bluescan: A powerful Bluetooth scanner

Conditions

sudo apt install libglib2.0-dev libbluetooth-dev

Installation

sudo pip3 install bluescan

Use

$ bluescan -h
bluescan v0.2.1

A powerful Bluetooth scanner.

Author: Sourcell Xu from DBAPP Security HatLab.

License: GPL-3.0

Usage:
bluescan (-h | --help)
bluescan (-v | --version)
bluescan [-i <hcix>] -m br [--inquiry-len=<n>]
bluescan [-i <hcix>] -m lmp BD_ADDR
bluescan [-i <hcix>] -m sdp BD_ADDR
bluescan [-i <hcix>] -m le [--timeout=<sec>] [--le-scan-type=<type>] [--sort=<key>]
bluescan [-i <hcix>] -m gatt [--include-descriptor] --addr-type=<type> BD_ADDR
bluescan [-i <hcix>] -m vuln --addr-type=br BD_ADDR

Arguments:
BD_ADDR Target Bluetooth device address

Options:
-h, --help Display this help.
-v, --version Show the version.
-i <hcix> HCI device for scan. [default: hci0]
-m <mode> Scan mode, support BR, LE, LMP, SDP, GATT and vuln.
--inquiry-len=<n> Inquiry_Length parameter of HCI_Inquiry command. [default: 8]
--timeout=<sec> Duration of LE scan. [default: 10]
--le-scan-type=<type> Active or passive scan for LE scan. [default: active]
--sort=<key> Sort the discovered devices by key, only support RSSI now. [default: rssi]
--include-descriptor Fetch descriptor information.
--addr-type=<type> Public, random or BR.

Scan BR devices -m br

Scan LE devices -m le

Scan SDP services

Scan LMP features

Scan GATT services

Vulnerabilities scanning (demo)

$ sudo bluescan -m vuln --addr-type=br ??:??:??:??:??:??
... ...
CVE-2017-0785