BT Audit

https://github.com/yesimxev/bt_audit
Admin
BT Audit is a suite of Bluetooth device auditing tools for discovering open L2CAP PSMs and RFCOMM...
Tokens:1,868
Snippets:17
Trust Score:9
Update:6 months ago
Show doc for...
Tokens:
Raw
### Build BT Audit Tools

Source: https://context7.com/yesimxev/bt_audit/llms.txt

Install BlueZ development libraries and build the `psm_scan` and `rfcomm_scan` tools using the provided Makefile. Requires Linux with BlueZ installed.

```bash
sudo apt-get install libbluetooth-dev
cd src
make
make clean
```

--------------------------------

### Interpret L2CAP Response Codes

Source: https://context7.com/yesimxev/bt_audit/llms.txt

Reference guide for interpreting raw socket scan output and L2CAP connection response results.

```bash
# L2CAP Connection Response Results:
# L2CAP_CR_SUCCESS    - PSM is open and accepting connections
# L2CAP_CR_PEND       - Connection pending (authentication/authorization in progress)
# L2CAP_CR_BAD_PSM    - PSM not registered/available (closed)
# L2CAP_CR_SEC_BLOCK  - Security block (authentication/encryption required)
# L2CAP_CR_NO_MEM     - No resources available

# L2CAP Connection Status Codes:
# L2CAP_CS_NO_INFO    - No further information available
# L2CAP_CS_AUTHEN_PEND - Authentication pending
# L2CAP_CS_AUTHOR_PEND - Authorization pending

# Example raw socket scan output interpretation:
# psm: 0x0001 (00001) status: L2CAP_CS_NO_INFO     result: L2CAP_CR_SUCCESS
#   -> SDP service (PSM 1) is open without security
# psm: 0x000f (00015) status: L2CAP_CS_AUTHEN_PEND result: L2CAP_CR_PEND
#   -> BNEP (PSM 15) requires authentication
# psm: 0x0017 (00023)                              result: L2CAP_CR_SEC_BLOCK
#   -> AVCTP (PSM 23) blocked by security policy
```

--------------------------------

### Automated Device Audit with btdsd_sample.sh

Source: https://context7.com/yesimxev/bt_audit/llms.txt

Execute the `btdsd_sample.sh` script to perform a comprehensive Bluetooth device audit, collecting hardware info, SDP services, L2CAP PSMs, and RFCOMM channels into a report file.

```bash
cd scripts
./btdsd_sample.sh 00:11:22:33:44:55 device_report.txt
```

```bash
cat device_report.txt
```

--------------------------------

### Compile psm_scan and rfcomm_scan

Source: https://context7.com/yesimxev/bt_audit/llms.txt

The compilation commands generated by `make` for `psm_scan` and `rfcomm_scan` using gcc and the Bluetooth library.

```bash
gcc psm_scan.c -o psm_scan -lbluetooth
```

```bash
gcc rfcomm_scan.c -o rfcomm_scan -lbluetooth
```

--------------------------------

### Scan L2CAP PSMs with psm_scan

Source: https://context7.com/yesimxev/bt_audit/llms.txt

Scan a target Bluetooth device for open L2CAP PSMs. Requires root privileges for raw socket mode. Use `-o` for quiet mode (only open PSMs) and `-c` for a simpler connect scan that does not require root.

```bash
sudo ./psm_scan 00:11:22:33:44:55
```

```bash
sudo ./psm_scan -o 00:11:22:33:44:55
```

```bash
sudo ./psm_scan -s 1 -e 1001 00:11:22:33:44:55
```

```bash
./psm_scan -c 00:11:22:33:44:55
```

```bash
sudo ./psm_scan -S 00:AA:BB:CC:DD:EE 00:11:22:33:44:55
```

```bash
sudo ./psm_scan -o -s 1 -e 255 -S 00:AA:BB:CC:DD:EE 00:11:22:33:44:55
```

--------------------------------

### Scan RFCOMM Channels with rfcomm_scan

Source: https://context7.com/yesimxev/bt_audit/llms.txt

Scan a target Bluetooth device for open RFCOMM channels (1-30). Use `-o` to display only open channels. The `-d` option keeps the ACL connection active for faster scanning.

```bash
./rfcomm_scan 00:11:22:33:44:55
```

```bash
./rfcomm_scan -o 00:11:22:33:44:55
```

```bash
./rfcomm_scan -s 1 -e 10 00:11:22:33:44:55
```

```bash
./rfcomm_scan -d 00:11:22:33:44:55
```

```bash
./rfcomm_scan -S 00:AA:BB:CC:DD:EE 00:11:22:33:44:55
```

```bash
./rfcomm_scan -o -d -s 1 -e 30 00:11:22:33:44:55
```

--------------------------------

### Apply BlueZ Kernel Patch

Source: https://context7.com/yesimxev/bt_audit/llms.txt

Applies a legacy kernel patch for Linux 2.4.x to enable raw socket access to L2CAP command responses. This is not required for kernels 2.6.5 and newer.

```bash
# Apply patch to Linux 2.4.x kernel (NOT required for 2.6.5+)
cd /usr/src/linux/net/bluetooth
patch -p0 < /path/to/bt_audit/patches/bluez_l2cap_raw_socket.patch

# Rebuild kernel modules
make modules
make modules_install
```
Tokens:
Raw