domains / families / security / offensive-bluetooth-ble

offensive-bluetooth-ble

separate

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.

When to use

• GATT enumeration
• characteristic read/write without auth
• pairing downgrade (Just Works forced)
• LE Secure Connections bypass
• MITM via active relay
• sniffing with Sniffle / Ubertooth / Frontline
• encryption key extraction
• companion-app trust analysis

When not to use

• Out of Band (OOB) pairing attacks

Skill page

Source