ToolWar | Information Security (InfoSec) Tools: Bluetooth

BTCrack (Bluetooth PIN Bruteforce) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="BTCrack" border="0" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj39dSDx3Q16NiYxmcXH5VHD94Rf39rMa2VbZdwWfgE1bGbxiL6ggWB3LlGMiWqtUEy-sERyTTMmrpe5-288pBCgS_JBX0EP0tVZtj9XKe0NYZThTtOjEnY2deWAo9osu8t-u4ofVRIHhUo/s320/BTCrack.jpg" title="BTCrack" width="320" /></div>
<div style="text-align: justify;">
<span class="style3"><b>BTCrack</b> is the worlds first <i><a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank">Bluetooth</a> Pass phrase 
(PIN) bruteforce  tool</i>, <b>BTCrack</b> will bruteforce the Passkey and the Link
 key from  captured pairing* exchanges.</span></div>
<div style="text-align: justify;">
<span class="style3"><b>BTcrack</b> was demoed and realeased at Hack.lu 2007 and 23C3 in 
Berlin, the video of the presentation is available on Google Video .</span><span class="style3"><br />
          To capture the pairing data it is  necessary to have a <i>
Professional Bluetooth <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">Analyzer</a></i> : FTE (BPA 100, BPA  105, others), 
Merlin OR  flash a CSR based consumer USB  dongle with special <a href="http://www.toolwar.com/search/label/Firmware" target="_blank">firmware</a>.</span></div>
<div style="text-align: justify;">
<span class="style3"><span class="style3"><b>Speed Comparison :</b><br />
·        P4 2Ghz - Dual Core     200.000 keys/sec</span><br />
· <span class="style3">FPGA E12 @ 50Mhz      7.600.000 keys/sec<br />
·
            FPGA E12 @ 75Mhz     10.000.000 keys/sec<br />
· FPGA E14             30.000.000 keys/sec<br />
<br />
<b>Changes :</b><br />
· 1.0 First release<br />
· 1.1 Intermediate Release <br />
  E12 + E14 FPGA Support ( http://www.picocomputing.com)<br />
  Splash Screen <br />
  Process Priority <br />
  Speed increase (+15%)<br />
</span> </span></div>
<h3 style="text-align: justify;">
<span class="style3">Tutorials ::</span></h3>
<div style="text-align: justify;">
<span class="style3"><b>Video ::</b> <a href="http://vimeo.com/3256789" target="_blank">Click Here </a></span></div>
<h3 style="text-align: justify;">
<span class="style3">Download ::</span></h3>
<div style="text-align: justify;">
<b><span class="style3">Windows :: </span></b><a href="http://secdev.zoller.lu/btcrack.zip" target="_blank"><span class="style3">BTCrack (.zip)</span></a><b><span class="style3"><br /></span></b></div>
<div style="text-align: justify;">
<b><span class="style3">Official Website :: </span></b><a href="http://www.g-sec.lu/products.html"><span class="style3">http://www.g-sec.lu/products.html</span></a>
            </div>

BTCrack (Bluetooth PIN Bruteforce) :: Tools

BTCrack is the worlds first Bluetooth Pass phrase (PIN) bruteforce tool , BTCrack will bruteforce the Passkey and the Link key from...

Haraldscan (Bluetooth Scanner) :: Tools

<div class="separator" style="clear: both; text-align: center;">
 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSyj8NI7RbwtmH4bmwqJHa2NAn-lvlBdx_2YfPB-G4GM7b73kAnWg6As2qAAb9eXS7Ge4Rhyphenhyphenr7CGuhYg3stwxHyxN1-_i7aSk1Hn_FT6-dE8i3haJJbza3brYB_TOoXTAyixlZBPEFnnVi/s1600/Harald+Scan+Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Harald Scan Screenshot" border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSyj8NI7RbwtmH4bmwqJHa2NAn-lvlBdx_2YfPB-G4GM7b73kAnWg6As2qAAb9eXS7Ge4Rhyphenhyphenr7CGuhYg3stwxHyxN1-_i7aSk1Hn_FT6-dE8i3haJJbza3brYB_TOoXTAyixlZBPEFnnVi/s400/Harald+Scan+Screenshot.png" title="Harald Scan Screenshot" width="400" /></a></div>
<div style="text-align: justify;">
<b>Harald Scan </b>is a <b>Bluetooth Scanner</b> for <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> and Mac OS X. <b>Harald Scan</b> is  able to determine Major and Minor device class of device, as well as  attempt to resolve the device's <b>MAC address</b> to the largest known  <a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank">Bluetooth </a>MAC address Vendor list. </div>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div style="text-align: justify;">
<b>Installation :: </b><a href="http://code.google.com/p/haraldscan/wiki/Installation" target="_blank">Click Here  </a></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Mac :: </b><a href="http://haraldscan.googlecode.com/files/haraldscan-osx-0.42.tar.gz" target="_blank">HaraldScan-osx-0.42</a></div>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://haraldscan.googlecode.com/files/haraldscan-dist-32-0.42.tar.gz" target="_blank">Haraldscan-dist-32-0.42</a></div>

Haraldscan (Bluetooth Scanner) :: Tools

Harald Scan is a Bluetooth Scanner for Linux and Mac OS X. Harald Scan is able to determine Major and Minor device class of device,...

Blue|Smash (Bluetooth Penetration Testing Suite) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAbSu1pJlmWvitiwSQ6VbwDnk9YGXBwiQYxb8jRWOKY83EeuFf8reMEgHAd0wiMs_5B4voq_teB_0YZUKMxghjkcSF1FlCPn0JQTQwdhz0psxua3qc4t1izcLhHPAIIUFma1XcjO6U93xU/s1600/bluesmash+logo.gif" imageanchor="1"><img alt="qBluesmash logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAbSu1pJlmWvitiwSQ6VbwDnk9YGXBwiQYxb8jRWOKY83EeuFf8reMEgHAd0wiMs_5B4voq_teB_0YZUKMxghjkcSF1FlCPn0JQTQwdhz0psxua3qc4t1izcLhHPAIIUFma1XcjO6U93xU/s1600/bluesmash+logo.gif" title="Bluesmash logo" /></a></div>
<div style="text-align: justify;">
<b>Blue|Smash</b> is a free open source <b>Bluetooth Pentest Suite,</b> powered  by <a href="http://www.toolwar.com/search/label/Python" target="_blank">python</a> for <a href="http://www.toolwar.com/search/label/Linux" target="_blank">linux</a>. I built <b>Blue|Smash</b> to aid me in my <a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank">bluetooth</a>  adventures and thought others might benefit from my work . Here is a  list of some of the tools included. </div>
<ul id="main" style="text-align: justify;">
<li>Sorbo's Front-line Bluetooth sniffer.</li>
<li>A brute-force scanner</li>
<li>Mac address spoofer</li>
<li>Load's of exploits</li>
<li>Autopwn vulnerability checker</li>
<li>CSR Firmware Backup/Updater</li>
</ul>
<h3>
Download ::</h3>
<b>Linux :: </b><a class="name" href="http://sourceforge.net/projects/bluesmash/files/bluesmash/Blue-Smash-v1.0e.tar.gz/Blue-Smash-v1.0e.tar.gz/download" title="Click to download Blue-Smash-v1.0e.tar.gz">Blue-Smash-v1.0e.tar.gz</a><br />
<b>Official Website :: </b> <a class="external free" href="http://bluesmash.sourceforge.net/" rel="nofollow">http://bluesmash.sourceforge.net/</a>

Blue|Smash (Bluetooth Penetration Testing Suite) :: Tools

Blue|Smash is a free open source Bluetooth Pentest Suite, powered by python for linux . I built Blue|Smash to aid me in my bluetooth...

Blooover (J2ME Phone Autditing) :: Tools

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsTpT9cfrEeVdY-n-9KwBEegNMoVSM-KW02xdTM_5zftMZe0MF7XjeQXlKWs_21jAnKaWACK6JxwmHue-4BheAZXFM3vfoX_PrI20ajZNTvLbHyjvuCkSONRBN9o26QhHqh1lhf5AcG7Mh/s1600/blooover+logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Blooover Logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsTpT9cfrEeVdY-n-9KwBEegNMoVSM-KW02xdTM_5zftMZe0MF7XjeQXlKWs_21jAnKaWACK6JxwmHue-4BheAZXFM3vfoX_PrI20ajZNTvLbHyjvuCkSONRBN9o26QhHqh1lhf5AcG7Mh/s1600/blooover+logo.png" title="Blooover Logo" /></a></div><div style="text-align: justify;"><b>Blooover</b> is a <i>J2ME Phone Auditing Tool</i>. Since <b>Adam Laurie's</b> BlueSnarf experiment and the subsequent BlueBug experiment it is proven that some <a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank">Bluetooth</a>-enabled phones have <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> issues. Until now, attackers need laptops for the snarfing of other people's information. Unless attackers do a long-distance-snarf, people would see that there is somebody with a laptop trying to do strange things. <b>Blooover</b> is a proof-of-concept tool that is intended to run on J2ME-enabled cell phones that appear to be comparably seamless. <b>Blooover </b>is a tool that is intended to serve as an audit tool that people can use to check whether their phones and phones of friends and employees are vulnerable.<br />
<br />
Since the application runs on handheld devices and sucks information, it has been called <b>Blooover</b> (derived from <b>Bluetooth Hoover</b>).<br />
<br />
We had some objections to release a tool that actually does a bluebug-attack before eventual victims were not in the position of doing something against it. Now, that Nokia announced a <a href="http://www.toolwar.com/search/label/Firmware" target="_blank">firmware </a>upgrade for their vulnerable models, these objections are no longer present.</div><div style="text-align: justify;"><h3>Tutorial ::</h3><h4>Installation ::</h4>When you intend to install the application, you should be using               a phone that has the Java Bluetooth API implemented. Phones with               this feature are listed on this, very useful page.<br />
Once you downloaded the file, make sure that it is called Bloover.jar               (not Blooover.zip). After this you can either transfer the application               to your phone via (1) the phone software on your pc, or (2) via               Obex Push over Bluetooth or (3) via OTA (over-the-air application               provisioning) which will use your phone's data services.</div><div style="text-align: justify;"><h3>Download ::</h3><b>Jar :: </b><a href="http://trifinite.org/Downloads/Blooover.jar" target="_blank">Blooover.jar </a></div>

Blooover (J2ME Phone Autditing) :: Tools

Blooover is a J2ME Phone Auditing Tool . Since Adam Laurie's BlueSnarf experiment and the subsequent BlueBug experiment it is proven t...

BlueBugger (Information Gathering) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRWT68-7tScmEGFEeFKiWmc_SNYITCODD2zGkNWWOzAUPw4hq4hChN30UixXPrJSG3j39xnPJgcKk33X8rIq0wkbX4rR672Zv0AJIL98ExNJdQWelFIit93JhVGj1YnzgXt1zo8PwXMYdq/s1600/bluebugger.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="bluebugger" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRWT68-7tScmEGFEeFKiWmc_SNYITCODD2zGkNWWOzAUPw4hq4hChN30UixXPrJSG3j39xnPJgcKk33X8rIq0wkbX4rR672Zv0AJIL98ExNJdQWelFIit93JhVGj1YnzgXt1zo8PwXMYdq/s1600/bluebugger.jpg" title="bluebugger " /></a></div>
<div style="text-align: justify;">
<b>BlueBugger </b>is a tool for bluetooth devices. You can get all informations, phonebook entries and messages with a simply run. <b>Bluebugger</b> is an implementation of the <b>bluebug</b> technique which was discovered by Martin Herfurt.</div>
<h3>
Uses ::</h3>
<span style="font-size: x-small;"><span style="font-weight: normal;"><span style="font-family: "Courier New",Courier,monospace;">bluebugger 0.1 (cant post urls :D)<br />
-----------------------------------------<br />
<br />
Usage: bluebugger [OPTIONS] -a <addr> [MODE]<br />
<br />
       -a <addr>     = Bluetooth address of target<br />
<br />
       Options:<br />
       --------<br />
       -m <name>     = Name to use when connecting (default: '')<br />
       -d <device>   = Device to use (default: '/dev/rfcomm')<br />
       -c <channel>  = Channelto use (default: 17)<br />
       -n            = No device name lookup<br />
       -t <timeout>  = Timeout in seconds for name lookup (default: 5)<br />
       -o <file>     = Write output to <file><br />
<br />
       Mode:<br />
       -----<br />
       info                   = Read Phone Info   (default)<br />
       phonebook              = Read Phonebook    (default)<br />
       messages               = Read SMS Messages (default)<br />
       dial <num>             = Dial number<br />
       ATCMD                  = Custom Command (e.g. '+GMI')<br />
<br />
       Note: Modes can be combined, e.g. 'info phonebook +GMI' </span></span></span><br />
<br />
Tutorial ::<br />
<b>Text :: </b><a href="https://github.com/pwnieexpress/pwn_plug_sources/tree/master/src/bluetooth/bluebugger" target="_blank">Click Here </a><br />
<h3>
Download ::</h3>
<b>Linux :: </b><a href="https://github.com/pwnieexpress/pwn_plug_sources/tree/master/src/bluetooth/bluebugger/source" target="_blank">BlueBugger Source </a><br />
<br />

BlueBugger (Information Gathering) :: Tools

BlueBugger is a tool for bluetooth devices. You can get all informations, phonebook entries and messages with a simply run. Bluebugger i...

Btscanner (Bluetooth Scanner) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjm0aKcbxbyWNe5Vn3_8vIVLYiu5DStLoy9ob-P-O1T2a2ChcS3NEDdMKVlUbBlv2wdqPdotzFW5gmg5V3MUErCDYF5jVTNQog18aXx5VAadxStWCjLGM2jMXUKtgaGBXc-i3tZTFJhurzw/s1600/Btscanner+screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="btscanner screenshot" border="0" height="221" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjm0aKcbxbyWNe5Vn3_8vIVLYiu5DStLoy9ob-P-O1T2a2ChcS3NEDdMKVlUbBlv2wdqPdotzFW5gmg5V3MUErCDYF5jVTNQog18aXx5VAadxStWCjLGM2jMXUKtgaGBXc-i3tZTFJhurzw/s400/Btscanner+screenshot.jpg" title="btscanner screenshot" width="400" /></a></div>
<br />
<b>Btscanner </b>is a<b> </b><i>Bluetooth scanner and Information Gathering tool</i><b>.</b> <b>Btscanner</b> is a <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tool</a> that extracts as much information as possible  from a <a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank">Bluetooth </a>device without the requirement to pair. A detailed  information screen extracts HCI and SDP information, and maintains an  open connection to monitor the RSSI and link quality.<b> btscanner</b> is based  on the BlueZ Bluetooth stack, which is included with recent Linux  kernels, and the BlueZ toolset. Using the information gathered from  these sources, it is possible to make educated guesses as to the host  device type. </div>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Vl0TIhBFQ18?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows XP:: </b><a href="http://www.pentest.co.uk/src/btscanner_1_0_0.zip" target="_blank">Btscanner v1.0.0</a></div>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="http://www.pentest.co.uk/src/btscanner-2.1.tar.bz2" target="_blank">Btscanner v2.1</a></div>
<div style="text-align: justify;">
</div>

Btscanner (Bluetooth Scanner) :: Tools

Btscanner is a Bluetooth scanner and Information Gathering tool . Btscanner is a tool that extracts as much information as possible ...

Bluediving (Bluetooth Penetration Testing) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGDR5aWRa3G4M6DF_zV6qBMmhquEXiTAH_xz6QSOaASWovOeBIZlJmVlQESXiEd8UeBPa2KyYjOrLvJ7enIwRj5PMVixhz0sZ-Gbq-oQ947GmNFTzX6KObVr-2g2jhXfvTCt-yWHT5472P/s1600/bluediving+screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bluediving Screenshot" border="0" height="226" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGDR5aWRa3G4M6DF_zV6qBMmhquEXiTAH_xz6QSOaASWovOeBIZlJmVlQESXiEd8UeBPa2KyYjOrLvJ7enIwRj5PMVixhz0sZ-Gbq-oQ947GmNFTzX6KObVr-2g2jhXfvTCt-yWHT5472P/s400/bluediving+screenshot.jpg" title="Bluediving Screenshot" width="400" /></a></div>
<div style="text-align: justify;">
<b>Bluediving</b> is a <i>Bluetooth penetration testing suite</i>. Bluediving implements attacks like Bluebug, BlueSnarf, BlueSnarf++, BlueSmack, has features such as <a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank">Bluetooth</a> address spoofing, an AT and a RFCOMM socket shell and implements tools like carwhisperer, bss, L2CAP packetgenerator, L2CAP connection resetter, RFCOMM <a href="http://www.toolwar.com/search/label/Scanner" target="_blank">scanner</a> and greenplaque scanning mode (using more than one hci device).<br />
<b>Programming languages:</b> Perl and C<br />
<b>Supported operating systems: </b>GNU Linux 2.4 / 2.6 and FreeBSD<br />
<b>Requirements:</b> BlueZ, Sox, obexftp, Gnu Readline library, XML::Simple</div>
<div style="text-align: justify;">
<h3>
Download :: </h3>
</div>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/bluediving/files/bluediving/bluediving-0.9/bluediving-0.9.tgz/download" target="_blank">Bluediving v0.9</a></div>
<div style="text-align: justify;">
<h3>
Tutorial ::</h3>
<a href="http://www.youtube.com/watch?v=njUoGVI6l1s" target="_blank">Click Here</a> </div>

Bluediving (Bluetooth Penetration Testing) :: Tools

Bluediving is a Bluetooth penetration testing suite . Bluediving implements attacks like Bluebug, BlueSnarf, BlueSnarf++, BlueSmack, has...

Car Whisperer (Hack Carkit Bluetooth) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="car whisperer image" border="0" height="187" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkC2AwMgoejXDeEWtuft-qbIf2141FbNI8oAzWjtHadAjcvYqBkZruCI7RBFC5-doo_cjpVxr86oB-qXBC21UY4DLNwCdpK6eQhCbKuSAZ9XQb7Dyo8z3Bxy-sWym6ja8oSEjPmhExS0OA/s400/Car+Whisperer+Image.jpg" title="car whisperer image" width="400" /></div>
<b>Carwhisperer</b> project intends to sensibilise manufacturers               of carkits and other <b>Bluetooth appliances</b> without display and keyboard               for the possible             security threat evolving from the use of standard passkeys.             </div>
<div style="text-align: justify;">
A <a href="http://www.toolwar.com/search/label/Bluetooth" target="_blank"><b>Bluetooth </b></a>passkey is used within the pairing process that takes               place, when                two<b> Bluetooth</b> enabled devices connect for the first time. Besides               other public                data, the passkey is a secret parameter used in the process that               generates and                exchanges the so-called link key. In Bluetooth communication scenarios               the link               key is used for authentication and encryption of the information               that is              exchanged between the counterparts of the communication.</div>
<div style="text-align: justify;">
The cw_scanner                 script is repeatedly performing a device inquiry for visible                 Bluetooth devices of which the class matches the one of Bluetooth                 Headsets                  and Hands-Free Units. Once a visible Bluetooth device with the                 appropriate <br />
device class is found, the cw_scanner script executes the carwhisperer                 binary                  that connects to the found device (on RFCOMM channel 1) and opens                 a control                connection and connects the SCO links.</div>
<div style="text-align: justify;">
The carwhiperer binary connects to the device found by the cw_scanner.               The passkey that is required for the initial connection to the               device is provided                by the cw_pin.pl script that replaces the official Bluez PIN helper               (graphical                application that usually prompts for the passkey). The cw_pin.pl               script                provides the passkey depending on the Bluetooth address that requests               it.                Depending on the first three bytes of the address, which references               the                manufacturer, different passkeys are returned by the cw_pin.sh               script. In                quite a few cases the preset standard passkey on headsets and handsfree               units              is '0000' or '1234'.</div>
<div style="text-align: justify;">
Once the connection has been successfully established, the carwhisperer               binary                starts sending audio to, and recording audio from the headset.               This allows attackers to inject audio data into the car. This could               be fake <br />
traffic announcements or nice words. Attackers are also able to               eavesdrop             conversations among people sitting in the car.</div>
<div style="text-align: justify;">
Ideally, the carwhisperer is used with a toooned dongle                and                 a directional                antenna that enhances the range of a Bluetooth radio quite a bit.</div>
<div style="text-align: justify;">
<h3>
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/yZcL1k33tho?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/1c-jzYAH2gw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
<b>Linux :: </b><a href="http://trifinite.org/Downloads/carwhisperer-0.2.tar.gz" target="_blank">Car Whisperer v0.2</a><br />
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
</div>

Car Whisperer (Hack Carkit Bluetooth) :: Tools

Carwhisperer project intends to sensibilise manufacturers of carkits and other Bluetooth appliances without display and k...

BlueMaho (Bluetooth Devices Security Testing) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNVahVyEcfeuzVD5lawFbk1swmp1o1H7I7v9E-pH4ejkRPZhlmFkUjvKXrBJxfz9ompBZO3fgIelIXorjmjWxOxR6sP7Oeyr968W6YoaZ1rdyC2xxbsgMJUT4ysmHVpx8skquk_Zn5LVOb/s1600/bluemaho+screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="bluemaho screenshot" border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNVahVyEcfeuzVD5lawFbk1swmp1o1H7I7v9E-pH4ejkRPZhlmFkUjvKXrBJxfz9ompBZO3fgIelIXorjmjWxOxR6sP7Oeyr968W6YoaZ1rdyC2xxbsgMJUT4ysmHVpx8skquk_Zn5LVOb/s320/bluemaho+screenshot.jpg" title="bluemaho screenshot" width="320" /></a></div>
<div style="text-align: justify;">
<b>BlueMaho</b> is GUI-shell (interface) for suite of <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a>  for <i>testing security of bluetooth devices</i>. It is freeware, opensource,  written on <a href="http://www.toolwar.com/search/label/Python" target="_blank">python</a>, uses wxPyhon. It can be used for testing BT-devices  for known vulnerabilities and major thing to do - testing to find  unknown vulns. Also it can form nice statistics. </div>
<h3 id="head-679ba20470ace2c0c9be33f0c0f8dc38db4b8bae" style="text-align: justify;">
What it can do? (features)</h3>
<div style="text-align: justify;">
<span class="anchor" id="line-18"></span></div>
<ul style="text-align: justify;">
<li><a href="http://www.toolwar.com/search/label/Scanner" target="_blank">Scan</a> for devices, show advanced info, SDP records, vendor etc <span class="anchor" id="line-19"></span></li>
<li>Track devices - show where and how much times device was seen, its name changes <span class="anchor" id="line-20"></span></li>
<li>loop scan - it can scan all time, showing you online devices <span class="anchor" id="line-21"></span></li>
<li>alerts with sound if new device found <span class="anchor" id="line-22"></span></li>
<li>on_new_device - you can spacify what command should it run when it founds new device <span class="anchor" id="line-23"></span></li>
<li>it can use separate dongles - one for scaning (loop scan) and one for running tools or exploits <span class="anchor" id="line-24"></span></li>
<li>send files <span class="anchor" id="line-25"></span></li>
<li>change name, class, mode, BD_ADDR of local HCI devices <span class="anchor" id="line-26"></span></li>
<li>save results in database <span class="anchor" id="line-27"></span></li>
<li>form nice statistics (uniq devices by day/hour, vendors, services etc) <span class="anchor" id="line-28"></span></li>
<li>test remote device for known vulnerabilities (see <a href="http://www.toolwar.com/search/label/Exploitation" target="_blank">exploits</a> for more details) <span class="anchor" id="line-29"></span></li>
<li>test remote device for unknown vulnerabilities (see tools for more details) <span class="anchor" id="line-30"></span></li>
<li>themes! you can customize it  <span class="anchor" id="line-31"></span><span class="anchor" id="line-32"></span></li>
</ul>
<div class="line867" style="text-align: justify;">
</div>
<h3 id="head-be34a21c5d08001e482450faeb1c54cf3a8d0fab" style="text-align: justify;">
What tools and exploits it consist of?</h3>
<div style="text-align: justify;">
<span class="anchor" id="line-33"></span></div>
<ul style="text-align: justify;">
<li style="list-style-type: none;"><b>Tools: </b><span class="anchor" id="line-34"></span></li>
<li>atshell.c by Bastian Ballmann (modified attest.c by Marcel Holtmann) <span class="anchor" id="line-35"></span></li>
<li>bccmd by Marcel Holtmann <span class="anchor" id="line-36"></span></li>
<li>bdaddr.c by Marcel Holtmann <span class="anchor" id="line-37"></span></li>
<li>bluetracker.py by smiley <span class="anchor" id="line-38"></span></li>
<li>carwhisperer v0.2 by Martin Herfurt <span class="anchor" id="line-39"></span></li>
<li>psm_scan and rfcomm_scan from bt_audit-0.1.1 by Collin R. Mulliner <span class="anchor" id="line-40"></span></li>
<li>BSS (Bluetooth Stack Smasher) v0.8 by Pierre Betouin <span class="anchor" id="line-41"></span></li>
<li>btftp v0.1 by Marcel Holtmann <span class="anchor" id="line-42"></span></li>
<li>btobex v0.1 by Marcel Holtmann <span class="anchor" id="line-43"></span></li>
<li>greenplaque v1.5 by digitalmunition.com <span class="anchor" id="line-44"></span></li>
<li>L2CAP packetgenerator by Bastian Ballmann <span class="anchor" id="line-45"></span></li>
<li>obex stress tests 0.1 <span class="anchor" id="line-46"></span></li>
<li>redfang v2.50 by Ollie Whitehouse <span class="anchor" id="line-47"></span></li>
<li>ussp-push v0.10 by Davide Libenzi <span class="anchor" id="line-48"></span><span class="anchor" id="line-49"></span></li>
<li class="gap" style="list-style-type: none;">exploits/attacks: <span class="anchor" id="line-50"></span></li>
<li>Bluebugger v0.1 by Martin J. Muench <span class="anchor" id="line-51"></span></li>
<li>bluePIMp by Kevin Finisterre <span class="anchor" id="line-52"></span></li>
<li>BlueZ hcidump v1.29 DoS PoC by Pierre Betouin <span class="anchor" id="line-53"></span></li>
<li>helomoto by Adam Laurie <span class="anchor" id="line-54"></span></li>
<li>hidattack v0.1 by Collin R. Mulliner <span class="anchor" id="line-55"></span></li>
<li>Mode 3 abuse attack <span class="anchor" id="line-56"></span></li>
<li>Nokia N70 l2cap packet DoS PoC Pierre Betouin <span class="anchor" id="line-57"></span></li>
<li>opush abuse (prompts flood) DoS attack <span class="anchor" id="line-58"></span></li>
<li>Sony-Ericsson reset display PoC by Pierre Betouin <span class="anchor" id="line-59"></span><span class="anchor" id="line-60"></span></li>
<li class="gap" style="list-style-type: none;">you can add your own tools by editing 'exploits/exploits.lst' and 'tools/tools.lst' <span class="anchor" id="line-61"></span><span class="anchor" id="line-62"></span></li>
</ul>
<div class="line867" style="text-align: justify;">
</div>
<h3 id="head-e627522f4fdfdbf663d44878db163eb1f1439774" style="text-align: justify;">
Requirements</h3>
<div style="text-align: justify;">
<span class="anchor" id="line-63"></span></div>
<ul style="text-align: justify;">
<li>OS (tested with Debian 4.0 Etch / 2.6.18) <span class="anchor" id="line-64"></span></li>
<li><div class="line862">
<a href="http://www.toolwar.com/search/label/Python" target="_blank">python</a> (python 2.4 http://www.python.org) <span class="anchor" id="line-65"></span></div>
</li>
<li><div class="line862">
wxPython (python-wxgtk2.6 http://www.wxpython.org) <span class="anchor" id="line-66"></span></div>
</li>
<li><div class="line862">
BlueZ (3.9/3.24) http://www.bluez.org <span class="anchor" id="line-67"></span></div>
</li>
<li>Eterm  to open tools somewhere, you can set another term in  'config/defaul.conf' changing the value of 'cmd_term' variable. (tested  with 1.1 ver) <span class="anchor" id="line-68"></span></li>
<li>pkg-config(0.21), 'tee' used in tools/showmaxlocaldevinfo.sh, openobex, obexftp <span class="anchor" id="line-69"></span></li>
<li>libopenobex1 + libopenobex-dev (needed by ussp-push) <span class="anchor" id="line-70"></span></li>
<li>libxml2, libxml2-dev (needed by btftp) <span class="anchor" id="line-71"></span></li>
<li>libusb-dev (needed by bccmd) <span class="anchor" id="line-72"></span></li>
<li>libreadline5-dev (needed by atshell.c) <span class="anchor" id="line-73"></span></li>
<li>lightblue-0.3.3 (needed by obexstress.py) <span class="anchor" id="line-74"></span></li>
<li>hardware: any bluez compatible bluetooth-device <span class="anchor" id="line-75"></span><span class="anchor" id="line-76"></span></li>
</ul>
<div class="line867" style="text-align: justify;">
</div>
<h3 id="head-24caaa99fac9202edff5973b243c88b76a030b49" style="text-align: justify;">
Configuration</h3>
<div style="text-align: justify;">
<span class="anchor" id="line-77"></span></div>
<ol style="text-align: justify;" type="1">
<li>all configuration is in 'config' dir. <span class="anchor" id="line-78"></span></li>
<li>for  using bluemaho propertly you need to build tools and exploits. check if  you satisfy 'requirements' for bluemaho. then run 'build.sh'. if you  see 'Building complete!' message, than all went OK. if not - try to play  around requirements. <span class="anchor" id="line-79"></span></li>
<li>'default.conf'  is a default configuration file, you can edit it if you need to change  some options, path to files and commands used by bluemaho, theme etc. by  default you don't need to change it if you do all from 'requirements'  chapter. but, please, view it, for example just for setting  'user_location' variable for defining you location, which will be used  for tracking function. <span class="anchor" id="line-80"></span></li>
<li>'themes' - directory with themes for bluemaho GUI. You can set path to default theme with 'theme' variable in 'default.conf'  <span class="anchor" id="line-81"></span><span class="anchor" id="line-82"></span></li>
</ol>
<div class="line867" style="text-align: justify;">
</div>
<h3 id="head-2670038111a3c9008f5b357412c4e536fda3337a" style="text-align: justify;">
Run and use</h3>
<div style="text-align: justify;">
<span class="anchor" id="line-83"></span><br />
<div class="line862">
you can run <b>BlueMaho</b>  typing in console 'bluemaho.py'. For verbose output in console (and  redirecting std_err and std_out) run 'bluemaho.py -v'. it saves founded  devices to 'bluemaho.log' by default, you can change it in  'config/defaul.conf'. <span class="anchor" id="line-84"></span>enjoy! </div>
<h3 class="line862">
Download ::</h3>
<div class="line862">
<b>Linux :: </b> <a href="https://wiki.thc.org/BlueMaho?action=AttachFile&do=get&target=bluemaho_v090417.tgz" target="_blank">BlueMaho.tgz</a></div>
<div class="line862">
<br /></div>
<h3 class="line862">
Tutorial ::</h3>
<div class="line862">
Text :: <a class="external text" href="http://www.digitalmunition.com/DMA%5B2005-1214a%5D.txt" rel="nofollow">Bluetooth for Windows Remote Audio Eavesdropping</a></div>
</div>

BlueMaho (Bluetooth Devices Security Testing) :: Tools

BlueMaho is GUI-shell (interface) for suite of tools for testing security of bluetooth devices . It is freeware, opensource, written ...

Subscribe to: Posts ( Atom )