Skip to content

Commit 6bd6819

Browse files
V33RUV33RU
committed
Update recon.md
1 parent 11fb389 commit 6bd6819

1 file changed

Lines changed: 144 additions & 60 deletions

File tree

‎docs/recon.md‎

Lines changed: 144 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Reconnaissance (6)
1+
# Reconnaissance (5)
22

33
Auto-generated from `modules/recon/`.
44
Load any module with `use recon/<name>`.
@@ -11,34 +11,36 @@ Load any module with `use recon/<name>`.
1111

1212
## Module index
1313

14-
| Module | Severity | CVE | Description |
14+
| Module | Severity | Protocol | Description |
1515
|---|---|---|---|
16-
| [`recon/adv_parser`](#reconadv_parser) | ℹ️ INFO | — | Deep BLE advertisement data analysis |
17-
| [`recon/discovery`](#recondiscovery) | ℹ️ INFO | — | Passive full-spectrum Bluetooth discovery — Classic + BLE |
18-
| [`recon/gatt_enum`](#recongatt_enum) | ℹ️ INFO | — | Enumerate GATT services and characteristics |
19-
| [`recon/oui_lookup`](#reconoui_lookup) | ℹ️ INFO | — | Bluetooth MAC Address OUI Manufacturer Lookup |
20-
| [`recon/sdp_enum`](#reconsdp_enum) | ℹ️ INFO | — | Advanced SDP enumerator — risk + CVE map, PnP decode, L2CAP probe |
21-
| [`recon/version_fingerprint`](#reconversion_fingerprint) | ℹ️ INFO | — | Bluetooth Device OS/Firmware Fingerprinting |
16+
| [`recon/adv_parser`](#reconadv_parser) | ℹ️ INFO | BLE | Deep BLE advertisement data analysis |
17+
| [`recon/discovery`](#recondiscovery) | ℹ️ INFO | Both | Passive full-spectrum Bluetooth discovery — Classic + BLE |
18+
| [`recon/gatt_enum`](#recongatt_enum) | ℹ️ INFO | BLE | GATT enumerator with device identity, chipset detection, LL version |
19+
| [`recon/oui_lookup`](#reconoui_lookup) | ℹ️ INFO | Both | Bluetooth MAC address OUI manufacturer lookup |
20+
| [`recon/sdp_enum`](#reconsdp_enum) | ℹ️ INFO | Classic | Advanced SDP enumerator — risk scoring, CVE map, PnP decode, L2CAP probe |
2221

2322
---
2423

2524
## Modules
2625

2726
### `recon/adv_parser`
2827

29-
**scanners/ble/adv_parser**
28+
**BLE Advertisement Parser**
3029

31-
Deep BLE advertisement data analysis
30+
Passive BLE scanner that decodes every advertisement packet in detail:
31+
Apple Continuity sub-types, Microsoft Swift Pair, Google Fast Pair,
32+
Eddystone-URL/UID, iBeacon, manufacturer data, service UUIDs, TX power,
33+
and RSSI. Optionally filter by BD_ADDR or device name.
3234

3335
**Severity:** ℹ️ INFO · **Protocol:** BLE
3436

3537
| Option | Required | Default | Description |
3638
|---|---|---|---|
37-
| `timeout` | | `15` | Scan duration (seconds) |
38-
| `target` | | | Filter by BD_ADDR |
39-
| `filter_name` | | | Filter by name |
40-
| `show_raw` | | `False` | Show raw bytes |
41-
| `output_file` | | | Save to JSON |
39+
| `timeout` | | `15` | Scan duration in seconds |
40+
| `target` | | | Filter by BD_ADDR |
41+
| `filter_name` | | | Filter by device name |
42+
| `show_raw` | | `False` | Show raw manufacturer data bytes |
43+
| `output_file` | | | Save results to JSON |
4244

4345
**References:**
4446
- <https://www.bluetooth.com/specifications/assigned-numbers/>
@@ -47,35 +49,115 @@ Deep BLE advertisement data analysis
4749

4850
### `recon/discovery`
4951

50-
Passive full-spectrum Bluetooth discovery — Classic + BLE
52+
**Full-Spectrum Bluetooth Discovery Scanner**
53+
54+
Passive discovery for Classic BR/EDR and BLE. BLE and Classic scans run
55+
**sequentially** on the same adapter to avoid BlueZ `Operation already in
56+
progress` conflicts.
5157

5258
**Severity:** ℹ️ INFO · **Protocol:** BOTH
5359

60+
#### Scan sequence (mode = all)
61+
62+
```
63+
[1/2] BLE scan — bleak BleakScanner, duration seconds
64+
↓ adapter released
65+
[2/2] BR/EDR inquiry — hcitool inq + hcitool scan, duration seconds
66+
```
67+
68+
With `mode=ble` or `mode=classic` only one phase runs.
69+
70+
#### What is extracted passively
71+
72+
| Source | Data extracted |
73+
|---|---|
74+
| Manufacturer data | Apple product type (AirPods, Watch, FindMy…), iBeacon UUID/Major/Minor, Microsoft Swift Pair |
75+
| Service UUIDs | Device class (HeartRate, HID, DFU, Mesh…), risky service flags |
76+
| Service data | Eddystone-URL / Eddystone-UID decoded |
77+
| BLE flags byte | Discoverable mode, cross-transport (BR/EDR + LE) |
78+
| RSSI 6-sample avg | Stable distance estimate via log-distance path-loss model |
79+
| Address type | public / random (static / RPA / NRPA) |
80+
81+
Risky services (DFU, HID, Mesh Provisioning) are flagged with `!` in the live table.
82+
83+
#### Options
84+
5485
| Option | Required | Default | Description |
5586
|---|---|---|---|
56-
| `timeout` | | `15` | Scan duration in seconds |
57-
| `mode` | | `all` | Protocol: all \| ble \| classic |
58-
| `interface` | | `hci0` | HCI adapter (e.g. hci0) |
59-
| `min_rssi` | | | Ignore BLE devices below this RSSI (e.g. -85) |
60-
| `live` | | `True` | Print each new device as it is discovered |
61-
| `output_file` | | | Save results to JSON |
87+
| `timeout` | | `15` | Scan duration per phase in seconds |
88+
| `mode` | | `all` | Protocol: all \| ble \| classic |
89+
| `interface` | | `hci0` | HCI adapter |
90+
| `min_rssi` | | | Ignore BLE devices below this RSSI (dBm) |
91+
| `live` | | `True` | Print each new device as it is discovered |
92+
| `output_file` | | | Save results to JSON |
6293

6394
---
6495

6596
### `recon/gatt_enum`
6697

67-
**scanners/ble/gatt_enum**
98+
**GATT Enumerator + Device Identity**
6899

69-
Enumerate GATT services and characteristics
100+
Connects over BLE GATT, prints a full device identity header, then
101+
enumerates every service and characteristic with properties, handles,
102+
and live-read values.
70103

71104
**Severity:** ℹ️ INFO · **Protocol:** BLE
72105

106+
#### Device identity header
107+
108+
Before the GATT table the module collects and displays:
109+
110+
| Field | Source |
111+
|---|---|
112+
| BD_ADDR | Target address |
113+
| Address Type | BlueZ D-Bus device record |
114+
| Device Name | `BleakScanner.find_device_by_address` → advertising `local_name`; fallback to `bluetoothctl info` |
115+
| Appearance | `bluetoothctl info` cached record |
116+
| Manufacturer | GATT 0x2A29 (Manufacturer Name characteristic) |
117+
| Model | GATT 0x2A24 |
118+
| Serial | GATT 0x2A25 |
119+
| Firmware | GATT 0x2A26 |
120+
| Hardware | GATT 0x2A27 |
121+
| Software | GATT 0x2A28 |
122+
| System ID | GATT 0x2A23 |
123+
| PnP ID | GATT 0x2A50 — decoded: vendor ID source, vendor name, product ID, version |
124+
| Chipset | PnP vendor ID → lookup table; fallback: manufacturer string pattern match; fallback: OUI prefix lookup |
125+
| LL/LMP Version | `hcitool leinfo` (BLE LE connection) → `hcitool info` (Classic fallback) |
126+
127+
#### LL / chipset detection priority
128+
129+
```
130+
1. hcitool leinfo <addr> — LE connection, reads remote version (needs CAP_NET_RAW)
131+
Subversion 0x8762 → Realtek RTL8762
132+
Subversion 0x000D → Nordic nRF52840 … (12 known subversions)
133+
134+
2. hcitool info <addr> — Classic BR/EDR inquiry (Dual devices)
135+
136+
3. bluetoothctl info <addr> — BlueZ cached record, no root needed
137+
→ device Name + Appearance
138+
```
139+
140+
All three fall back silently. The LL version line only appears when at least one source succeeds.
141+
142+
#### GATT characteristics table
143+
144+
Each characteristic row shows: UUID, human-readable name, properties
145+
(`R W WNR N I`), handle, and live-read value (when `read_values=True`).
146+
Writable characteristics are highlighted yellow; notify/indicate magenta.
147+
148+
Summary sections at the bottom list:
149+
150+
- All writable characteristics (attack surface)
151+
- All notify/indicate characteristics
152+
153+
#### Options
154+
73155
| Option | Required | Default | Description |
74156
|---|---|---|---|
75-
| `target` | ✓ | | Target BD_ADDR (XX:XX:XX:XX:XX:XX) |
76-
| `timeout` | | `15` | Connection timeout in seconds |
77-
| `read_values` | | `True` | Attempt to read characteristic values |
78-
| `output_file` | | | Save results to JSON file |
157+
| `target` | ✓ | | Target BD_ADDR (XX:XX:XX:XX:XX:XX) |
158+
| `timeout` | | `15` | Connection timeout in seconds |
159+
| `read_values` | | `True` | Attempt to read characteristic values |
160+
| `output_file` | | | Save results to JSON |
79161

80162
**References:**
81163
- <https://www.bluetooth.com/specifications/gatt/>
@@ -84,63 +166,65 @@ Enumerate GATT services and characteristics
84166

85167
### `recon/oui_lookup`
86168

87-
**scanners/oui_lookup**
169+
**OUI Manufacturer Lookup**
88170

89-
Bluetooth MAC Address OUI Manufacturer Lookup
171+
Look up the IEEE OUI prefix of one or more Bluetooth BD_ADDRs to identify
172+
the manufacturer. Supports optional online lookup for addresses not in the
173+
local database.
90174

91175
**Severity:** ℹ️ INFO · **Protocol:** BOTH
92176

93177
| Option | Required | Default | Description |
94178
|---|---|---|---|
95-
| `target` | ✓ | | BD_ADDR or comma-separated list (XX:XX:XX:XX:XX:XX) |
96-
| `online` | | `False` | Use online lookup if not in database |
97-
| `verbose` | | `True` | Show detailed output |
179+
| `target` | ✓ | | BD_ADDR or comma-separated list |
180+
| `online` | | `False` | Use online lookup if not in local database |
181+
| `verbose` | | `True` | Show detailed output |
98182

99183
**References:**
100184
- <https://standards-oui.ieee.org/>
101-
- <https://www.wireshark.org/tools/oui-lookup.html>
102185

103186
---
104187

105188
### `recon/sdp_enum`
106189

107-
Advanced SDP enumerator — risk + CVE map, PnP decode, L2CAP probe
190+
**Advanced SDP Enumerator**
108191

109-
**Severity:** ℹ️ INFO · **Protocol:** CLASSIC
192+
Deep enumeration of the Classic Bluetooth SDP catalogue on a target device.
193+
Goes well beyond plain `sdptool browse` — annotates every service with a
194+
risk tier and CVE list, decodes PnP Information records, probes L2CAP PSMs
195+
for reachability, and parses XML attribute records.
110196

111-
| Option | Required | Default | Description |
112-
|---|---|---|---|
113-
| `target` | ✓ | | Target BD_ADDR (XX:XX:XX:XX:XX:XX) |
114-
| `mode` | | `full` | Mode: full \| browse \| records \| tree |
115-
| `search` | | | Search a specific service (SP, DUN, OPP, FTP, HID, NAP, …) |
116-
| `probe_l2cap` | | `True` | Attempt L2CAP connect on each PSM to confirm reachability |
117-
| `decode_pnp` | | `True` | Decode PnP Information record (UUID 0x1200) |
118-
| `xml_attrs` | | `True` | Also fetch & parse XML attribute records |
119-
| `timeout` | | `30` | Per-command timeout in seconds |
120-
| `output_file` | | | Save the full structured report to JSON |
121-
122-
**References:**
123-
- <https://www.bluetooth.com/specifications/assigned-numbers/service-discovery/>
124-
- <https://www.bluetooth.com/specifications/specs/device-identification-profile-1-3/>
125-
- <https://www.bluez.org/>
197+
!!! note "Classic only"
198+
SDP runs over L2CAP PSM 0x0001 (BR/EDR). For BLE devices use
199+
`recon/gatt_enum` instead.
126200

127-
---
201+
**Severity:** ℹ️ INFO · **Protocol:** CLASSIC
128202

129-
### `recon/version_fingerprint`
203+
#### Risk annotation
130204

131-
**scanners/version_fingerprint**
205+
Services are matched against a curated UUID → risk table covering:
132206

133-
Bluetooth Device OS/Firmware Fingerprinting
207+
HID (CVE-2023-45866), BNEP/PAN (BlueBorne CVE-2017-0781), OBEX FTP/OPP
208+
(BlueSnarfing), HFP/HSP (AT-command RCE), PBAP/MAP/SIM Access (privacy
209+
leak), A2DP/AVRCP (BlueFrag CVE-2020-0022), SDP itself (CVE-2017-0785),
210+
and more.
134211

135-
**Severity:** ℹ️ INFO · **Protocol:** BOTH
212+
#### Options
136213

137214
| Option | Required | Default | Description |
138215
|---|---|---|---|
139-
| `target` | ✓ | | Target BD_ADDR (XX:XX:XX:XX:XX:XX) |
140-
| `protocol` | | `auto` | Protocol: auto, classic, or ble |
141-
| `timeout` | | `30` | Scan timeout in seconds |
216+
| `target` | ✓ | | Target BD_ADDR (XX:XX:XX:XX:XX:XX) |
217+
| `mode` | | `full` | Mode: full \| browse \| records \| tree |
218+
| `search` | | | Search a specific service (SP, DUN, OPP, FTP, HID, NAP…) |
219+
| `probe_l2cap` | | `True` | Attempt L2CAP connect on each PSM to confirm reachability |
220+
| `decode_pnp` | | `True` | Decode PnP Information record (UUID 0x1200) |
221+
| `xml_attrs` | | `True` | Parse XML attribute records |
222+
| `timeout` | | `30` | Per-command timeout in seconds |
223+
| `output_file` | | | Save structured report to JSON |
142224

143225
**References:**
144-
- <https://www.bluetooth.com/specifications/assigned-numbers/>
226+
- <https://www.bluetooth.com/specifications/assigned-numbers/service-discovery/>
227+
- <https://www.bluetooth.com/specifications/specs/device-identification-profile-1-3/>
228+
- <https://www.bluez.org/>
145229

146230
---

0 commit comments

Comments
 (0)