Bluetooth sniff with Ubertooth about snoopy-ng

[maximcherny]

I'm pretty sure the current BT sniffing implementation uses basic "hcitool scan" whereas when using Ubertooth something like "ubertooth-scan" or a Python wrapper like pyubertooth should be used.

[th36r1m]

maximcherny is right. All you should have to do is edit includes/bluScan.py.

If it was me, I would also extend the snoopy.py bluetooth plugin to take an argument, such as "snoopy -m bluetooth:uber=true"

[keldnorman]

Ok good hint thanks

[keldnorman]

bluetooth data is logged:

root@probe1:~/Source/Snoopy/snoopy-ng# hcitool scan --info --class --flush
Scanning ...

BD Address: 9C:D2:1E:--:--:-- [mode 1, clkoffset 0x6473]
Device name: BRAVIA [cached]
Device class: Audio/Video, Video Display and Loudspeaker (0x00043c)

And it is send to the database server where the log shows:
[+] Sub-plugin wifi_aps currently observing 3 Access Points
[+] Sub-plugin blutooth currently observing 1 client devices

But where in Maltego - in what transformation should it appear - do I need to make my own or is it in the included in the palette after importing the Snoopy categorys ?

/Keld Norman

[glennzw]

Correct - the Bluetooth plugin was a fairly quick PoC using hcitool. We should definitely re-write it to use proper libraries.

I'll add some transforms. At the moment data is stored inside snoopy.db:

sqlite3 snoopy.db
SELECT * FROM bluetooth_details;
SELECT * FROM bluetooth_obs;

Or use sqlitebrowser for a GUI tool.

[keldnorman]

How do I add the column's to the db on the server recieving the clients data ?

2015-05-03 17:22:04 D blutooth.py: Scanning for bluetooth devices
2015-05-03 17:22:07 D snoopy: Not syncing table 'bluetooth_details' - no 'sunc' column
2015-05-03 17:22:09 D snoopy: Not syncing table 'user_agents' - no 'sunc' column

[keldnorman]

Any plans for adding 'user_agents', 'bluetooth_details' etc to the sync function in this release ?