Attacking Bluetooth and NFC

Bluetooth and NFC share a property with early Wi-Fi -- the protocols were designed for convenience in a trusted physical environment, and the trust assumption no longer holds. BLE devices routinely transmit sensitive data in cleartext because the GATT characteristic was "internal", and NFC access cards rely on cryptography that was broken years ago. Physical proximity is not access control.

When to Use

• Assessing BLE peripherals or IoT devices with Bluetooth interfaces
• Testing NFC-based physical access controls (badge readers, door locks)
• Evaluating contactless payment card or transit card security
• Pentesting Bluetooth Classic services (RFCOMM, OBEX, SDP)
• Sniffing or intercepting BLE communication between device and app
• Cloning or replaying NFC/RFID credentials

Scope and authorization. RF work has a legal profile the rest of pentesting does not, because you cannot confine a radio to the target: