- Joined
- May 15, 2017
- Messages
- 981
- Likes
- 760
- Points
- 1,045
Btlejack provides everything you need to sniff, jam and hijack Bluetooth Low Energy devices. It relies on one or more BBC Micro:Bit. devices running a dedicated firmware. You may also want to use an Adafruit's Bluefruit LE sniffer or a nRF51822 Eval Kit, as we added support for these devices.
Current version of this tool (2.0) supports BLE 4.x and 5.x. The BLE 5.x support is limited, as it does only support the 1Mbps Uncoded PHY and does not support channel map updates.
Requirements
You need a UNIX based system (for example a Raspberry Pi). If you use the BBC Micro:Bit, you will need one to three Micro:Bit devices (three devices recommended) and for each device one free USB port. The power consumption of a Micro:Bit is rather low, so you can use a single USB port and a passive hub for powering the three recommended units.
If you connect 3 microbits at the same time on your computer, Btlejack will be able to sniff on every advertising channel and has far more chance to capture the connection request.
How to install
First, install the btlejack Python3 client software with Pip:
Then, connect your Micro:Bit device to your computer with a USB cable, mount the associated mass storage device (the mount point must contain MICROBIT), and issue the following command:
This will program every Micro:Bit device connected to your computer, and make them ready to use with Btlejack. It will use the correct firmware version for the current client software, so it is highly recommended to perform this firmware installation procedure each time you update Btlejack.
If you are using a Bluefruit LE sniffer or a nRF51822 Eval Kit, then please use an external SWD programmer to flash your device with this firmware.
Keep your devices connected and you're all set !
NOTE This only works with posix compatible systems.
How to use Btlejack
Using Btlejack is quite easy. Btlejack can:
- use various devices
- sniff an existing BLE connection
- sniff new BLE connections
- jam an existing BLE connection
- hijack an existing BLE connection
- export captured packets to various PCAP formats