Offensive Security Researcher & Quantum Cryptography Analyst

spooftooph: Bluetooth hacking tool for sniffing, spoofing, and cracking Bluetooth devices

Abdul Wahab Junaid
spooftooph: Bluetooth hacking tool for sniffing, spoofing, and cracking Bluetooth devices

Bluetooth security testing doesn’t get nearly as much attention as Wi-Fi, but it’s just as relevant — think medical devices, industrial sensors, car infotainment systems, and every wireless keyboard on someone’s desk. Spooftooph is one of the older but still genuinely useful tools in this space, built specifically for cloning, spoofing, and randomizing Bluetooth device identities during authorized assessments.

I’ve used Spooftooph mostly during physical/IoT security engagements where the goal is to test whether a target environment’s Bluetooth access controls actually check anything beyond a device’s advertised name and address. This guide covers what it does, how it works, installation, syntax, and how it fits into a real Bluetooth pentest workflow.

What Is Spooftooph?

Spooftooph is a Linux command-line tool for Bluetooth device spoofing. Its core capabilities are:

The underlying idea is that many Bluetooth pairing and access-control schemes rely on trusting a device based on its advertised MAC address and friendly name — Spooftooph lets you test how robust (or fragile) that trust actually is.

How It Works Internally

Spooftooph interacts directly with the Linux Bluetooth stack (BlueZ) through hci tools (hciconfig, hcitool). When cloning a device, it:

  1. Scans for nearby Bluetooth devices using standard discovery.
  2. Extracts the target’s Class of Device (CoD), device name, and Bluetooth address (BD_ADDR).
  3. Writes those values to your own adapter using low-level HCI commands, effectively presenting your adapter as an identical clone on the air.

For randomization mode, it simply generates a new valid-looking BD_ADDR and device name at whatever interval you specify, cycling your adapter’s identity to avoid tracking or fingerprinting during an assessment.

Installation

Spooftooph is available in Kali’s repositories:

sudo apt update
sudo apt install spooftooph -y

If it’s not packaged for your distro, build from source:

git clone https://github.com/rfrankel/spooftooph.git
cd spooftooph
make
sudo make install

Verify it’s installed:

spooftooph -h

Expected output includes the usage banner and flag list:

Spooftooph v0.5.2

usage: spooftooph [options]

  -i     interface (default hci0)
  -r     randomize BT device name/address
  -a     specify new BT address
  -n     specify new BT name
  -c     specify new BT class
  -s     scan and select target to clone
  -t     time interval for randomizing
  -w     write results to a log file

Prerequisites

Make sure your Bluetooth adapter is up and BlueZ is installed:

sudo apt install bluez -y
sudo systemctl start bluetooth
hciconfig hci0 up

Confirm your adapter is visible:

hciconfig -a

Basic Usage and Syntax

1. Scan for Nearby Devices

sudo spooftooph -i hci0 -s

Output lists discoverable devices:

Scanning for devices...
1) 00:1A:7D:DA:71:13   Target-Speaker
2) 88:53:2E:44:9C:01   OfficeHeadset
Select device to clone:

2. Clone a Specific Device

sudo spooftooph -i hci0 -a 00:1A:7D:DA:71:13 -n Target-Speaker

This sets your adapter’s address and name to match the target device exactly.

3. Randomize Identity on an Interval

sudo spooftooph -i hci0 -r -t 30

This changes your adapter’s name and address randomly every 30 seconds — useful for identity-hopping during a test to see if tracking/logging systems can keep up.

4. Log Results to File

sudo spooftooph -i hci0 -r -t 60 -w bt_spoof_log.txt

Verify it changed by checking:

hciconfig hci0

Output should show the new address/class reflected:

hci0:   Type: Primary  Bus: USB
        BD Address: 00:1A:7D:DA:71:13  ACL MTU: 310:10  SCO MTU: 64:8
        UP RUNNING PSCAN

Real-World Use Cases (Authorized Testing Only)

1. Testing Bluetooth Access Control Logic On one physical security assessment, a client’s meeting room speakers were configured to auto-trust “known” devices by address. I used Spooftooph, with explicit permission, to clone an authorized device’s identity and confirmed the speaker accepted the connection without any additional authentication — a finding that went straight into the report.

2. Evaluating Bluetooth Asset Tracking Systems Some facilities use Bluetooth beacons for asset or personnel tracking. Randomizing your adapter’s identity with Spooftooph is a good way to test whether the tracking system properly de-duplicates or flags anomalous identity churn.

3. IoT Device Fuzz-Adjacent Testing Cloning a legitimate IoT device’s advertised identity (with permission) helps evaluate whether other devices on the network implicitly trust it more than an unknown device — a common and risky design flaw in industrial and medical IoT deployments.

Workflow and Tool Integration

Troubleshooting

Common Mistakes

Best Practices

Practical Lab Example

  1. Pair two of your own Bluetooth devices (e.g., a phone and a speaker) and note the speaker’s address with hcitool scan.
  2. Disconnect the phone and put your test adapter into spoof mode: sudo spooftooph -i hci0 -a <phone_address> -n <phone_name>.
  3. Attempt to reconnect to the speaker using your spoofed adapter and observe whether it accepts the connection without re-pairing.
  4. Document the result, then restore your adapter’s real identity.

FAQ

Is Bluetooth spoofing legal? Spoofing your own equipment’s identity for authorized testing is legal; using it against devices or networks you don’t own or lack permission to test is not.

Does Spooftooph work on BLE (Bluetooth Low Energy) devices? Spooftooph primarily targets classic Bluetooth (BR/EDR) identity fields; for BLE-specific spoofing you’ll want to pair it with BLE-focused tools.

Can Spooftooph crack Bluetooth PINs? No — it doesn’t crack anything. It’s purely for identity cloning and randomization.

Is Spooftooph still maintained? It’s a mature, relatively stable tool with infrequent updates — it still works well on standard BlueZ/HCI setups, though newer BLE security models limit how much impact simple address spoofing has.

Summary

Spooftooph fills a specific niche in wireless security testing: proving (or disproving) whether Bluetooth-based trust systems rely too heavily on device identity alone. It’s a lightweight, focused tool, and when used within an authorized engagement it can surface real access-control weaknesses in facilities and IoT deployments that assume Bluetooth addresses are trustworthy.

References

Exit mobile version