DissPair

DissPair is an open-source Bluetooth security toolkit for auditing Bluetooth Classic (RFCOMM) and Bluetooth Low Energy (BLE) devices you own or are authorized to test. Instead of trusting what a device advertises, it actively probes how the device really behaves. Two CVEs have been found with it (CVE-2026-31280, CVE-2025-67133).

Discovery

Scan Classic (BR/EDR) and BLE devices, plus already-paired devices

Device class tags, RSSI and filters for unnamed and paired devices

Bluetooth Classic (RFCOMM)

Sweep RFCOMM channels 1-30 and see which accept unpaired (insecure) or paired connections

Send AT commands and OBEX payloads, with automatic HFP handshake handling

Flood test to stress a channel's buffer handling

BLE advertisement inspector (GAP)

Decodes every advertising field: flags, service UUIDs, names, TX power, appearance, service and manufacturer data

Vendor formats: Apple Continuity (iBeacon, AirDrop, Handoff, Nearby Info, Find My), Eddystone, Google Fast Pair

Privacy checks: public vs rotating addresses, identifiers in device names, tracker beacons (Find My, SmartTag, Tile)

Advertising interval estimate, RSSI graph, legacy/extended PDU, PHY and connectable flags

BLE GATT analysis

Full service and characteristic map with standard and vendor names

Read and write (with or without response), hex or text

Subscribe to notifications and indications with a live log

Automatic maximum MTU negotiation

GATT access audit

One tap tests what every characteristic allows without pairing: read, subscribe and write