blue-tap 2.6.5

Bluetooth/BLE Penetration Testing Toolkit for Automotive IVI Systems

Documentation · CLI Reference · CVE Matrix · Changelog

Blue-Tap is a Bluetooth Classic and BLE security assessment framework designed to find both known and unknown vulnerabilities in Bluetooth stacks. It targets automotive IVI systems, mobile devices, IoT endpoints, and embedded firmware — anything with a Bluetooth radio. 101 modules across 6 families cover the full pentest lifecycle from device discovery through 0-day hunting via protocol-aware fuzzing. A DarkFirmware capability on RTL8761B controllers extends testing below the HCI boundary into the Link Manager and Link Controller layers, reaching the 40-45% of the Bluetooth attack surface that host-only tools cannot see.

Features

Discovery & Reconnaissance — Classic and BLE device scanning, SDP/GATT enumeration, L2CAP/RFCOMM channel probing, device fingerprinting, HCI capture, BLE/LMP sniffing, capability detection, and cross-probe correlation. Guide

Vulnerability Assessment — 25 CVE detections (behavioral + compliance) and 11 non-CVE posture checks covering L2CAP, BNEP, SDP, AVRCP, GATT, HID, SMP, and pairing protocols. CVE Matrix

Exploitation — KNOB (CVE-2019-9506), BIAS (CVE-2020-10135), BLUFFS (CVE-2023-24023), CTKD (CVE-2020-15802), encryption downgrade, SSP downgrade, connection hijack, and PIN brute-force. Guide

Denial of Service — 9 CVE-backed crash probes and 21 protocol stress tests across L2CAP, SDP, RFCOMM, BNEP, HFP, OBEX, LMP, and pairing with automatic recovery monitoring. DoS Matrix

Post-Exploitation — Phonebook extraction (PBAP), message access (MAP), call audio (HFP), audio streaming (A2DP), media control (AVRCP), file push (OPP), Bluesnarfer (OBEX), and AT command probing. Guide

Protocol Fuzzing — 16-protocol mutation fuzzer with coverage-guided, state-machine, targeted, and random-walk strategies. Crash database, payload minimization, CVE reproduction, and live Rich dashboard. 6,685+ seeds. Typed Python research API (run_campaign, benchmark, MockTransport) plus a seedable mutation stream for reproducible campaigns and hardware-free CI smoke tests. Guide

DarkFirmware (Below-HCI) — RTL8761B firmware patching for LMP injection, link-layer monitoring, and controller memory R/W. Reaches the 40-45% of Bluetooth CVEs invisible to host-only tools. Hardware Setup

Reporting & Sessions — Professional HTML and JSON reports with 11 per-module adapters. Persistent sessions for multi-phase assessments. Guide

Installation

Prerequisites

• Linux (Kali recommended)
• Python 3.10+
• BlueZ 5.50+ (bluetoothctl, hcitool, btmon)
• An RTL8761B-based USB dongle (e.g., TP-Link UB500) — Blue-Tap currently gates all live operations behind RTL8761B detection. Stock firmware is fine; DarkFirmware unlocks below-HCI features.
• Root privileges for Bluetooth operations

Via PyPI

pip install blue-tap

From Source

git clone https://github.com/Indspl0it/blue-tap.git
cd blue-tap
pip install -e .

Verify Installation

blue-tap --version          # print Blue-Tap version
blue-tap doctor             # check prerequisites — no root, no hardware needed
blue-tap session list       # list past sessions — no root, no hardware needed
blue-tap demo               # full pipeline against simulated data — no hardware needed
sudo blue-tap adapter list  # enumerate live HCI adapters (needs root + RTL8761B)

See the full Installation Guide for detailed setup, including DarkFirmware flashing.

Usage

Blue-Tap follows a phase-verb workflow that mirrors a real-world Bluetooth pentest:

discover  →  recon  →  vulnscan  →  exploit  →  dos  →  extract  →  fuzz  →  report

Quick Start

# 1. Find nearby Bluetooth devices
sudo blue-tap discover classic -d 20

# 2. Deep recon on a target
sudo blue-tap recon 4C:4F:EE:17:3A:89 sdp
sudo blue-tap recon 4C:4F:EE:17:3A:89 fingerprint

# 3. Scan for vulnerabilities (25 CVE + 11 posture checks)
sudo blue-tap vulnscan 4C:4F:EE:17:3A:89

# 4. Exploit a confirmed vulnerability
sudo blue-tap exploit 4C:4F:EE:17:3A:89 knob --yes

# 5. Extract data post-exploitation
sudo blue-tap extract 4C:4F:EE:17:3A:89 contacts --all

# 6. Generate HTML report
blue-tap report --format html --output report.html

Prefix any command with --dry-run (or set BLUE_TAP_DRY_RUN=1) to print the resolved plan without touching hardware or sending packets — useful for previewing destructive operations and for CI pipelines.

Automation

# Full automated assessment against a single target
sudo blue-tap auto 4C:4F:EE:17:3A:89 --yes

# Fleet scan — discover and assess all IVI devices in range
sudo blue-tap fleet --duration 20 --class ivi

# Run a bundled playbook (see `blue-tap run-playbook --list` for all)
sudo blue-tap run-playbook --playbook ivi-attack 4C:4F:EE:17:3A:89

Fuzzing

# Multi-protocol fuzzing campaign (needs hardware)
sudo blue-tap fuzz campaign 4C:4F:EE:17:3A:89 -p sdp -p rfcomm --duration 2h

# Reproducible CI smoke (no hardware, no root)
BLUE_TAP_FUZZ_SEED=42 blue-tap fuzz campaign --dry-run --strategy random \
    -p sdp -n 200 --cooldown 0

# Variance benchmarks for research
blue-tap fuzz benchmark --dry-run --strategy random -p sdp -t 5 -n 500 \
    --base-seed 42 --trajectory-interval 0.5 \
    -o bench.json --csv-dir traj/

# Crash analysis (no root, no hardware needed — pure on-disk crash database)
blue-tap fuzz crashes list --protocol sdp --severity HIGH
blue-tap fuzz crashes show CRASH_ID
blue-tap fuzz crashes export -o crashes.json

# Get help for any fuzz subcommand
blue-tap fuzz crashes --help
blue-tap fuzz campaign --help
blue-tap fuzz benchmark --help

See the full CLI Reference for all commands and options.

Documentation

Full documentation is hosted at Indspl0it.github.io/blue-tap

Legal Disclaimer

Blue-Tap is provided for authorized security testing and research purposes only. You must have explicit written permission from the owner of any device you test. Unauthorized access to Bluetooth devices is illegal under the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, and similar laws worldwide. The authors accept no liability for misuse. Report vulnerabilities responsibly to the affected manufacturer.

License

GNU General Public License v3.0

Santhosh Ballikonda — @Indspl0it