IoT Playground Tips

iot-playground-tips.md

Tool Setup

Bluetooth Service

# IMPORTANT:  if you get connection refused (111)
# Check the bluetooth service
sudo systemctl status bluetooth

# Start bluetooth if it was not active
sudo systemctl restart bluetooth

# check if device soft or hard blocked in rfkill 
sudo rfkill

# Troubleshoot service issues
rmmod btusb
rmmod btintel

modprobe btintel
modprobe btusb

gatttool (if your Kali doesn't have BlueZ)

sudo apt update
sudo apt install -y build-essential autoconf automake libtool pkg-config \
  libglib2.0-dev libdbus-1-dev libudev-dev libical-dev libreadline-dev \
  libbluetooth-dev wget python3-docutils binutils
  
# Check your BlueZ version
bluetoothctl --version
export BLUEZ=5.71 # use your version here

cd /tmp
wget https://www.kernel.org/pub/linux/bluetooth/bluez-${BLUEZ}.tar.xz
tar xf bluez-${BLUEZ}.tar.xz
cd bluez-${BLUEZ}

./configure --enable-deprecated --enable-tools --enable-library

make -j4

sudo cp /tmp/bluez-${BLUEZ}/attrib/gatttool /usr/local/bin/
sudo chmod +x /usr/local/bin/gatttool

Interface Setup

# Check all interface statuses
sudo hciconfig

# Bring one interface eg hci0 up
sudo hciconfig -a hci0 up

# Take an interface down
sudo hciconfig -a hci0 down


# Scan for Devices
## bluetoothctl
```bash
sudo bluetoothctl
  scan on
  # wait for the device to show up
  scan off
  quit

bluetoothctl --timeout 10 scan on | grep -i iot

export BDADDR=<target device address>

ble-enum

go install github.com/fracturelabs/iot-tools/ble-enum@latest
sudo setcap 'cap_net_admin,cap_net_raw+eip' ~/go/bin/ble-enum

ble-enum -scan | grep -i iot

Recon

ble-enum

export BDADDR=DE:AD:BE:EF:CA:FE
ble-enum -b $BDADDR

Read/Write

gatttool

# List characterists
gatttool -b $BDADDR --characteristics

# Read a handle
gatttool -b $BDADDR --char-read -a $handle | \
  awk -F':' '{print $2}' | tr -d ' ' | xxd -r -p; printf '\n'
  
# Interactive mode (single persistent connection — gentler on devices)
gatttool -b $BDADDR -I
  connect
  primary                          # List all primary services
  characteristics                  # List all characteristics with properties
  char-desc                        # List all descriptors (shows full handle map)
  char-read-hnd 0x000B             # Read by handle (use handles from char-desc)
  char-write-req 0x0025 01         # Write with response (ATT Write Request)
  char-write-cmd 0x0025 01         # Write without response (ATT Write Command)
  disconnect
  quit

# If the device uses a random BLE address (connection fails without this)
gatttool -b $BDADDR -t random --characteristics

# Read all handles in a range (useful for finding hidden characteristics)
for h in $(seq 1 80); do
  gatttool -b $BDADDR --char-read -a $(printf '0x%04X' $h) 2>/dev/null && echo " <- handle $h"
done

# Discover service UUIDs
gatttool -b $BDADDR --primary

# Read a specific UUID instead of a handle
gatttool -b $BDADDR --char-read -u 00002a00-0000-1000-8000-00805f9b34fb

# Listen for notifications (subscribe to a characteristic)
gatttool -b $BDADDR --listen --char-write-req -a 0x000F -n 0100

# Decode common characteristic values
# Device Name (UUID 0x2A00)
gatttool -b $BDADDR --char-read -u 00002a00-0000-1000-8000-00805f9b34fb | \
  awk -F':' '{print $2}' | tr -d ' ' | xxd -r -p; printf '\n'

# Manufacturer Name (UUID 0x2A29)
gatttool -b $BDADDR --char-read -u 00002a29-0000-1000-8000-00805f9b34fb | \
  awk -F':' '{print $2}' | tr -d ' ' | xxd -r -p; printf '\n'