IoT 101 – A Detailed Learning Map
this blog is largely forked from GitHub iot-security101 . We would like to thank the creator for creating this awesome blog
Approach Methodology
1. Network
2. Web (Front & Backend and Web services)
3. Mobile App (Android & iOS)
4. Wireless Connectivity (Zigbee , WiFi , Bluetooth , etc)
5. Firmware Pentesting (OS of IoT Devices)
6. Hardware Hacking & Fault Injections & SCA Attacks
7. Storage Medium
8. I/O Ports
To seen Hacked devices
- https://blog.exploitee.rs/2018/10/
- https://www.exploitee.rs/
- https://forum.exploitee.rs/
- Your Lenovo Watch X Is Watching You & Sharing What It Learns
- Your Smart Scale is Leaking More than Your Weight: Privacy Issues in IoT
- Smart Bulb Offers Light, Color, Music, and… Data Exfiltration?
- Besder-IPCamera analysis
- Smart Lock
- Subaru Head Unit Jailbreak
- Jeep Hack
- Dropcam hacking
Chat groups for IoT Security
- https://t.me/iotsecurity1011
- https://www.reddit.com/r/IoTSecurity101/
- https://t.me/hardwareHackingBrasil
- https://t.me/joinchat/JAMxOg5YzdkGjcF3HmNgQw
- https://discord.gg/EH9dxT9
Books For IoT Pentesting
- Android Hacker’s Handbook
- Hacking the Xbox – Openbook
- Car hacker’s handbook
- IoT Penetration Testing Cookbook
- Abusing the Internet of Things
- Hardware Hacking: Have Fun while Voiding your Warranty
- Linksys WRT54G Ultimate Hacking
- Linux Binary Analysis
- The Firmware Handbook
- Hardware Hacking Handbook
- inside radio attack and defense
- Pentest Hardware – Openbook
- The Art of Pcb Reverse Engineering
- Internet of Things Security Encyclopedia – Openbook
- Applied Cyber Security and the Smart Grid-ICS
- Gray Hat Hacking: The Ethical Hacker’s Handbook, Fifth Edition
Blogs for iotpentest
- https://payatu.com/blog/
- http://jcjc-dev.com/
- https://w00tsec.blogspot.in/
- http://www.devttys0.com/
- https://www.rtl-sdr.com/
- https://keenlab.tencent.com/en/
- https://courk.cc/
- https://iotsecuritywiki.com/
- https://cybergibbons.com/
- http://firmware.re/
- https://iotmyway.wordpress.com/
- http://blog.k3170makan.com/
- https://blog.tclaverie.eu/
- http://blog.besimaltinok.com/category/iot-pentest/
- https://ctrlu.net/
- http://iotpentest.com/
- https://blog.attify.com
- https://duo.com/decipher/
- http://www.sp3ctr3.me
- http://blog.0x42424242.in/
- https://dantheiotman.com/
- https://blog.danman.eu/
- https://quentinkaiser.be/
- https://blog.quarkslab.com
- https://blog.ice9.us/
- https://labs.f-secure.com/
- https://mg.lol/blog/
- https://cjhackerz.net/
- https://github.com/sponsors/bunnie/
Awesome CheatSheets
Search Engines for IoT Openly devices
CTF For IoT’s And Embeddded
- https://github.com/hackgnar/ble_ctf
- https://www.microcorruption.com/
- https://github.com/Riscure/Rhme-2016
- https://github.com/Riscure/Rhme-2017
- https://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
- https://github.com/scriptingxss/IoTGoat
YouTube Channels for IoT Pentesting
- Liveoverflow
- Binary Adventure
- EEVBlog
- JackkTutorials
- Craig Smith
- iotpentest [Mr-IoT]
- Besim ALTINOK – IoT – Hardware – Wireless
- Ghidra Ninja
- Cyber Gibbons
- Scanline
Vehicle Security Resources
- https://github.com/jaredthecoder/awesome-vehicle-security
IoT Vulnerabilites Checking Guides
- Reflecting upon OWASP TOP-10 IoT Vulnerabilities
- OWASP IoT Top 10 2018 Mapping Project
- Firmware Pentest Guide
- Hardware toolkits for IoT security analysis
IoT Gateway Software
IoT Pentesting OSes
- Sigint OS- LTE IMSI Catcher
- Instatn-gnuradio OS – For Radio Signals Testing
- AttifyOS – IoT Pentest OS – by Aditya Gupta
- Ubutnu Best Host Linux for IoT’s – Use LTS
- Internet of Things – Penetration Testing OS
- Dragon OS – DEBIAN LINUX WITH PREINSTALLED OPEN SOURCE SDR SOFTWARE
- EmbedOS – Embedded security testing virtual machine
- Skywave Linux- Software Defined Radio for Global Online Listening
- A Small, Scalable Open Source RTOS for IoT Embedded Devices
- ICS – Controlthings.io
Exploitation Tools
- Expliot – IoT Exploitation framework – by Aseemjakhar
- Routersploit (Exploitation Framework for Embedded Devices)
- IoTSecFuzz (comprehensive testing for IoT device)
- HomePwn – Swiss Army Knife for Pentesting of IoT Devices
- killerbee – Zigbee exploitation
- PRET – Printer Exploitation Toolkit
- HAL – The Hardware Analyzer
- FwAnalyzer (Firmware Analyzer)
- ISF(Industrial Security Exploitation Framework
- PENIOT: Penetration Testing Tool for IoT
Reverse Engineering Tools
Introduction
IoT Web and message services
MQTT
- Introduction
- Hacking the IoT with MQTT
- thoughts about using IoT MQTT for V2V and Connected Car from CES 2014
- Nmap
- The Seven Best MQTT Client Tools
- A Guide to MQTT by Hacking a Doorbell to send Push Notifications
- Are smart homes vulnerable to hacking
Softwares
CoAP
Automobile
CanBus
- Introduction and protocol Overview
- PENTESTING VEHICLES WITH CANTOOLZ
- Building a Car Hacking Development Workbench: Part1
- CANToolz – Black-box CAN network analysis framework
- PLAYING WITH CAN BUS
Radio IoT Protocols Overview
- SDR Notes
- Understanding Radio
- [Signal Processing]()
- Software Defined Radio
- Gnuradio
- Creating a flow graph
- Analysing radio signals
- Recording specific radio signal
- Replay Attacks
Base transceiver station (BTS
GSM & SS7 Pentesting
- Introduction to GSM Security
- GSM Security 2
- vulnerabilities in GSM security with USRP B200
- Security Testing 4G (LTE) Networks
- Case Study of SS7/SIGTRAN Assessment
- Telecom Signaling Exploitation Framework – SS7, GTP, Diameter & SIP
- ss7MAPer – A SS7 pen testing toolkit
- Introduction to SIGTRAN and SIGTRAN Licensing
- SS7 Network Architecture
- Introduction to SS7 Signaling
- Breaking LTE on Layer Two
Zigbee & Zwave
- Introduction and protocol Overview
- Hacking Zigbee Devices with Attify Zigbee Framework
- Hands-on with RZUSBstick
- ZigBee & Z-Wave Security Brief
BLE Intro and SW & HW Tools to pentest
- Step By Step guide to BLE Understanding and Exploiting
- Traffic Engineering in a Bluetooth Piconet
- BLE CharacteristicsBluetooth and BLE Pentest Tools
- btproxy
- hcitool & bluez
- Testing With GATT Tool
- Cracking encryption
- bettercap
- BtleJuice Bluetooth Smart Man-in-the-Middle framework
- gattacker
- BTLEjack Bluetooth Low Energy Swiss army knifeHardware
- NRFCONNECT – 52840
- EDIMAX
- CSR 4.0
- ESP32 – Development and learning Bluetooth
- Ubertooth
- Sena 100
BLE Pentesting Tutorials
- Bluetooth vs BLE Basics
- Intel Edison as Bluetooth LE — Exploit box
- How I Reverse Engineered and Exploited a Smart Massager
- My journey towards Reverse Engineering a Smart Band — Bluetooth-LE RE
- Bluetooth Smartlocks
- I hacked MiBand 3
- GATTacking Bluetooth Smart Devices
- blueooth beacon vulnerability
- Sweyntooth Vulnerabilties
Mobile security (Android & iOS)
- Android App Reverse Engineering 101
- Android Application pentesting book
- IOS Pentesting
- OWASP Mobile Security Testing Guide
- Android Tamer – Android Tamer is a Virtual / Live Platform for Android Security professionals
Online Assemblers
- AZM Online Arm Assembler by Azeria
- Online Disassembler
- Compiler Explorer is an interactive online compiler which shows the assembly output of compiled C++, Rust, Go
ARM
Pentesting Firmwares and emulating and analyzing
- Firmware analysis and reversing
- Firmware emulation with QEMU
- Dumping Firmware using Buspirate
- Reversing ESP8266 Firmware
- Emulating Embedded Linux Devices with QEMU
- Emulating Embedded Linux Systems with QEMU
- Fuzzing Embedded Linux Devices
- Emulating ARM Router Firmware
- Reversing Firmware With Radare
- Samsung Firmware Magic
- Qiling & Binary Emulation for automatic unpacking
Firmware samples to pentest
IoT hardware Overview
Hardware Gadgets to pentest
- Bus Pirate
- EEPROM reader/SOIC Cable
- Jtagulator/Jtagenum
- Logic Analyzer
- The Shikra
- FaceDancer21 (USB Emulator/USB Fuzzer)
- RfCat
- Hak5Gear- Hak5FieldKits
- Ultra-Mini Bluetooth CSR 4.0 USB Dongle Adapter
- Attify Badge – UART, JTAG, SPI, I2C (w/ headers)
Attacking Hardware Interfaces
- Serial Terminal Basics
- Reverse Engineering Serial Ports
- REVERSE ENGINEERING ARCHITECTURE AND PINOUT OF CUSTOM ASICS
- ChipWhisperer – Hardware attacks
UART
- Identifying UART interface
- onewire-over-uart
- Accessing sensor via UART
- Using UART to connect to a chinese IP cam
- A journey into IoT – Hardware hacking: UART
JTAG
SideChannel Attacks
- All Attacks
- AttacksonImplementationsCourseBook
- fuzzing, binary analysis, IoT security, and general exploitation
Awesome IoT Pentesting Guides
Vulnerable IoT and Hardware Applications
- IoT Goat : https://github.com/scriptingxss/IoTGoat
- IoT : https://github.com/Vulcainreo/DVID
- Safe : https://insinuator.net/2016/01/damn-vulnerable-safe/
- Router : https://github.com/praetorian-code/DVRF
- SCADA : https://www.slideshare.net/phdays/damn-vulnerable-chemical-process
- PI : https://whitedome.com.au/re4son/sticky-fingers-dv-pi/
- SS7 Network: https://www.blackhat.com/asia-17/arsenal.html#damn-vulnerable-ss7-network
- VoIP : https://www.vulnhub.com/entry/hacklab-vulnvoip,40/
Recent Comments