offensive-bluetooth-ble

# Bluetooth Low Energy (BLE) Attacks BLE devices communicate via GATT — a hierarchy of services, characteristics, and descriptors. Many devices treat the BLE link itself as the trust boundary, exposing privileged operations on characteristics readable/writable from any nearby device. ## Quick Workflow 1. Discover and enumerate the device's GATT tree 2. Test every characteristic for read/write/notify without authentication 3. Inspect pairing method — Just Works = no MITM protection 4. If Just Works, MITM the pairing to capture / inject 5. Reverse the companion app for proprietary command formats --- ## Discovery + GATT Enumeration ```bash # bettercap (interactive) sudo bettercap -eval "ble.recon on; events.show 60; ble.show" # Or, attach to a known-MAC device sudo bettercap -eval "ble.recon on; ble.enum AA:BB:CC:DD:EE:FF" # bluetoothctl bluetoothctl > scan on > connect AA:BB:CC:DD:EE:FF > menu gatt > list-attributes # gatttool (deprecated but still works) gatttool -b AA:BB:CC:DD:EE:FF -I > connect > primary # list services > char-desc # list characteristics > char-read-uuid <uuid> > char-write-req <handle> <hex> ``` GATT services use 16-bit UUIDs for SIG-defined services (battery, heart rate) and 128-bit UUIDs for vendor-defined ones. Custom 128-bit UUIDs are where vendor-specific commands live — that's your attack surface. ## Characteristic Auth-Free Read/Write Test every characteristic flagged read/write/notify: ```bash # Read all readable char...