Skip to content
KitploitKITPLOIT
ToolsBlog
Log in
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2020-10135-BIAS — CVE 2020-10135 a.k.a BIAS (Bluetooth Impersonation Attack) | Kitploit
Tools/GitHubGitHub/m4rm0k/cve-2020-10135-bias
Bluetooth SecurityExploitationImpersonation ToolsWireless SecurityPenetration TestingRed Teaming
GitHubm4rm0k/cve-2020-10135-bias

CVE-2020-10135-BIAS

CVE 2020-10135 a.k.a BIAS (Bluetooth Impersonation Attack)

View Repository
2236 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2020-10135-BIAS

CVE 2020-10135 a.k.a BIAS (Bluetooth Impersonation Attack)

Seems like after a while and jumping through some hoops was able to perform BIAS (Bluetooth Impersonation Attack) CVE 2020-10135. Impersonated Samsung S3 Neo+ connection to Linux host. Cool stuff. THANK YOU for Internalblue and BIAS PoCs.

From my perspective found out that pretty much all you need to perform the attack is the BT address of inpersonated device that was previously paired and connected with the other end. Rest you can obtain for PoC to work.

CVE-2020-10135

PoC/original Author(s): https://github.com/francozappa/bias

LOG


No.     Time           Source                Destination           Protocol Length Info
      1 0.000000       2f:d0:a5:b4           controller            LMP      64     LMP_version_req

Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      2 0.016282       controller            2f:d0:a5:b4           LMP      64     LMP_version_res

Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      3 0.016293       2f:d0:a5:b4           controller            LMP      64     LMP_features_req

Frame 3: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      4 0.016295       controller            2f:d0:a5:b4           LMP      64     LMP_features_res

Frame 4: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      5 0.032274       2f:d0:a5:b4           controller            LMP      64     LMP_features_req_ext

Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      6 0.032285       controller            2f:d0:a5:b4           LMP      64     LMP_features_res_ext

Frame 6: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      7 0.032287       2f:d0:a5:b4           controller            LMP      64     LMP_power_control_req

Frame 7: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      8 0.048306       2f:d0:a5:b4           controller            LMP      64     LMP_host_connection_req

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
      9 0.048313       controller            host                  HCI_EVT  13     Rcvd Connect Request

Frame 9: 13 bytes on wire (104 bits), 13 bytes captured (104 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Event - Connect Request

No.     Time           Source                Destination           Protocol Length Info
     10 0.048319       controller            2f:d0:a5:b4           LMP      64     LMP_power_control_res

Frame 10: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     11 0.048415       host                  controller            HCI_CMD  11     Sent Accept Connection Request

Frame 11: 11 bytes on wire (88 bits), 11 bytes captured (88 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Command - Accept Connection Request

No.     Time           Source                Destination           Protocol Length Info
     12 0.063970       controller            host                  HCI_EVT  7      Rcvd Command Status (Accept Connection Request)

Frame 12: 7 bytes on wire (56 bits), 7 bytes captured (56 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Event - Command Status

No.     Time           Source                Destination           Protocol Length Info
     13 0.080314       controller            2f:d0:a5:b4           LMP      64     LMP_slot_offset

Frame 13: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     14 0.080320       2f:d0:a5:b4           controller            LMP      64     LMP_accepted

Frame 14: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     15 0.096284       controller            2f:d0:a5:b4           LMP      64     LMP_switch_req

Frame 15: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     16 0.096294       2f:d0:a5:b4           controller            LMP      64     LMP_power_control_req

Frame 16: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     17 0.256055       controller            2f:d0:a5:b4           LMP      64     LMP_power_control_res

Frame 17: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     18 0.256066       controller            2f:d0:a5:b4           LMP      64     LMP_slot_offset

Frame 18: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     19 0.256067       controller            2f:d0:a5:b4           LMP      64     LMP_switch_req

Frame 19: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth H4 Serial Broadcom Vendor Specific

No.     Time           Source                Destination           Protocol Length Info
     20 0.272129       2f:d0:a5:b4           controller            LMP      64     LMP_accepted
Download Tool