https://github.com/indspl0it/blue-tap
Blue-Tap is a comprehensive Bluetooth and BLE penetration testing toolkit designed specifically for security assessments of automotive In-Vehicle Infotainment (IVI) systems. It provides a complete attack lifecycle — from passive device discovery through active exploitation, data extraction, and automated report generation.
https://github.com/indspl0it/blue-tap
ble bluetooth fuzzing ivi pentesting security vulnerability-research
Last synced: 3 months ago
JSON representation
Blue-Tap is a comprehensive Bluetooth and BLE penetration testing toolkit designed specifically for security assessments of automotive In-Vehicle Infotainment (IVI) systems. It provides a complete attack lifecycle — from passive device discovery through active exploitation, data extraction, and automated report generation.
- Host: GitHub
- URL: https://github.com/indspl0it/blue-tap
- Owner: Indspl0it
- License: gpl-3.0
- Created: 2026-03-21T07:17:36.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-03-30T21:42:42.000Z (3 months ago)
- Last Synced: 2026-03-30T22:24:04.591Z (3 months ago)
- Topics: ble, bluetooth, fuzzing, ivi, pentesting, security, vulnerability-research
- Language: Python
- Homepage:
- Size: 918 KB
- Stars: 4
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Bluetooth/BLE Penetration Testing Toolkit for Automotive IVI Systems
-557C94)
Documentation ·
CLI Reference ·
CVE Matrix ·
Changelog
---
Blue-Tap is a Bluetooth Classic and BLE security assessment framework designed to find both known and unknown vulnerabilities in Bluetooth stacks. It targets automotive IVI systems, mobile devices, IoT endpoints, and embedded firmware — anything with a Bluetooth radio. 101 modules across 6 families cover the full pentest lifecycle from device discovery through 0-day hunting via protocol-aware fuzzing. A DarkFirmware capability on RTL8761B controllers extends testing below the HCI boundary into the Link Manager and Link Controller layers, reaching the 40-45% of the Bluetooth attack surface that host-only tools cannot see.
## Features
**Discovery & Reconnaissance** — Classic and BLE device scanning, SDP/GATT enumeration, L2CAP/RFCOMM channel probing, device fingerprinting, HCI capture, BLE/LMP sniffing, capability detection, and cross-probe correlation. [Guide](https://Indspl0it.github.io/blue-tap/guide/discovery/)
**Vulnerability Assessment** — 25 CVE detections (behavioral + compliance) and 11 non-CVE posture checks covering L2CAP, BNEP, SDP, AVRCP, GATT, HID, SMP, and pairing protocols. [CVE Matrix](https://Indspl0it.github.io/blue-tap/cve/detection-matrix/)
**Exploitation** — KNOB (CVE-2019-9506), BIAS (CVE-2020-10135), BLUFFS (CVE-2023-24023), CTKD (CVE-2020-15802), encryption downgrade, SSP downgrade, connection hijack, and PIN brute-force. [Guide](https://Indspl0it.github.io/blue-tap/guide/exploitation/)
**Denial of Service** — 9 CVE-backed crash probes and 21 protocol stress tests across L2CAP, SDP, RFCOMM, BNEP, HFP, OBEX, LMP, and pairing with automatic recovery monitoring. [DoS Matrix](https://Indspl0it.github.io/blue-tap/cve/dos-matrix/)
**Post-Exploitation** — Phonebook extraction (PBAP), message access (MAP), call audio (HFP), audio streaming (A2DP), media control (AVRCP), file push (OPP), Bluesnarfer (OBEX), and AT command probing. [Guide](https://Indspl0it.github.io/blue-tap/guide/post-exploitation/)
**Protocol Fuzzing** — 16-protocol mutation fuzzer with coverage-guided, state-machine, targeted, and random-walk strategies. Crash database, payload minimization, CVE reproduction, and live Rich dashboard. 6,685+ seeds. [Guide](https://Indspl0it.github.io/blue-tap/guide/fuzzing/)
**DarkFirmware (Below-HCI)** — RTL8761B firmware patching for LMP injection, link-layer monitoring, and controller memory R/W. Reaches the 40-45% of Bluetooth CVEs invisible to host-only tools. [Hardware Setup](https://Indspl0it.github.io/blue-tap/getting-started/hardware-setup/)
**Reporting & Sessions** — Professional HTML and JSON reports with 11 per-module adapters. Persistent sessions for multi-phase assessments. [Guide](https://Indspl0it.github.io/blue-tap/guide/sessions-and-reporting/)
## Installation
### Prerequisites
- Linux (Kali recommended)
- Python 3.10+
- BlueZ 5.50+ (`bluetoothctl`, `hcitool`, `btmon`)
- At least one Bluetooth HCI adapter
- Root privileges for Bluetooth operations
Optional: RTL8761B USB dongle (e.g., TP-Link UB500) for DarkFirmware / below-HCI attacks.
### Via PyPI
```bash
pip install blue-tap
```
### From Source
```bash
git clone https://github.com/Indspl0it/blue-tap.git
cd blue-tap
pip install -e .
```
### Verify Installation
```bash
blue-tap --version # Should print 2.6.2
blue-tap doctor # Check all prerequisites
sudo blue-tap adapter list # List Bluetooth adapters
```
See the full [Installation Guide](https://Indspl0it.github.io/blue-tap/getting-started/installation/) for detailed setup, including DarkFirmware flashing and the IVI simulator.
## Usage
Blue-Tap follows a phase-verb workflow that mirrors a real-world Bluetooth pentest:
```
discover → recon → vulnscan → exploit → dos → extract → fuzz → report
```
### Quick Start
```bash
# 1. Find nearby Bluetooth devices
sudo blue-tap discover classic -d 20
# 2. Deep recon on a target
sudo blue-tap recon 4C:4F:EE:17:3A:89 sdp
sudo blue-tap recon 4C:4F:EE:17:3A:89 fingerprint
# 3. Scan for vulnerabilities (25 CVE + 11 posture checks)
sudo blue-tap vulnscan 4C:4F:EE:17:3A:89
# 4. Exploit a confirmed vulnerability
sudo blue-tap exploit 4C:4F:EE:17:3A:89 knob --yes
# 5. Extract data post-exploitation
sudo blue-tap extract 4C:4F:EE:17:3A:89 contacts --all
# 6. Generate HTML report
blue-tap report --format html --output report.html
```
### Automation
```bash
# Full automated assessment against a single target
sudo blue-tap auto 4C:4F:EE:17:3A:89 --yes
# Fleet scan — discover and assess all IVI devices in range
sudo blue-tap fleet --duration 20 --class ivi
# Run a playbook
sudo blue-tap run-playbook --playbook ivi-full-audit.yaml
```
### Fuzzing
```bash
# Multi-protocol fuzzing campaign
sudo blue-tap fuzz campaign 4C:4F:EE:17:3A:89 -p sdp -p rfcomm --duration 2h
# Crash analysis
blue-tap fuzz crashes list --protocol sdp --severity HIGH
blue-tap fuzz minimize CRASH_ID
```
See the full [CLI Reference](https://Indspl0it.github.io/blue-tap/guide/cli-reference/) for all commands and options.
## Documentation
Full documentation is hosted at **[Indspl0it.github.io/blue-tap](https://Indspl0it.github.io/blue-tap/)**
| Section | Description |
|---------|-------------|
| [Getting Started](https://Indspl0it.github.io/blue-tap/getting-started/installation/) | Installation, hardware setup, quick start, IVI simulator |
| [CLI Reference](https://Indspl0it.github.io/blue-tap/guide/cli-reference/) | Every command, option, and example |
| [CVE Detection Matrix](https://Indspl0it.github.io/blue-tap/cve/detection-matrix/) | 37 CVEs across vulnscan, exploitation, and DoS |
| [DoS Matrix](https://Indspl0it.github.io/blue-tap/cve/dos-matrix/) | 30 DoS checks with severity and recovery monitoring |
| [Workflows](https://Indspl0it.github.io/blue-tap/workflows/full-pentest/) | End-to-end pentest recipes |
| [Developer Guide](https://Indspl0it.github.io/blue-tap/developer/architecture/) | Architecture, module system, writing modules, plugins |
| [Troubleshooting](https://Indspl0it.github.io/blue-tap/reference/troubleshooting/) | Common issues and fixes |
| [Changelog](https://Indspl0it.github.io/blue-tap/changelog/) | Release history |
## Legal Disclaimer
Blue-Tap is provided for **authorized security testing and research purposes only**. You must have explicit written permission from the owner of any device you test. Unauthorized access to Bluetooth devices is illegal under the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, and similar laws worldwide. The authors accept no liability for misuse. Report vulnerabilities responsibly to the affected manufacturer.
## License
[GNU General Public License v3.0](LICENSE) — Copyright (C) 2026 Santhosh Ballikonda
---
**Santhosh Ballikonda** — [@Indspl0it](https://github.com/Indspl0it)