
| C | Critical | RCE/DoS | Automated | | ✓ |
| V1 Feature Pages Execution | Critical | RCE/DoS | Automated | ✓ | ✓ |
| Unknown duplicated encapsulated payload | DoS | DoS | Automated | ✓ | ✓ |
| V2 Truncated SCO Link Request | DoS | DoS | Automated | ✓ | ✓ |
| V4 Feature Resp. Flooding | DoS | DoS | Automated | ✓ | ✓ |
| V5 LMP Auto Rate O | DoS | DoS | Automated | ✓ | ✓ |
| V6 LMP 2-DH1 O | DoS | DoS | Automated | ✓ | ✓ |
| V7 LMP DM1 O | DoS | DoS | Automated | ✓ | ✓ |
| V8 Truncated LMP Accepted | DoS | DoS | Automated | ✓ | ✓ |
| V9 Invalid Setup Complete | DoS | DoS | Automated | ✓ | ✓ |
| V10 Host Conn. Flooding | DoS | DoS | Automated | ✓ | ✓ |
| V11 Same Host Connection | DoS | DoS | Automated | ✓ | ✓ |
| V12 AU Rand Flooding | DoS | DoS | Automated | ✓ | ✓ |
| V14 Max Slot Length O | DoS | DoS | Automated | ✓ | ✓ |
| V15 Invalid Timing Accuracy | DoS | DoS | Automated | ✓ | ✓ |
| V16 Paging Scan Deadlock | DoS | DoS | Automated | ✓ | ✓ |
| Unknown wrong encapsulated payload | DoS | DoS | Automated | ✓ | ✓ |
| Unknown sdp unknown element type | DoS | DoS | Automated | ✓ | ✓ |
| Unknown sdp o element size | DoS | DoS | Automated | ✓ | ✓ |
| Unknown feature req ping pong | DoS | DoS | Automated | ✓ | ✓ |
| Unknown lmp invalid transport | DoS | DoS | Automated | ✓ | ✓ |
| C | Critical | Info leak | Automated | | ✓ |

No

These attacks a novel/new and are tested by the framework

| | Category | Type | type | Hardware req. | Tested |
|----------------------------------------------| :---: | :---: | :---: | :---: | :---: |
| Insecure NC implementation | MitM | MitM | Manual | | ✓ |
| NiNo | MitM | Info | Manual | | ✓ |
| Contact Extractor | Critical | BAC | Manual | | ✓ |

to be added soon

| | Category | Type | type | Hardware req. | Tested | Scheduled to be added |
|----------------------------------------------| :---: | :---: | :---: | :---: | :---: | :---: |
| BLUR | MitM | ? | - | ✓ | | ✓ |
| BIAS | MitM | ? | - | ✓ | | ✓ |
| BLUFFS | MitM | ? | - | ✓ | | ✓ |
| BlueRepli | Critical | BAC | - | | | |
| C | MitM | MiTM | - | | | |

TODO List

[ ] Add Support for BLE (Bluetooth Low Energy)

- Implement BLE functionality to enhance the project's connectivity capabilities.

[ ] Continuously (Re-)Develop Proofs of Concept (PoCs)

- Develop new PoCs to explore additional use cases or features.

Bluetooth and Attacks

Additionally, we found the following Bluetooth Classic and Bluetooth Low Energy (BLE) . The table has the following information about the attacks and - name, type either implementation-specific, protocol-specific or affecting a BT profile, Bluetooth Type (BLE, BT, BT + BLE), BT affected, number of exploits, year released, CVE if a, CVSS if a, Hardware if required, Proof of Concept if a and additional information in the comment section with additional links or explanation.

| Exp. Family | Name | Type | BT Type | BT ver | exp. # | Year | CVE | CVSS | Hardware | PoC | Link | Comment |
| -------------- | ----------------------------------- | ----- | ---------- | ------------------ | --------------- | ---- | -------------------------------------------------------------------- | ---- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | Qualcomm WSA8835 attck | Imp | BLE | | 1 | 2023 | | | | | | Improper GATT packet |
| | Auth bypass, spoofing | Imp | BLE | | 1 | 2022 | | | | | | Authentication Bypass by Spoofing in Tesla Keys |
| | unauth MITM | Prot | BLE | 4.0 - 5.3 | 1 | 2022 | | | | | | Check CVE for details, relies on Method Confusion |
| | BLE Proximity Auth relay | Rel | BLE | 4.0 - 5.3 | 1 | 2022 | | | | | | BLE Proximity Authentication to Relay Attacks |
| | Sniffle | Snif | BLE | 4.0-5.0 | 1 | 2022 | | | TI CC1352/CC26x2 | | | |
| | InjectaBLE | Prot | BLE | 4.0 - 5.2 | 1 | 2021 | | | nRF52840 | | | MITM, Send malicious packets, post-exploitation after the session was established/hijacked (Imp and model specific) |
| | jacknimble | Imp | BLE | | | 2020 | | | nRF52840 | | | 3 exploits for specific hardware, C |
| | SweynTooth | Imp | BLE | | 12 | 2020 | | | nRF52840 | | | |
| | BlueDoor | Prot | BLE | 4.0 - 5.2 | 1 | 2020 | | | nRF51822 | | | MITM |
| | Downgrade attack | Prot | BLE | 4.2 - 5.0 | 1 | 2020 | | | TICC2640 & Adafruit Bluefruit LE Sniffe | | | MITM through downgrade (SCO) C |
| | BLESA | Spoof | BLE | | 1 | 2020 | | | | | | Spoofing to establish MITM and disable encryption |
| SweynTooth | Cypress PSoc 4 BLE | Imp | BLE | | 1 | 2019 | | | | | | DoS |
| SweynTooth | Cypress PSoc 4 BLE | Imp | BLE | | 1 | 2019 | | | | | | Buffer O |
| SweynTooth | NXP KW41Z up to 2.2.1 | Imp | BLE | | 1 | 2019 | | | | | | BLE Link layer buffer o |
| SweynTooth | STMicroelectronics BLE Stack | Imp | BLE | | 1 | 2019 | | | | | | through 1.3.1 for STM32WB5x devices does not properly handle consecutive ATT requests on reception |
| | Co-located app BLE | | BLE | | 1 | 2019 | | | | Theory | | Co-located apps can get BLE data, and thus exfiltrate needed info??? can we do a relay with it? |
| | BleedingBit | Imp | BLE | 4.2 - 5.0 | 1 | 2018 | | | | | | |
| | GATTacking | Prot | BLE | 4.0 | 1 | 2016 | | | CSR 8510-based USB dongle | | | MITM BLE |
| | Crackle | Prot | BLE | 4 | 1 | 2013 | | | | | | crack ble encryption |
| Bluez | MynameIsKeyboard | Imp | BT | | 1 | 2023 | C | 8.8 | | | \- | C, C, C |
| Antonioli | BLUFFS | Prot | BT | 4.2-5.2 | 6 | 2023 | C | 6.8 | CYW920819EVB-02 | | | |
| | \- | Prot | BT | | 1 | 2022 | | | | | | Cross-stack illegal access attack (formal methods) + C and C mentioned in other entries |
| | BlackTooth | Prot | BT | | 1 | 2022 | | | CYW920819EVB-02 | | | 1 new attack (connection stage) + KNOB and other attacks that were reused |
| | BLAP | Prot | BT | | 1 | 2022 | | | | Theory | | Extract Link Key from the HCI dump needs physical access to the car (applicable in car sharing only) |
| | Blue's Clues | Prot | BT | <=5.3 | | 2022 | C | 4.3 | Ubertooth & USRP B210 SDR | | | C affects Privacy, defeats non-disco feature of BT/EDR |
| | unauth MITM | Prot | BT | 1.0B-5.3 | 1 | 2022 | C | 7.5 | | | | Check CVE for details, relies on Method Confusion, C |
| Braktooth | BrakTooth | Imp | BT | 3.0 - 5.2 | 16 | 2021 | C | 8.8 | ESP-WRO | | | |
| | BleedingTooth BadChoice | Imp | BT | 4.2-5.2 | 1 | 2020 | C | 6.5 | | | | Information leak |
| | BleedingTooth BadKarma | Imp | BT | 5.0 | 1 | 2020 | C | 8.8 | | | | stack-based info leak BlueZ |
| | BleedingTooth BadVibes | Imp | BT | 5.0+ | 1 | 2020 | C | 6.5 | | | | Requires BT 5.0 and higher |
| | Snapdragon Auto CVEs | Imp | BT | | 4 | 2020 | | | | | | C Snapdragon Auto, no exploits C C, C |
| | BlueRepli | Imp | BT | | 1 | 2020 | | | | No exploit so far | | |
| | UberTooth | Snif | BT | ALL | 1 | 2020 | | | Ubertooth | | | Sniffing |
| Antonioli | BIAS | Prot | BT | <=5.0 | 4 | 2019 | C | 5.4 | CYW920819, possibly CYW920819M2EVB-01 | | | C |
| | MITM SSP BT 5.0 | Prot | BT | 5 | 1 | 2018 | | | | | | passkey entry association model is to the MITM |
| BlueBorne | C | Imp | BT | | 1 | 2017 | C | 6.5 | | | | |
| BlueBorne | C | Imp | BT | 5 | 4 | 2017 | C | 8.0 | | | | |
| | Lexus BT Heap O | Imp | BT | | 1 | 2017 | C | 8.8 | | Theory | | RCE in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured not in Japan from Oct. 2016 to Oct. 2019 |
| | BlueEar | Snif | BT | ALL | 1 | 2016 | | | Ubertooth (2) | | | Sniffing, extending the code of Ubertooth |
| | C | Imp | BT | | 1 | 2014 | C | 8.8 | Nexus 5 (internalblue) | internalblue Nexus 5 examples | | Imp. specific attacks on Broadcom chips BCM4335C0, BCM43438A1, and some other from 2012-2014 (DoS) |
| | NINO MITM attack | Prot | BT | | 2 | 2010 | | | Nexus 5 (internalblue) | Theory + a PoC from internalblue + easy exploit similar to method confusion | | NINO - no input no output (mitm + out-of-band mitm attacks). |
| | Attacks on Pairing | Prot | BT | 2.1 | 1 | 2008 | | | | | | MITM, attack on 2.1 |
| | Cracking Bluetooth PIN | Brute | BT | | 1 | 2005 | | | | Theory | | 6 |
| | Key extraction | | BT | 1.0B | 1 | 2001 | | | | | | Old attack on very old 1.0B |
| | BadBluetooth | Prot | BT + adj | | 1 | 2019 | | | | Theory | | Too high assumptions (malicious app installed + compromised device) |
| BlueMirror | BlueMirror BT Mesh profile brute | Prot | BT Profile | 2.1-5.2 | 1 | 2021 | C | 7.5 | | | | Brute-force insufficient random AuthValue in BT Mesh 1.0 and 1.0.1 to complete authentication |
| BlueMirror | BlueMirror BT Mesh profile brute 2 | Prot | BT Profile | 2.1-5.2 | 1 | 2021 | C | 7.5 | | | | Determine Authvalue in BT Mesh 1.0 and 1.0.1 attack |
| BlueMirror | BlueMirror BT Mesh profile no brute | Prot | BT Profile | 2.1-5.2 | 1 | 2021 | C | 8.8 | | | | Auth bypass in Mesh profile 1.0, 1.0.1, can determine authvalue and other data without brute-force |
| BlueMirror | BlueMirror BT Mesh profile | Prot | BT Profile | 1.0B-5.2 | 1 | 2020 | C | 8.1 | | | | C - Auth bypass in Mesh profile 1.0, 1.0.1  |
| BlueMirror | BlueMirror Legacy pairing | Prot | BT/BLE | 2.1-5.2 | 1 | 2021 | C | 5.4 | | | | Complete pairing without knowledge of the PIN  |
| BlueMirror | BlueMirror passkey leak | Prot | BT/BLE | 2.1-5.2 | 1 | 2021 | C | 4.2 | | | | MitM attacker can determine passkey value through reflection of the public key (can leak passkey value 1 bit at a time) |
| Antonioli | BLURTooth | Prot | BT/BLE | 4.2, 5.0, 5.1, 5.2 | 4 | 2020 | C | 5.9 | | | | C |
| | Fixed Coord. In | Imp | BT/BLE | 2.1-5.2 | 1 | 2019 | C | | Nexus 5 (internalblue) or CY5677 | internalblue Nexus 5 examples | | MITM exploiting crypto (implementation/protocol attack) C |
| Antonioli | KNOB | Prot | BT/BLE | <=5.0 | 1 | 2019 | C | 8.1 | Nexus 5 (internalblue) | | | C |
| | Ghost attack | Prot | BT/BLE? | | 2 | 2023 | | | | | | Ghost attack and group guessing attack |
| | Qualcomm 9206 | Imp | BT/BLE? | | 1 | 2022 | C | 8.2 | | | | Buffer o in A2DP profile |
| | Qualcomm APQ8009 | Imp | BT/BLE? | | 1 | 2022 | C | 7.3 | | | | Memory corruption while processing AALUE_TEXT AVRCP response |
| | Qualcomm WSA8815 | Imp | BT/BLE? | | 1 | 2022 | C | 7.3 | | | | Memory corruption while processing AVRCP packet |
| | Qualcomm WSA8835 | Imp | BT/BLE? | | 1 | 2022 | C | 8.2 | | | | Bluetooth HOST Buffer o while processing GetFolderItems, GetItemAttributes |
| | Qualcomm WSA8835 | Imp | BT/BLE? | | 1 | 2022 | C | 9.8 | | | | Bluetooth Host Buffer o while processing response from remote |
| | SnapDragon Auto | Imp | BT/BLE? | | 1 | 2021 | C | 9.8 | | | | Null pointer dereference while freeing the HFP profile |
| | Method Confusion | Prot | BT/BLE? | 2.1-5.2 | 1 | 2020 | C | 6.3 | huge selection with different capabilities. | | | MITM between 2 BLE or BR/EDR devices. Strange hardware needed, C |
| | BlueSnarf re | Imp | OBEX | | 1 | 2011 | | | | | | OBEX path tra (FTP) |

The YAML DSL reference syntax is a here.

License

Shield: [![CC BY-NC-SA 4.0][cc-by-nc-sa-shield]][cc-by-nc-sa]

BlueToolkit is licensed under a
[Creati Attribution-NonCommercial-ShareAlike 4.0 International License][cc-by-nc-sa].

For inquiries contact at

[![CC BY-NC-SA 4.0][cc-by-nc-sa-image]][cc-by-nc-sa]

[cc-by-nc-sa]:
[cc-by-nc-sa-image]:
[cc-by-nc-sa-shield]:

项目信息

开发语言：Jupyter Notebook

Star 数：737

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕 BlueToolkit is an extensible Bluetooth Classic vulnerability testing framework that helps uncover new and old vulnerabilities in Bluetooth-enabled devices. Could be used in the vulnerability research, penetration testing and bluetooth hacking. We also collected and classified Bluetooth vulnerabilities in an "Awesome Bluetooth Security" way展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。