CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

blueXploit

blueXploit blueXploit video blueXploit is my own proof-of-concept that reproduces CVE-2023-45866 , the Bluetooth keystroke-injection vulnerability discovered by Marc Newlin. It abuses a flaw in the Bluetooth protocol to inject keystrokes into a target device without pairing , opening the door to...

system_bt_AOSP10_r33_CVE-2021-0435

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source root@kitploit: mkdir /fluoride cd /fluoride git clone...

shining-mask

Shining Mask Hacks This repository contains code and instructions for creating a custom Bluetooth Low Energy BLE controller for the Shining LED Mask that automatically changes the face image of any masks within BLE range. This repository is a companion to Invasion of the Facechangers: Halloween...

BTLE

BTLE BTLE is a free and open-source Bluetooth Low Energy BLE Software Defined Radio software suite and open BTLE chip design. It includes: BTLE baseband algorithms description, Python and Verilog implementation, FPGA and SkyWater 130 PDK OpenLane2 workflow results. Analog Devices AD9361 + Xilinx...

crackle

crackle cracks BLE Encryption AKA Bluetooth Smart. crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK Temporary Key. With the TK and other data collected from the pairing process, the STK Short Term Key and later the LTK Long Ter...

BlueSpy

BlueSpy - PoC to record audio from a Bluetooth device This repository contains the implementation of a proof of concept to record and replay audio from a bluetooth device without the legitimate user's awareness. The PoC was demonstrated during the talk BSAM: Seguridad en Bluetooth at RootedCON 20...

system_bt_AOSP10_r33_CVE-2021-0431

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source root@kitploit: mkdir /fluoride cd /fluoride git clone...

Komfy-Switch-Wifi-Password-Disclosure

Komfy-Switch-Wifi-Password-Disclosure Intro This writeup will detail my finding on D-Link's Komfy Switch with Camera to retrieve the device's associated wifi ssid and password over bluetooth 4.0 BLE. The Komfy switch is a home security and automation product that can replace a wall switch in your...

openwifipass

OpenWifiPass An open source implementation of the grantor role in Apple's Wi-Fi Password Sharing protocol. Disclaimer OpenWifiPass is experimental software and is the result of reverse engineering efforts by the Open Wireless Link project. The code serves solely documentary and educational...

CVE-2017-0785

CVE-2017-0785 PoC This is just a personal study based on the Android information leak vulnerability released by Armis. Further reading: https://www.facebook.com/khelfatni To run, be sure to have pybluez and pwntools installed. root@kitploit: sudo apt-get install bluetooth libbluetooth-dev sudo pi...

DLPwn

DLPwn Data Leak Prevention via Bluetooth Speaker DLPwn is a Red Team tool designed for file exfiltration to bypass security systems such as EDR Endpoint Detection and Response, XDR Extended Detection and Response, DLP Data Loss Prevention, and more broadly any air-gapped information systems. It...

wigle-wifi-wardriving

WiGLE Wireless Wardriving Network stumbling client for Android, from wigle.net. This client provides geolocated detection and logging for WiFi, Bluetooth, and cellular signals using Android devices. As of January 2023, this application supports Android SDK versions 24 Nougat and up. For older...

Mahesh-970-CVE-2023-21125_bluedriod_repo

This repository does not have a README...

system_bt_AOSP10_r33_CVE-2022-20224

Fluoride Bluetooth stack Building and running on AOSP Just build AOSP - Fluoride is there by default. Building and running on Linux Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0 Download source root@kitploit: mkdir /fluoride cd /fluoride git clone...

bitchat-android

!WARNING This software has not received external security review and may contain vulnerabilities and may not necessarily meet its stated security goals. Do not use it for sensitive use cases, and do not rely on its security until it has been reviewed. Work in progress. bitchat for Android A secur...

om-research

OM Research This repository explores the Bluetooth Low Energy BLE protocol used by the Osmo Mobile series of gimbals. The official mobile apps are outdated and require broad system permissions. However, the gimbals themselves communicate through a simple BLE protocol. The goal of this project is ...

BlueToolkit

Extensible Bluetooth vulnerability testing framework for BR/EDR and BLE. Docs • Installation • Usage • Exploits • Hardware • TODOs • Automotive Evaluation • Bluetooth Resources • License BlueToolkit is a modular, black-box Bluetooth security testing framework for Bluetooth Classic BR/EDR and...

Upgraded_BlueBourne-CVE-2017-0785-

UpgradedBlueBourne-CVE-2017-0785- upgraded of BlueBourne CVE-2017-0785 to python3 root@kitploit: $ sudo apt-get install bluetooth libbluetooth-dev $ pip install pybluez $ pip3 install pwntools...