Offensive iot

--- name: offensive-iot description: "IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM,eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (BusyBox CVEs, MTD writes,/dev/mem ), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoTAPI abuse, and side-channel/glitching basics. Use for IoT penetration testing, smart-home assessments, ICS/OT testing, or embedded vulnerability research." --- # IoT & Embedded : Offensive Testing Methodology ## Quick Workflow 1. Physically recon the device : identify SoC, flash, debug interfaces, and radios 2. Obtain the firmware : vendor download, OTA capture, hardware dump, or chip-off 3. Unpack and analyze : filesystems, services, secrets, default credentials, vulnerable components 4. Establish runtime access : UART shell, Telnet/SSH default credentials, exploit chain 5. Pivot : to companion app, cloud-API s, neighboring devices via mesh or wireless --- ## Hardware Reconnaissance ### PCB Inspection - Identify the SoC by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.) - Identify flash (8-pin SOIC = SPI NOR; BGA =eMMC ; TSOP = NAND) - Locate debug headers: TX/RX/GND/VCC pads (UART), 4:10 pins (JTAG), 4 pins (SWD) - Locate test points labeledTX ,RX ,TCK ,TMS ,TDO ,TDI ,RST ,BOOT ### Tools | Tool | Use | |------|-----| | Multimeter | Identify GND and VCC rails before connecting | | Logic analyzer (Saleae, DSLogic) | Determine UART baud rate, SPI clock, and identify protocols | | USB-UART (FT232, CP2102) | UART console | | Bus Pirate / Glasgow | UART, SPI, I2C, JTAG (generic) | | J-Link / Black Magic Probe | JTAG / SWD MCU debugging | | CH341A programmer | Inexpensive SPI flash dumper | | XGecu T48 | Modern universal programmer (NAND/eMMC /SPI) | | ChipQuik / hot-air | Chip-off desoldering | ### UART Discovery ``bash # Find baud rate for b in 9600 19200 38400 57600 115200 230400 460800 921600; do echo "=== $b ===" timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log done grep -l -E "U-Boot|Linux|Bootloader|console|login" uart_*.log Look for: U-Boot console (often Hit any key countdown), Linux init messages, root shell on console, login prompt. ### Bootloader Console Drop # At U-Boot countdown, mash space or key listed Hit any key to stop autoboot: 0 => printenv # full env, often includes boot args => setenv bootargs ${bootargs} init=/bin/sh => boot # Linux comes up to root shell, no login If U-Boot is locked, try: - CONFIGDELAYAUTOBOOT_KEYED keyword (vendor-specific) - Ctrl+C / Ctrl+B / specific magic strings - Glitch the U-Boot version-check / signature-check (see Fault Injection) --- ## Flash Dumping ### SPI NOR (most common consumer IoT) bash # In-circuit dump (hold SoC in reset to avoid bus contention) flashrom -p ch341a_spi -r firmware.bin # Verify file firmware.bin && binwalk firmware.bin If the SoC fights you: desolder the SPI chip, dump in socket, re-solder. ### eMMC / NAND eMMC is desolder-then-read: BGA-153/169 to SD adapter (cheap eBay), use a USB SD reader. NAND requires bit-flipping and ECC handling : nanddump/ yaffshiv/ ubireader post-extraction. ### OTA Capture Many devices fetch firmware over HTTP(S). MITM the device: bash # Captive AP + transparent proxy sudo create_ap wlan0 eth0 IoTLab mitmproxy --mode transparent --showhost --ssl-insecure # Or for non-SNI / pinning, use bettercap with custom DNS Capture the URL, download directly, dissect. --- ## Firmware Analysis ### Initial Triage bash binwalk -Me firmware.bin # Extract recursively binwalk -E firmware.bin # Entropy plot : flat = encrypted/compressed strings firmware.bin | grep -iE "(passwd|key|token|admin|http|ssid)" `` ### Filesystem Mounting