You might remember from the beginning of this course
that Kismet works for more than Wi‑Fi.
It also works with software‑defined radios and Bluetooth.
For Bluetooth, there is no special hardware that is needed.
You just need a Bluetooth dongle that works with the Linux HCI.
The thing is, if you're using one of these types of dongles, built‑in or USB,
the scan will be active.
That means people could detect that you're scanning Bluetooth with it.
So I'm going to quit my text editor right here,
and I am going to list the different HCI devices available on my computer.
As you can see, I have hc0, which is my Bluetooth dongle,
which I made available to my virtual machine.
So all I have to do now is run Kismet and specify the
source as hc0, just like we did with Wi‑Fi.
And I'll give it a name, I'll just call it bluetooth.
Once I start running this, the dongle is going to start scanning for devices.
So if I open the Kismet UI, right away we see a lot of different
devices connected. And similar to the Wi‑Fi interface, we see how
many packets are coming through, and so on.
Now with this type of dongle, we're not storing actual packets, we're
only gathering metadata about the different devices that are around us.
And again, someone could detect you doing this.
That being said,
that could be great for gathering information about different
Bluetooth devices that you'll see in one area over and over if you're
trying to track if a specific device is in the same area at the same
time of day or simply if you're just trying to do a proper survey in
an entire building. It is surprising the amount of Bluetooth devices
you'll find, especially if you have a dongle that supports Bluetooth Low Energy.
Now, if you have more advanced Bluetooth requirements,
you might want to look into a Texas Instrument chip that can be
molded to be a sniffer‑only card or a Ubertooth One,
which also lets you do similar. Now if you remember
at the beginning of this course,
I said that Kismet also supported software‑defined radios,
specifically the RTL SDR.
So what we're going to do now is see how we can use it,
starting with just installing some prerequisites.
I am simply going to install a new radio as it will include a lot
of dependencies for making the RTL SDR work.
Now that this is all installed,
I'm going to run rtl_test just to see if my dongle is recognized properly.
As you can see, it did find a tuner, including a serial number.
That serial number does look a bit suspicious at 0001, but not
all RTL SDRs have proper serial numbers.
So what we need to do now is start Kismet and specify that as the
source. Now for this part of the demo, I skipped ahead a little bit
because this is something that requires a little bit more time to
gather information, but here I want to gather information on ADS‑B,
specifically. What does ADS‑B mean?
Well, it means Automatic Dependent Surveillance‑Broadcast.
It's the technology which planes used to broadcast a bunch of information.
So I've actually ran that command about 20 minutes ago so I can show you what
happens in a Kismet UI. So just like with Bluetooth and Wi‑Fi,
you'll start seeing the planes show up as devices. They are devices,
or I guess collections of devices, flying in the sky, and you
can see them here, what channel they're on, and if you've
received any packets from them. What's interesting is their
location is actually transmitted, and Kismet is able to decode that information.
So it'll show you in the ADSB Live tab some information about these planes.
So as you can see, I'm located in Montreal,
and that plane right here is actually pretty much over my
house at 32,000 feet going 461 miles an hour.
So this might not be the most useful thing if you're
trying to do a red team engagement,
for example, but it just goes to show that Kismet is able to do
a lot with a lot of different radio types.
We've seen Wi‑Fi,
which is the reason Kismet was invented in the first place,
we've seen Bluetooth with active scans,
but you know you can also do passive scans,
and now we're looking at ADS‑B so we can detect planes.
You can also use this SDR feature to look at electricity counters, for example.
And as we're speaking,
a third plane was discovered and should appear under Devices here.
There it is, a third plane.
So that was over a period of about 10 to 20 minutes.
So I hope you enjoyed all these different ways to use Kismet. And keep in mind,
look at the Compatibility page on the Kismet documentation to make
sure that the hardware you buy is going to work and that you're
going to have a lot of fun with it.