Which BtleJack Command Hijacks a BLE Connection
Clark, a professional hacker, attempted to perform a Btlejacking attack using an automated tool, Btlejack, and hardware tool, micro:bit. This attack allowed Clark to hijack, read, and export sensitive information shared between connected devices. To perform this attack, Clark executed various btlejack commands. Which of the following commands was used by Clark to hijack the connections?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can map BtleJack's command-line flags to attack actions, and the trap is assuming any -j style option must mean 'hijack' when the documented hijack flag is actually -t.
BtleJack is a BLE attack tool driven by a BBC micro:bit that can sniff, jam and hijack Low Energy connections, and it is covered in CEH module 16 on wireless hacking. This page establishes that the hijack is performed with the -t flag combined with -f (frequency) and -m (access address), which corresponds to option A.
Most learners pick D (btlejack -f 0x129f3244 -j) because the letter j looks like 'hijack'; however, -j is the option for joining and following an existing connection, and it carries no access address here, so it does not take over the link the way the documented hijack command does.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A,btlejack -f 0x9c68fd30 -t -m 0x1fffffffff, is exactly the hijack invocation documented for BtleJack: -f supplies the BLE channel/frequency index, -m supplies the 32-bit connection access address, and -t is the explicit hijack flag. As Lunko quoted directly from the tool documentation, "Hijacking a BLE connection... use the -t option to do so. Once hijacked, BtleJack will give you a prompt allowing you to interact with the hijacked device." Because the access address is required to craft valid packets that terminate the connection events of the master or slave and force the peer to talk to the attacker's micro:bit, the combination of -f, -m and -t is the only complete hijack recipe among the options. This matches the CEHv12 textbook text cited by insaniunt and LordXander at page 2538.Why the Other Options Are Wrong
Option B,btlejack -c any, is the all-channel jamming command — it denies service to the BLE connection rather than hijacking or reading it. Option C uses -d twice to point at two serial devices (the two micro:bits) and -s to sniff; that is the multi-sniffer capture setup, which supports passive reading but not connection takeover. Option D, btlejack -f 0x129f3244 -j, only identifies a frequency and uses the join/follow option, with no access address supplied; it attaches to and follows a connection instead of seizing it, so it does not produce the hijack prompt described in the scenario. As g_man_rap argued, "D is more accurate... the -j flag", but the tool's own documentation names -t as the hijack flag, so that reading is incorrect.Community Comment Notes
The vote distribution is unanimous for A, and the supporting comments are essentially quotations of the vendor documentation: Lunko pasted the BtleJack README passage starting "BtleJack version 1.1" plus the hijack example command verbatim. LordXander and insaniunt anchor the same answer to the CEHv12 module 16 material on page 2538, which is the authoritative exam source. The only dissenting voice, g_man_rap, concedes the rationale is based on how -j "involves actively intervening in the communication" rather than on the documented flag semantics, so the majority position is well supported here.Official Reference
Exam Strategy
On CEH command-recall items, match each flag to its documented meaning before guessing: -f sets frequency, -m sets access address, -t hijacks, -c jams, and -s sniffs. If an option letter in the flag resembles the attack name, treat it as a deliberate decoy and check the vendor's README or the module page instead.
Frequently Asked Questions
Why is `btlejack -f 0x129f3244 -j` not the hijack command?
The -j option makes BtleJack join and follow an existing connection, and it supplies no access address (-m). Hijacking requires -t, which seizes the connection and drops you into an interactive prompt.
What does `btlejack -c any` do in a BtleJack attack?
-c any performs all-channel jamming, denying communication on the BLE channels rather than hijacking or reading data. Jamming is a denial-of-service step, not a hijack.