HACKING PROJECT · wireless · Advanced
BLE Sniffer & Replay Tool
Sniff, enumerate, and replay BLE traffic to identify weak pairing, missing authentication, and replay vulnerabilities in BLE devices.
Bluetooth Low Energy is embedded in wearables, medical devices, smart locks, access fobs, and IoT sensors, yet many implementations use weak or no pairing, static keys, and unauthenticated GATT characteristics, exposing them to sniffing and replay attacks. Developers and security teams lack accessible tooling to assess BLE devices for these flaws before deployment. The gap is a hands-on BLE capture-and-replay platform for authorized security testing.
**What you'll build**
Build a BLE assessment tool that sniffs advertising and connection traffic across the three advertising channels, follows connections, enumerates GATT services/characteristics, captures command sequences, and replays them to test for missing authentication, freshness/nonce protection, and encryption. Include pairing-mode analysis (Just Works vs. LE Secure Connections) and a report highlighting replayable, unauthenticated operations, strictly for devices the tester owns or is authorized to assess.
**Objective** — Sniff, enumerate, and replay BLE traffic to identify weak pairing, missing authentication, and replay vulnerabilities in BLE devices.
**Expected outcome** — A working BLE sniffer/replay tool that captures GATT traffic, enumerates characteristics, replays commands, and reports authentication/replay weaknesses.
**Difficulty** — Advanced — BLE link-layer sniffing, channel-hopping capture, GATT enumeration, and replay require specialized hardware and protocol depth.
**Primary category** — IoT/Wireless Penetration Testing; Secondary = Hardware/RF Security, Security Research
**Security domains** — Primary = Red Team / Security Research; Secondary = IoT Security, Digital Forensics, Blue Team
**Technical focus** — BLE advertising/connection, GATT/ATT, pairing (Just Works/Passkey/LE Secure Connections), channel hopping, sniffing, replay attacks, nonce/freshness analysis, IoT protocol testing
**Core technologies** — Languages: Python, C; Frameworks/Libraries: bleak, PyBluez, Bumble, Scapy (BT layers); Security Tools: nRF Sniffer, Ubertooth, btlejack, gatttool/bluetoothctl, Wireshark (BT); Cloud/Infra: nRF52840/Ubertooth One hardware, Linux with BlueZ; AI/Data: pandas for reporting; Databases: SQLite, PCAP
**Where it's valued** — IoT/product security, medical devices, automotive, smart-home, access-control vendors, security consultancies
**Careers it builds toward** — IoT Security Researcher, Hardware/Wireless Pentester, Red Team Operator, Embedded Security Engineer, Product Security Analyst
**Framework alignment**
• MITRE ATT&CK: Adversary-in-the-Middle T1557, Replay-based abuse, Network Sniffing T1040; ATT&CK for Mobile / ICS AiTM concepts for constrained devices
• NIST CSF 2.0: Identify (ID.RA), Protect (data-in-transit), Detect; supports IoT device risk assessment
• OWASP: OWASP MASVS (MASVS-CRYPTO, MASVS-NETWORK) and OWASP IoT Top 10 (I4 lack of secure update, weak/guessable, insecure network services)
• CIS Controls v8: Control 7 (Vulnerability Management), Control 1 (Asset Inventory), Control 12 (Network Infrastructure), Control 4 (Secure Configuration)
**Innovation** — Improved Existing Solution — BLE sniffing tools exist (btlejack, nRF), but an integrated sniff-enumerate-replay-report workflow with pairing analysis adds practical value. Scores: Innovation 6/10, Startup 6/10, Enterprise-Readiness 5/10, Patent = Possible.