During a physical security assessment of a corporate office, you notice several employees using older Bluetooth-enabled mobile devices that remain in discoverable mode. You want to demonstrate the risk of an attacker extracting contact lists, calendar entries, and emails from these devices without the user's knowledge or authorization. Which attack technique should you use to demonstrate this specific risk?