Pentesting BLE - Bluetooth Low Energy
最后更新于
最后更新于
自蓝牙4.0规范以来，BLE仅使用40个信道，覆盖2400至2483.5 MHz范围。相比之下，传统蓝牙在同一范围内使用79个信道。
BLE设备通过发送广播包（信标）进行通信，这些包向其他附近设备广播BLE设备的存在。这些信标有时也会发送数据。
监听设备，也称为中央设备，可以通过向广告设备发送专门的扫描请求来响应广播包。对该扫描的响应使用与广播包相同的结构，还包含无法放入初始广告请求中的附加信息，例如完整设备名称。
前导字节同步频率，而四字节的访问地址是一个连接标识符，用于在多个设备尝试在相同信道上建立连接的情况下使用。接下来，协议数据单元（PDU）包含广告数据。有几种类型的PDU；最常用的是ADV_NONCONN_IND和ADV_IND。如果设备不接受连接，则使用ADV_NONCONN_IND PDU类型，仅在广播包中传输数据。如果设备允许连接并且一旦建立连接就停止发送广告包，则使用ADV_IND。
通用属性配置文件（GATT）定义了设备应如何格式化和传输数据。当您分析BLE设备的攻击面时，通常会集中注意力在GATT（或GATTs）上，因为这是触发设备功能以及存储、分组和修改数据的方式。GATT以16位或32位值的形式在表中列出设备的特征、描述符和服务。特征是在中央设备和外围设备之间发送的数据值。这些特征可以有提供有关它们的附加信息的描述符。如果这些特征与执行特定操作相关，则通常会将特征****分组在服务中。
GATTool 允许与另一个设备建立连接，列出该设备的特征，并读取和写入其属性。
GATTTool可以使用 -I 选项启动交互式 shell：
Passive Sniffing
Passive sniffing is the process of monitoring BLE traffic without actively participating in the communication. Bettercap can be used to passively sniff BLE traffic by setting up a BLE proxy and forwarding all traffic through it.
To start passive sniffing with Bettercap, use the following command:
This command will enable BLE reconnaissance mode in Bettercap, allowing you to passively sniff BLE traffic in the vicinity.
Active Sniffing
Active sniffing involves actively participating in the BLE communication by sending specific packets to devices and capturing their responses. Bettercap supports active sniffing by allowing you to send custom BLE packets and analyze the responses.
To start active sniffing with Bettercap, use the following command:
The ble.enum command will send enumeration packets to nearby devices and display their responses, allowing you to gather information about the devices in the vicinity.
