Aether-B — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Aether-B is a multi-phase Bluetooth and Bluetooth Low Energy (BLE) penetration testing orchestrator. It automates the complete assessment lifecycle from passive reconnaissance through exploitation and firmware extraction, coordinating specialized Bluetooth security tools at each stage.

The assessment follows five phases: Phase 0 performs passive reconnaissance using ubertooth-scan, hcitool lescan, and btscanner to discover Bluetooth Classic and BLE devices in range without alerting them. Phase 1 enumerates discovered devices via sdptool (SDP service records), gatttool (GATT attribute enumeration for BLE), and hcitool info (device capabilities and features). Phase 2 attempts key recovery using crackle (BLE Legacy Pairing key extraction from sniffed traffic), ubertooth-btle (raw BLE link-layer capture), Just Works pairing detection, and KNOB (Key Negotiation of Bluetooth) attack checks.

Phase 3 moves into active exploitation using bettercap (Bluetooth MitM), GATTacker (BLE device cloning and MitM), BlueToolkit (automated Bluetooth vulnerability scanning), and BIAS (Bluetooth Impersonation AttackS) sequences. Phase 4 targets device firmware through binwalk (firmware image analysis and extraction) and openocd (JTAG/SWD debug interface access for direct flash memory reads).

When managed by Crucible, Aether-B emits __CRUCIBLE_LOG__, __CRUCIBLE_STATUS__, __CRUCIBLE_FINDING__, and __CRUCIBLE_PROMPT__ protocol tokens. It writes findings to the universal pr0t31n schema with appropriate wireless metadata fields and supports pause/resume via the shared pr0t31n_pause module.

Phase Pipeline

Phase 1 — Survey & Discovery
Phase 2 — Bluetooth Scanning
Phase 3 — Service Enumeration
Phase 4 — Protocol Analysis
Phase 5 — Vulnerability Assessment
Phase 6 — Attack Execution

Security

Requires root/sudo for Bluetooth adapter access (hciconfig, ubertooth). CLI tool. Ubertooth One hardware recommended for passive BLE sniffing.

Features

Enumeration

Service & GATT Enumeration

Phase 1: Enumerates SDP service records (Bluetooth Classic) via sdptool, GATT attributes and characteristics (BLE) via gatttool, and device capabilities via hcitool info.

Exploitation

BLE MitM via GATTacker

Phase 3: Clones a BLE peripheral's GATT profile and interposes between the peripheral and its central device, enabling data interception and manipulation.

BIAS Impersonation

Phase 3: Tests Bluetooth Impersonation AttackS (BIAS) where an attacker impersonates a previously paired device to establish an encrypted connection without knowing the link key.

BlueToolkit Scanning

Phase 3: Runs automated Bluetooth vulnerability checks using BlueToolkit for known CVEs and implementation flaws.

Firmware

Firmware Extraction & Analysis

Phase 4: Extracts and analyzes Bluetooth device firmware through binwalk (image analysis) and openocd (JTAG/SWD debug interface) to identify hardcoded credentials, cryptographic keys, and vulnerable code.

Integration

Crucible Management

Full Crucible v2 integration via __CRUCIBLE_* protocol tokens for real-time status, log streaming, finding emission, and interactive prompts.

Key Recovery

BLE Key Extraction

Phase 2: Extracts BLE Legacy Pairing temporary keys from sniffed pairing exchanges using crackle, enabling decryption of subsequent encrypted traffic.

KNOB Attack Check

Phase 2: Tests for Key Negotiation of Bluetooth (KNOB) vulnerability where the entropy of the encryption key can be reduced to 1 byte, enabling brute-force decryption.

Reconnaissance

Passive Bluetooth Discovery

Phase 0: Detects Bluetooth Classic and BLE devices using ubertooth-scan, hcitool lescan, and btscanner without establishing connections or alerting target devices.

Reliability

Pause & Resume

Supports graceful pause via pr0t31n_pause, allowing the operator to interrupt and resume long-running Bluetooth captures.

Use Cases

IoT Device Bluetooth Assessment

Perform a comprehensive security assessment of IoT devices that use Bluetooth Classic or BLE for communication, testing pairing security, GATT service exposure, and firmware integrity.

Medical Device BLE Security Testing

Assess Bluetooth Low Energy implementations on medical devices for unauthorized data access, weak pairing (Just Works), and susceptibility to MitM attacks on patient data transmissions.

Automotive Bluetooth Testing

Evaluate vehicle infotainment and telematics Bluetooth interfaces for KNOB vulnerability, BIAS impersonation, and unauthorized service access.

Smart Lock & Access Control Assessment

Test BLE-enabled physical access control systems for replay attacks, weak key exchange, and GATTacker-based MitM that could enable unauthorized entry.

Bluetooth Firmware Security Review

Extract and analyze Bluetooth chipset firmware via JTAG/SWD to identify hardcoded encryption keys, debug interfaces left enabled, and known vulnerable firmware versions.

CLI Reference

Command Examples

Full BLE Assessment

sudo python3 aether_b.py --settings settings.json

Run all Bluetooth/BLE assessment phases.

Target Specific Device

sudo python3 aether_b.py --target-bdaddr AA:BB:CC:DD:EE:FF --phase enumeration

Enumerate a specific device by MAC address.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

ubertooth-scan

Passive Bluetooth Classic device discovery using an Ubertooth One SDR dongle for spectrum-level scanning

ubertooth-scan

ubertooth-btle

Raw BLE link-layer packet capture for pairing exchange sniffing and key extraction

ubertooth-btle -f -c capture.pcap

ubertooth-btle -t AA:BB:CC:DD:EE:FF

hcitool

Bluetooth Classic and BLE device scanning and information retrieval via the host HCI interface

hcitool lescan

hcitool info AA:BB:CC:DD:EE:FF

hcitool scan

sdptool

Service Discovery Protocol queries to enumerate Bluetooth Classic services on target devices

sdptool browse AA:BB:CC:DD:EE:FF

gatttool

BLE GATT (Generic Attribute Profile) client for enumerating services, characteristics, and reading/writing attribute values

gatttool -b AA:BB:CC:DD:EE:FF --characteristics

gatttool -b AA:BB:CC:DD:EE:FF --char-read -a 0x0003

btscanner

Bluetooth device discovery with detailed device information extraction

btscanner

crackle

BLE Legacy Pairing temporary key extraction from captured pairing exchanges, enabling encrypted traffic decryption

crackle -i capture.pcap -o decrypted.pcap

bettercap

Bluetooth MitM attack framework for intercepting and modifying Bluetooth communications

bettercap -eval 'ble.recon on'

GATTacker

BLE device cloning and MitM proxy that replicates a peripheral's GATT profile for interception

node ws-slave.js

node advertise.js -a config.json

binwalk

Firmware image analysis, extraction, and entropy scanning for embedded Bluetooth devices

binwalk -e firmware.bin

binwalk -E firmware.bin

openocd

JTAG/SWD debug interface access for direct flash memory reads from Bluetooth chipsets

openocd -f interface/jlink.cfg -f target/nrf52.cfg

Finding Nomenclature

Aether-B findings use the AE- prefix in their catalogue IDs, shared with the Aether wireless family. Findings include Bluetooth-specific metadata:

bssid — the target device's Bluetooth MAC address (BD_ADDR)
wireless_data — a dictionary containing Bluetooth-specific details (device class, protocol version, pairing method, service UUIDs, GATT characteristics)

Risk levels follow the standard CRITICAL/HIGH/MEDIUM/LOW/INFO scale. Successful key extraction or MitM is typically rated CRITICAL, weak pairing configurations as HIGH, information disclosure via GATT enumeration as MEDIUM or LOW, and device discovery as INFO.

Action Items

Aether-B generates action items for physical Bluetooth testing — e.g., "Attempt Just Works pairing with target device", "Test KNOB attack with btlejuice", "Capture BLE pairing exchange for crackle analysis".

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`findings_catalogue.json`	JSON	Findings catalogue

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Aether-B && python3 aether_b.py` Run directly with command-line arguments.
CLI — Settings File	`cd /opt/pr0t31n/Aether-B && python3 aether_b.py --config config.json` Configure via config.json (JSON), then run.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Used By

Crucible (manages)
Prometheus (reports)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
BlueZ (hcitool, sdptool, gatttool, bluetoothctl)	Marcel Holtmann / BlueZ team	system	http://www.bluez.org/
Ubertooth One tools	Great Scott Gadgets / Michael Ossmann	system	https://github.com/greatscottgadgets/ubertooth
crackle	Mike Ryan	system	https://github.com/mikeryan/crackle
bettercap	Simone Margaritelli (evilsocket)	system	https://github.com/bettercap/bettercap
GATTacker	Slawomir Jasek / SecuRing	system	https://github.com/securing/gattacker
BlueToolkit	sgxgsx	system	https://github.com/sgxgsx/BlueToolkit
tshark / Wireshark	Gerald Combs / Wireshark Foundation	system	https://github.com/wireshark/wireshark
binwalk	Craig Heffner / ReFirm Labs	system	https://github.com/ReFirmLabs/binwalk
OpenOCD	OpenOCD project	system	https://github.com/openocd-org/openocd

Metadata

Name	Aether-B
Category	Wireless
Version	1.5.1
Install Path	`/opt/pr0t31n/Aether-B`
Main File	`aether_b.py`
GitHub	https://github.com/pr0t31n/Aether-B.git