Using BLEShark Nano in a CTF Challenge
Capture The Flag competitions have expanded well beyond web app exploits and binary reversing. Wireless challenges - WiFi, Bluetooth, and infrared - show up regularly in hardware-focused CTFs and in the ICS/RF tracks at major events like DEF CON, THOTCON, and numerous regional BSides competitions. These challenges test skills that are awkward to develop without real hardware.
The BLEShark Nano is a useful tool in this context - not because it automates the solution, but because it handles the radio work natively without requiring a laptop in monitor mode. This article covers the types of wireless CTF challenges where it is relevant and walks through a fictional wireless challenge to show the workflow.
What wireless CTF categories look like
Wireless challenges in CTFs vary a lot by event. Some provide PCAP files for offline analysis (no physical radio needed). Others are live challenges where you interact with a real device or network. The most interesting are the live ones, because they test actual hardware interaction skills.
Common challenge types you will encounter:
- PCAP analysis: A captured packet dump containing a WiFi handshake, a BLE session, or an IR signal. Analyze it, extract data, decode something, get the flag.
- Hidden SSID discovery: An AP is broadcasting with a non-obvious SSID. Scan for it, probe it, or analyze a capture to find the hidden network name.
- WPA2 handshake capture and crack: Capture a WPA2 handshake (sometimes by deauthing a client connected to the target AP), crack the password with Hashcat, use it to connect and find the flag.
- BLE device interaction: Discover a BLE device, identify its services and characteristics via GATT, read or write a characteristic to get the flag.
- IR signal replay: Capture an IR signal from a remote, decode it or replay it to trigger a device that displays the flag.
- Beacon frame analysis: Decode data hidden in custom information elements within beacon frames.
graph TD
subgraph "CTF WiFi Challenge"
C1["Scan for hidden AP"] --> C2["Crack WPA2
handshake"]
C2 --> C3["Connect to network"]
C3 --> C4["Find captive portal"]
C4 --> C5["Submit flag"]
end
WiFi challenge types and the BLEShark
Scanning and discovery: The BLEShark's WiFi scanner shows SSIDs, BSSIDs, channels, signal strength, and security type. For "find the hidden AP" challenges, running a scan from multiple positions helps identify APs with low signal. For challenges where you need to identify the AP broadcasting on a specific channel, the scan shows channel assignments directly.
Handshake capture: The BLEShark captures WPA2 handshakes as PCAP files. The workflow: connect to the target SSID's channel, trigger a handshake capture (which passively captures when a client authenticates, or can use deauth to force a reconnection), and download the PCAP via the File Portal for cracking with Hashcat or Aircrack-ng on your laptop.
In EU regions, deauth is disabled by the BLEShark's firmware per the Radio Equipment Directive (RED). For CTF contexts in the EU, passive handshake capture works when a client authenticates normally - you wait for the handshake rather than forcing it.
Deauth testing: For challenges that involve testing network availability or forcing a client to disconnect and reconnect, the BLEShark's deauth feature handles this without needing an adapter in monitor mode.
One practical advantage in a CTF context: the BLEShark operates without a laptop. At a CTF with table space at a premium, not occupying desk space with a laptop just for WiFi work is a real advantage. Run the scan from across the room, download the PCAP to your main machine via the file portal, and crack it there.
BLE challenge types
BLE challenges are where the BLEShark earns its name. The BLE scanner with OUI lookup helps identify unknown devices by manufacturer. But the more interesting challenges involve GATT interaction:
GATT exploration: A BLE device is advertising. Connect to it, enumerate services and characteristics, read the value of the right characteristic to get the flag. Or write a value that triggers the device to display the flag. These challenges test understanding of the GATT protocol - services contain characteristics, characteristics have UUIDs, and the right UUID contains the data you need.
BLE advertisement decoding: Some challenges hide data in the manufacturer-specific data field of BLE advertisements. The raw advertisement bytes contain the flag in encoded form. The BLEShark scanner shows raw advertisement data for decoding.
BLESpam defense challenges: Occasionally a challenge involves identifying which device is generating BLE spam (iOS popups, Android pairing prompts) - requiring correlation of advertisement data with physical device identification.
For GATT interaction beyond passive scanning, you will typically use nRF Connect (mobile app) or a Python script with the bleak library on a laptop. The BLEShark's scanner handles the discovery phase; detailed GATT interaction is better handled by dedicated GATT client tools.
IR challenges
IR challenges are less common but show up in hardware-focused CTFs. Typical formats:
Capture and analyze: An IR transmitter is present. Capture the signal, decode it (NEC protocol? Sony SIRC? Raw timing?), extract hidden data encoded in the timing or payload. The BLEShark's IR receiver captures raw signals and stores them.
Replay for access: A device is controlled by IR. Capture the correct IR code and replay it to trigger the device showing the flag. The BLEShark IR clone feature captures and stores a signal, then replays it on demand.
Brute force IR unlock: A padlock or physical lock responds to one of many possible IR codes. The TV-B-Gone mode cycles through a library of codes. For a custom brute force, uploading a sequence of IR commands via the File Portal is the approach.
Walkthrough: a fictional wireless CTF challenge
Here is a walkthrough of a fictional CTF challenge called "Hidden Shark" to show the workflow concretely. This is a composite of challenge types that appear in real competitions.
Challenge description: "There's a wireless network named after a predator. Find the key. It connects clients every 90 seconds."
Step 1: Discovery
Run a BLEShark WiFi scan. You see several SSIDs. One of them is "SharkBait-5G" - not obviously the target but worth noting. On 2.4GHz, you see "SharkNet" with no visible clients and WPA2 security. That's probably the target based on the challenge description. The BSSID starts with the ESP32 manufacturer prefix (Espressif), confirming it is a software-defined AP.
Step 2: Handshake capture
The challenge says it connects clients every 90 seconds - this means a client device will authenticate periodically. Put the BLEShark into handshake capture mode for the SharkNet SSID. Wait. After about 90 seconds, a client connects and the BLEShark captures the 4-way handshake. The PCAP is now in the File Portal.
Step 3: Crack the handshake
Download the PCAP to your laptop. Run Hashcat with the captured handshake and a wordlist. The challenge is a beginner-level challenge, so the password is in a standard wordlist. Hashcat cracks it in under a minute: "sharkweek2025".
Step 4: Connect and find the flag
Connect your laptop to "SharkNet" using the cracked password. The AP hosts a web server at 192.168.4.1. Browse to it and find a captive portal. The portal has a form. Submit it with anything. The portal returns: "FLAG{w3lc0me_t0_the_ch0mping_gr0und}".
Total time: about 5 minutes. No laptop in monitor mode required during the capture phase.
Step 5 (bonus): BLE clue
The challenge description says "find the key" - perhaps the WiFi password was just step one. Run a BLE scan. There is a BLE device advertising "SharkKey." Connect with nRF Connect. Under services, there is a custom service UUID. Under it, one characteristic. Read it: "ctf/bonus/flag2". Browse to that URL on the AP-hosted server: "FLAG{bl3_g4ve_it_away}".
Tips for wireless CTF preparation
Set up a home test environment before competition. A spare router, a few client devices, and a BLEShark gives you a practice environment. Run through handshake capture, BLE scanning, and IR replay before you need to do it under time pressure.
Know your tools for each layer. BLEShark for radio operations, nRF Connect for GATT interaction, Hashcat for cracking, Wireshark for PCAP analysis, Scapy for packet construction. Each tool has a role and knowing the boundaries saves time during a competition.
Practice PCAP analysis offline. Sites like Wireshark's sample PCAP library and CTF writeup blogs have real captures to practice on. Getting fast at reading PCAP data for WiFi and BLE challenges is a skill that compounds.
For BLE challenges, memorize common service UUIDs. Battery Service (0x180F), Generic Access (0x1800), Device Information (0x180A), and HID (0x1812) show up constantly. Custom UUIDs are usually in the 128-bit format and specific to the challenge.
The File Portal is your interface to the BLEShark during a CTF. Connect to the BLEShark's AP, browse to 192.168.4.1, and you can download PCAPs, upload DuckyScript payloads, and configure settings without any app or separate tool. Knowing this workflow cold before competition saves fumbling.
Shiver mesh for multi-stage challenges. Some CTFs have wireless challenges spread across a physical space. A Shiver mesh pack (available in 3, 5, 7, 12, and 16-node configurations) lets you station nodes at different locations and coordinate capture or scanning from a central device. Niche, but relevant at larger hardware-focused CTFs where the challenge space is physically large.
Wireless CTF challenges are genuinely fun and teach practical skills that translate directly to real-world wireless security work. The barrier is having the right hardware. The BLEShark Nano at $36.99 is the lowest-cost entry point for the radio capabilities these challenges require.