القائمة
Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/xalgord/xalgorix --skill performing-bluetooth-security-assessmentيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | performing-bluetooth-security-assessment |
| description | Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities |
| domain | cybersecurity |
| subdomain | wireless-security |
| tags | ["bluetooth","ble","gatt","wireless-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03"] |
This skill covers performing Bluetooth Low Energy (BLE) security assessments using the Python bleak library. BLE devices are ubiquitous in IoT, healthcare, fitness, and smart home applications, and many ship with weak or absent security controls. This assessment identifies unencrypted GATT characteristics, devices broadcasting sensitive data, known vulnerable device fingerprints, and improperly secured pairing configurations.
The agent uses bleak's asyncio API to discover nearby BLE devices, connect to target devices, enumerate all GATT services and characteristics, and analyze security properties of each characteristic. It flags characteristics that allow unauthenticated read/write access to sensitive data and identifies devices matching known vulnerable profiles.
bleak only covers Bluetooth Low Energy. Bluetooth Classic (BR/EDR) devices and profiles (SDP, RFCOMM) won't appear in a BLE scan — assess them separately with hcitool, sdptool browse, and bettercap's ble.recon/Classic modules.BleakScanner.discover() pass.read/write/write-without-response reachable without authentication, and sensitive GATT services (Heart Rate 0x2A37, Device Information, Battery) that should require encryption but allow unauthenticated reads.hcitool lescan and gatttool --primary/--characteristics for service/characteristic enumeration, and () — then prove the weakness by actually performing an unauthenticated read/write of the flagged characteristic. A property listed as in the GATT table is not confirmed exploitable until an unauthenticated write succeeds end-to-end.bettercapble.enumwritepip install bleak)Scan for BLE devices: Use BleakScanner to discover all advertising BLE devices within range. Capture device name, address (MAC), RSSI signal strength, and advertised service UUIDs.
Identify target devices: Filter discovered devices by name pattern, address, or minimum signal strength. Flag devices broadcasting default or well-known vulnerable names.
Connect and enumerate GATT services: Use BleakClient to connect to the target device and iterate over all GATT services. For each service, record the UUID, description, and contained characteristics.
Analyze characteristic properties: For each characteristic, examine its properties (read, write, write-without-response, notify, indicate). Flag characteristics that expose read or write access without requiring authentication or encryption.
Check for known vulnerable UUIDs: Compare discovered service and characteristic UUIDs against a database of known vulnerable or sensitive services (Heart Rate, Blood Pressure, Device Information, Battery Level) that should require encryption.
Detect unencrypted data exposure: Attempt to read characteristics that should be protected. Successful unauthenticated reads of sensitive data indicate missing security controls.
Generate security report: Compile all findings into a structured JSON report with severity classifications and remediation recommendations.
{
"assessment_type": "ble_security_audit",
"target_device": {
"name": "SmartBand-XR",
"address": "AA:BB:CC:DD:EE:FF",
"rssi": -42
},
"services_found": 5,
"characteristics_found": 18,
"findings": [
{
"severity": "high",
"finding": "Heart Rate Measurement readable without encryption",
"uuid": "00002a37-0000-1000-8000-00805f9b34fb",
"properties": ["read", "notify"],
"remediation": "Enable encryption requirement on characteristic"
}
],
"risk_score": 7.5
}