// the find
hackgnar/ble_ctf
A Bluetooth low energy capture the flag
A CTF challenge that runs as a GATT server on an ESP32, teaching BLE fundamentals through 20 progressively harder flags. You flash the firmware to a cheap microcontroller, then solve challenges using standard Linux BLE tools like gatttool and hcitool. Aimed at security folks and embedded developers who want hands-on BLE protocol experience rather than reading a spec.
Ships pre-compiled firmware so you can get started without an ESP-IDF toolchain. Covers the full GATT interaction surface — reads, writes, notifications, indications, MTU negotiation, fuzzing, and client attributes — in a single device. Supports three ESP32 variants (esp32, esp32s3, esp32c6), so it works with whatever you have lying around. The hint docs are genuinely incremental: each one teaches the concept you need, not just the answer.
The entire GATT server lives in one 800-line C file (gatts_table_creat_demo.c), which is functional but not something you'd learn from structurally. The tool dependency on gatttool is a problem — it was deprecated from BlueZ years ago and is missing from many current distros; the README mentions it prominently but only links a replacement in passing. Flag progression isn't enforced server-side, so you can read later handles before understanding earlier ones, which undermines the learning intent. No automated scoring or remote leaderboard — score tracking is a single GATT handle you read yourself, which works but makes workshop use awkward.