The bluescan it is one project open source by SAPcell Xu of the DBAPP Security HatLab team.
When violating new goals Bluetooth, the scanner can help us gather information, such as:
- BR devices
- LE devices
- LMP features
- GATT services
- SDP services
This tool is based on BlueZ, the official stack Bluetooth Linux. The following packages must be installed:
sudo apt install libglib2.0-dev libbluetooth-dev
sudo pip3 install bluescan
$ bluescan -h bluescan v0.1.1 A powerful Bluetooth scanner. Author: Sourcell Xu from DBAPP Security HatLab. License: GPL-3.0 Usage: bluescan (-h | --help) bluescan (-v | --version) bluescan [-i <hcix>] -m br [--inquiry-len=<n>] bluescan [-i <hcix>] -m lmp BD_ADDR bluescan [-i <hcix>] -m sdp BD_ADDR bluescan [-i <hcix>] -m le [--timeout=<sec>] [--le-scan-type=<type>] [--sort=<key>] bluescan [-i <hcix>] -m gatt [--include-descriptor] --addr-type=<type> BD_ADDR bluescan [-i <hcix>] -m vuln --addr-type=br BD_ADDR Arguments: BD_ADDR Target Bluetooth device address Options: -h, --help Display this help -v, --version Show the version -i <hcix> HCI device for scan [default: hci0] -m <mode> Scan mode, support BR, LE, LMP, SDP, GATT and vuln --inquiry-len=<n> Inquiry_Length parameter of HCI_Inquiry command [default: 8] --timeout=<sec> Duration of LE scan [default: 10] --le-scan-type=<type> Active or passive scan for LE scan [default: active] --sort=<key> Sort the discovered devices by key, only support RSSI now [default: rssi] --include-descriptor Fetch descriptor information --addr-type=<type> Public, random or BR
Scanning BR devices -m br
The classic devices Bluetooth may use three technologies: BR (Basic Rate), EDR (Enhanced Data Rate) and AMP (Alternate MAC / PHY). Since they all belong to the Basic Rate system, we call them BR scanners:
As shown above, by scanning BR devices, we can get the address, name, device type and RSSI of the surrounding classic devices Bluetooth.
Scanning devices LE -m le
As shown above, by scanning LE devices, we can obtain the address, type of address, connection status, RSSI and GAP data of the surrounding LE devices.
SDP scanning services
You can try to connect to these services for further benefits.
LMP scan functions
Scanning GATT services
LE devices inform the outside world about their open services through GATT. After scanning the GATT, we can receive the GATT service of the specified LE device. You can try to keep the GATT data for further breaches:
Vulnerability Scan (Demo)
The vulnerability scan is still in the demonstration phase and currently only supports CVE-2017-0785:
$ sudo bluescan -m vuln --addr-type=br ??:??:??:??:??:?? ... ... CVE-2017-0785
You can download the program from here.