offensive-bluetooth-classic
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add SnailSploit/Claude-Red --skill offensive-bluetooth-classicCompatible with
Supported agents
Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking
Practical, repeatable guidance for authorized security work.
Includes procedures, checks, and references for this skill.
| name | offensive-bluetooth-classic |
| description | "Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories." |
Older than BLE, less commonly attacked today, but still present in cars, industrial sensors, audio gear, and legacy enterprise hardware. Many of the well-known historic attacks (BlueSnarf, BlueBug) are mitigated; KNOB and the BlueBorne family remain relevant against unpatched devices.
hcitool / bluetoothctl / redfang# Modern adapter (built-in or USB Bluetooth 4.0+)
sudo hciconfig hci0 up
sudo hcitool inq # inquiry
sudo hcitool scan --length=12 # 12-second scan
# bluetoothctl interactive
bluetoothctl
> scan on
> devices
# Discoverable-mode-only devices appear; non-discoverable need address brute
sudo redfang -r 00:00:00:00:00:00-FF:FF:FF:FF:FF:FF
# (very slow — ~7 hours per OUI prefix)
# List all services on a device
sdptool browse AA:BB:CC:DD:EE:FF
sdptool records AA:BB:CC:DD:EE:FF
Common profiles and their attack relevance:
| Profile | UUID | Attack |
|---|---|---|
| OBEX Object Push (OPP) | 0x1105 | BlueSnarf/BlueBug on legacy phones (mostly extinct) |
| OBEX File Transfer (FTP) | 0x1106 | Browse / write filesystem on legacy devices |
| Headset (HSP/HFP) | 0x1108 / 0x111E | Eavesdrop active call audio |
| Serial Port Profile (SPP) | 0x1101 | Industrial/IoT debug ports — often unauthenticated |
| HID | 0x1124 | Keyboard/mouse impersonation |
| Audio Sink/Source (A2DP) | 0x110B / 0x110A | Audio injection/eavesdrop |
The Serial Port Profile (SPP) tunnels arbitrary data over Bluetooth as a virtual COM port. Industrial / IoT devices use it for debug or telemetry, often without authentication.
# Connect to SPP service, channel typically 1
sudo rfcomm bind /dev/rfcomm0 AA:BB:CC:DD:EE:FF 1
sudo screen /dev/rfcomm0 9600
# Then interact with the device's CLI / debug menu
Forces Bluetooth pairing to negotiate a 1-byte encryption key — making the link key trivially brute-forceable.
# Test with internalblue (requires Broadcom firmware patch)
git clone https://github.com/seemoo-lab/internalblue
internalblue
> log keys
# Patch firmware to allow 1-byte key; pair with target; observe weak key
Patched in firmware on most modern devices. Still works against:
A family of buffer overflows / info leaks in major Bluetooth stacks (Linux BlueZ, Android, Windows, iOS). Mostly patched 2017–2018, but unpatched embedded Linux devices are common.
# Armis blueborne-scanner — checks for patch-level
git clone https://github.com/ArmisSecurity/blueborne
python blueborne_scanner.py AA:BB:CC:DD:EE:FF
If pairing succeeds via Just Works or weak PIN, you can register as a HID device — keystroke injection on an unattended Bluetooth-paired host.
# bdaddr + HID example — register custom HID on rfcomm
hcitool dev
hciconfig hci0 class 0x000540 # HID device class
sdptool add HID
# Use a HID descriptor crafted as keyboard, send keystrokes
If a target has Bluetooth headset paired and active, and you can re-pair (PIN brute or KNOB):
# 1. Discover
sudo hcitool inq
# 2. Enumerate services per device
sdptool browse <MAC>
# 3. SPP (industrial/IoT) — connect and explore
sudo rfcomm bind /dev/rfcomm0 <MAC> 1
sudo screen /dev/rfcomm0 9600
# 4. Patch-level scan
python blueborne_scanner.py <MAC>
# 5. KNOB testing (with adapter that supports internalblue)
internalblue → log keys → re-pair target
# 6. Document profiles, auth state, exposed commands per device
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionoffensive-bluetooth-classicExecute the skills CLI command in your project's root directory to begin installation:
epx add SnailSploit/Claude-Red --skill offensive-bluetooth-classicFetches offensive-bluetooth-classic from SnailSploit/Claude-Red and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/offensive-bluetooth-classic
Restart Cursor to activate offensive-bluetooth-classic. Access via /offensive-bluetooth-classicin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
offensive-bluetooth-ble
SnailSploit/Claude-Red · wireless · same repo
offensive-krack-fragattacks
SnailSploit/Claude-Red · wireless · same repo
offensive-exploit-development
SnailSploit/Claude-Red · exploit-dev · same repo
offensive-xss
SnailSploit/Claude-Red · web · same repo
offensive-advanced-redteam
SnailSploit/Claude-Red · infrastructure · same repo
offensive-windows-boundaries
SnailSploit/Claude-Red · infrastructure · same repo
Solid pick for teams standardizing on skills: offensive-bluetooth-classic is focused, and the summary matches what you get after install.
offensive-bluetooth-classic reduced setup friction for our internal harness; good balance of opinion and flexibility.
I recommend offensive-bluetooth-classic for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
offensive-bluetooth-classic has been reliable in day-to-day use. Documentation quality is above average for community skills.
offensive-bluetooth-classic reduced setup friction for our internal harness; good balance of opinion and flexibility.
offensive-bluetooth-classic has been reliable in day-to-day use. Documentation quality is above average for community skills.
Useful defaults in offensive-bluetooth-classic — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
We added offensive-bluetooth-classic from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
offensive-bluetooth-classic fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Registry listing for offensive-bluetooth-classic matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 25