-
A Collection for IoT Security Resources
-
You are welcome to fork and contribute
-
Other Interesting Areas
Approach Methodology
- 1. Network
- 2. Web (Front & Backend and Web services)
- 3. Mobile App (Android & iOS)
- 4. Wireless Connectivity (Zigbee , WiFi , Bluetooth , etc)
- 5. Firmware Pentesting (OS of IoT Devices)
- 6. Hardware Hacking & Fault Injections & SCA Attacks
- 7. Storage Medium
- 8. I/O Ports
Contents
-
IoT Security information
-
Network
-
Web IoT Message Protocols
-
Mobile app
-
Wireless Protocols
-
Firmware
-
Hardware
- IoT Hardware Intro
- [IoT Hardware hacking Intro]
- Required hardware to pentest IoT
- Hardware interfaces
- SPI
- UART
- JTAG
- SideChannel Attacks & Glitching attacks
- Glitching Attacks
-
Storage Medium
-
Payment Security
To seen Hacked devices
- https://blog.exploitee.rs/2018/10/
- https://www.exploitee.rs/
- https://forum.exploitee.rs/
- Your Lenovo Watch X Is Watching You & Sharing What It Learns
- Your Smart Scale is Leaking More than Your Weight: Privacy Issues in IoT
- Smart Bulb Offers Light, Color, Music, and… Data Exfiltration?
- Besder-IPCamera analysis
- Smart Lock
- Subaru Head Unit Jailbreak
- Jeep Hack
- Dropcam hacking
- Printer Hacking live sessions - gamozolabs
- LED Light Hacking
Chat groups for IoT Security
- IoTSecurity101 Telegram - https://t.me/iotsecurity1011
- IoTSecurity101 Reddit - https://www.reddit.com/r/IoTSecurity101/
- IoTSecurity101 Discord - https://discord.gg/EH9dxT9
- hardware hacking Telegram - https://t.me/hardwareHackingBrasil
- RFID Discord group - https://discord.gg/Z43TrcVyPr
- ICS Discord group - https://discord.com/invite/CmDDsFK
IoT and Hardware Security Trainings
Books For IoT Pentesting
- The Firmware Handbook (Embedded Technology) 1st Edition by Jack Ganssle - 2004
- Hardware Hacking: Have Fun while Voiding your Warranty 1st Edition - 2004
- Linksys WRT54G Ultimate Hacking 1st Edition by Paul Asadoorian - 2007
- Applied Cyber Security and the Smart Grid: Implementing Security Controls into the Modern Power Infrastructure by Eric D. Knapp , Raj Samani -2013
- Hacking the Xbox-An Introduction to Reverse Engineering HACKING THE XBOX by Andrew “bunnie” Huang - Openbook - 2013
- Android Hacker's Handbook by Joshua J. Drake - 2014
- The Art of Pcb Reverse Engineering: Unravelling the Beauty of the Original Design - 2015
- Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts 1st Edition, by Nitesh Dhanjani - 2015
- Learning Linux Binary Analysis By Ryan "elfmaster" O'Neill - 2016
- Car hacker's handbook by Craig Smith - 2016
- IoT Penetration Testing Cookbook By Aaron Guzman , Aditya Gupta - 2017
- Inside Radio: An Attack and Defense Guide by Authors: Yang, Qing, Huang, Lin -2018
- Pentest Hardware - Openbook -2018
- Gray Hat Hacking: The Ethical Hacker's Handbook, Fifth Edition 5th Edition by by Daniel Regalado , Shon Harris , Allen Harper , Chris Eagle , Jonathan Ness , Branko Spasojevic , Ryan Linn , Stephen Sims - 2018
- Practical Hardware Pentesting - 2021
- Manual PCB-RE: The Essentials
- The Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks Front Cover Jasper van Woudenberg, Colin O'Flynn - 2021
- Practical IoT Hacking-The Definitive Guide to Attacking the Internet of Things by Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Woods - 2021
- Internet of Things Security Encyclopedia - Openbook
- PatrIoT: practical and agile threat research for IoT by Emre Süren - 2022
- Practical Hardware Pentesting - Second Edition - 2023
- Blue Fox: Arm Assembly Internals & Reverse Engineering - 2023
- Fuzzing Against the Machine: Automate vulnerability research with emulated IoT devices on QEMU - 2023
- Hardware Security Training, Hands-on! - 2023
Blogs for iotpentest
- https://jilles.com/
- https://payatu.com/blog/
- https://raelize.com/blog/
- http://jcjc-dev.com/
- https://w00tsec.blogspot.in/
- http://www.devttys0.com/
- https://wrongbaud.github.io/
- https://embeddedbits.org/
- https://www.rtl-sdr.com/
- https://keenlab.tencent.com/en/
- https://courk.cc/
- https://iotsecuritywiki.com/
- https://cybergibbons.com/
- http://firmware.re/
- http://blog.k3170makan.com/
- https://blog.tclaverie.eu/
- http://blog.besimaltinok.com/category/iot-pentest/
- https://ctrlu.net/
- http://iotpentest.com/
- https://blog.attify.com
- https://duo.com/decipher/
- http://www.sp3ctr3.me
- http://blog.0x42424242.in/
- https://dantheiotman.com/
- https://blog.danman.eu/
- https://quentinkaiser.be/
- https://blog.quarkslab.com
- https://blog.ice9.us/
- https://labs.f-secure.com/
- https://mg.lol/blog/
- https://cjhackerz.net/
- https://github.com/sponsors/bunnie/
- https://iotmyway.wordpress.com/
- https://www.synacktiv.com/publications.html
- http://blog.cr4.sh/
- https://ktln2.org/
- https://naehrdine.blogspot.com/
- https://limitedresults.com/
- https://fail0verflow.com/blog/
- https://www.exploitsecurity.io/blog
Awesome CheatSheets
Search Engines for Exposed IoT devices worldwide
CTF For IoT And Embeddded
- https://github.com/hackgnar/ble_ctf
- https://www.microcorruption.com/
- https://github.com/Riscure/Rhme-2016
- https://github.com/Riscure/Rhme-2017
- https://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
- https://github.com/scriptingxss/IoTGoat
YouTube Channels for IoT Pentesting
- Joe Grand
- Liveoverflow
- Binary Adventure
- EEVBlog
- Craig Smith
- iotpentest [Mr-IoT]
- Besim ALTINOK - IoT - Hardware - Wireless
- Ghidra Ninja
- Cyber Gibbons
- Scanline
- Aaron Christophel
- Valerio Di Giampietro
Vehicle Security Resources
IoT Vulnerabilites Checking Guides
- Reflecting upon OWASP TOP-10 IoT Vulnerabilities
- OWASP IoT Top 10 2018 Mapping Project
- Hardware toolkits for IoT security analysis
IoT Gateway Software
IoT Pentesting OSes
- Sigint OS- LTE IMSI Catcher
- Instatn-gnuradio OS - For Radio Signals Testing
- AttifyOS - IoT Pentest OS - by Aditya Gupta
- Ubutnu Best Host Linux for IoT's - Use LTS
- Internet of Things - Penetration Testing OS v1
- Dragon OS - DEBIAN LINUX WITH PREINSTALLED OPEN SOURCE SDR SOFTWARE
- EmbedOS - Embedded security testing virtual machine
- Skywave Linux- Software Defined Radio for Global Online Listening
- A Small, Scalable Open Source RTOS for IoT Embedded Devices
- ICS - Controlthings.io
Exploitation Tools
- Expliot - IoT Exploitation framework - by Aseemjakhar
- Routersploit (Exploitation Framework for Embedded Devices)
- IoTSecFuzz (comprehensive testing for IoT device)
- HomePwn - Swiss Army Knife for Pentesting of IoT Devices
- killerbee - Zigbee exploitation
- PRET - Printer Exploitation Toolkit
- HAL – The Hardware Analyzer
- FwAnalyzer (Firmware Analyzer)
- ISF(Industrial Security Exploitation Framework
- PENIOT: Penetration Testing Tool for IoT
- MQTT-PWN
Reverse Engineering Tools
Introduction
IoT Web and message services
MQTT
- Introduction
- Hacking the IoT with MQTT
- thoughts about using IoT MQTT for V2V and Connected Car from CES 2014
- Nmap
- The Seven Best MQTT Client Tools
- A Guide to MQTT by Hacking a Doorbell to send Push Notifications
- Are smart homes vulnerable to hacking
- Deep Learning UDF for KSQL / ksqlDB for Streaming Anomaly Detection of MQTT IoT Sensor Data
- Authenticating & Authorizing Devices using MQTT with Auth0
- Development information for the MQTT with hardware
- Understanding the MQTT Protocol Packet Structure
- R7-2019-18: Multiple Hickory Smart Lock Vulnerabilities
- IoT Live Demo: 100.000 Connected Cars With Kubernetes, Kafka, MQTT, TensorFlow
Softwares
- Mosquitto-An open source MQTT broker
- HiveMQ
- MQTT Explorer
- MQTT proxy - IoXY
- MQTT Broker Security - 101
- Welcome to MQTT-PWN!
CoAP
RADIO HACKER QUICK START GUIDE
- Complete course in Software Defined Radio (SDR) by Michael Ossmann
- SDR Notes - Radio IoT Protocols Overview
- Understanding Radio
- Introduction to Software Defined Radio
- Introduction Gnuradio companion
- Creating a flow graph in gunradiocompanion
- Analysing radio signals 433Mhz
- Recording specific radio signal
- Replay Attacks with raspberrypi -rpitx
Cellular Hacking GSM BTS
BTS
GSM SS7 Pentesting
- Introduction to GSM Security
- GSM Security 2
- vulnerabilities in GSM security with USRP B200
- Security Testing 4G (LTE) Networks
- Case Study of SS7/SIGTRAN Assessment
- Telecom Signaling Exploitation Framework - SS7, GTP, Diameter & SIP
- ss7MAPer – A SS7 pen testing toolkit
- Introduction to SIGTRAN and SIGTRAN Licensing
- SS7 Network Architecture
- Introduction to SS7 Signaling
- Breaking LTE on Layer Two
Hardware Tools
Zigbee ALL Stuff
- Introduction and protocol Overview
- Hacking Zigbee Devices with Attify Zigbee Framework
- Hands-on with RZUSBstick
- ZigBee & Z-Wave Security Brief
- Hacking ZigBee Networks
- Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes
- Security Analysis of Zigbee Networks with Zigator and GNU Radio
- Low-Cost ZigBee Selective Jamming
SW Tools
Hardware Tools for Zigbee
- APIMOTE IEEE 802.15.4/ZIGBEE SNIFFING HARDWARE
- RaspBee-The Raspberry Pi Zigbee gateway
- USRP SDR 2
- ATUSB IEEE 802.15.4 USB Adapter
- nRF52840-Dongle
BLE Intro and SW-HW Tools to pentest
- Step By Step guide to BLE Understanding and Exploiting
- Traffic Engineering in a Bluetooth Piconet
- BLE Characteristics
Bluetooth and BLE Pentest Tools
- btproxy
- hcitool & bluez
- Testing With GATT Tool
- crackle-Cracking encryption
- bettercap
- BtleJuice Bluetooth Smart Man-in-the-Middle framework
- gattacker
- BTLEjack Bluetooth Low Energy Swiss army knife
- bluing-An intelligence gathering tool for hacking Bluetooth
- DEDSEC-Bluetooth-exploit
Hardware for bluetooth hacking
- NRFCONNECT - 52840
- EDIMAX
- CSR 4.0
- ESP32 - Development and learning Bluetooth
- Ubertooth
- Sena 100
- ESP-WROVER-KIT-VB
BLE Pentesting Tutorials
- Bluetooth vs BLE Basics
- Finding bugs in Bluetooth
- Intel Edison as Bluetooth LE — Exploit box
- How I Reverse Engineered and Exploited a Smart Massager
- My journey towards Reverse Engineering a Smart Band — Bluetooth-LE RE
- Bluetooth Smartlocks
- I hacked MiBand 3
- GATTacking Bluetooth Smart Devices
- blueooth beacon vulnerability
- Sweyntooth Vulnerabilties
- AIRDROP_LEAK - sniffs BLE traffic and displays status messages from Apple devices
- BRAKTOOTH: Causing Havoc on Bluetooth Link Manager
- Practical Introduction to BLE GATT Reverse Engineering: Hacking the Domyos EL500
- MojoBox - yet another not so smartlock
- bluetooth-hacking
DECT (Digital Enhanced Cordless Telecommunications)
- Real Time Interception And Monitoring Of A DECT Cordless Telephone
- Eavesdropping On Unencrypted DECT Voice Traffic
- Decoding DECT Voice Traffic: In-depth Explanation
Software Tools && Hardware Tools
Software
Hardware
Mobile security (Android & iOS)
- Android App Reverse Engineering 101
- Android Application pentesting book
- Android Pentest Video Course-TutorialsPoint
- IOS Pentesting
- OWASP Mobile Security Testing Guide
- Android Tamer - Android Tamer is a Virtual / Live Platform for Android Security professionals
Online Assemblers
- AZM Online Arm Assembler by Azeria
- Online Disassembler
- Compiler Explorer is an interactive online compiler which shows the assembly output of compiled C++, Rust, Go
ARM
Pentesting Firmwares and emulating and analyzing
Firmware Analysis Tools
- EMBA-An analyzer for embedded Linux firmware
- FACT-Firmware Analysis and Comparison Tool
- Binwalk
- Qiling
- fwanalyzer
- ByteSweep
- Firmwalker
- Checksec.sh
- QEMU
- Firmadyne
- Firmware Modification Kit
Resources
- Firmware analysis and reversing
- Reversing 101
- IoT Security Verification Standard (ISVS)
- OWASP Firmware Security Testing Methodology
- Firmware emulation with QEMU
- Reversing ESP8266 Firmware
- Emulating Embedded Linux Devices with QEMU
- Emulating Embedded Linux Systems with QEMU
- Fuzzing Embedded Linux Devices
- Emulating ARM Router Firmware
- Reversing Firmware With Radare
- Samsung Firmware Magic - Unpacking and Decrypting
- Qiling & Binary Emulation for automatic unpacking
- Reverse engineering with #Ghidra: Breaking an embedded firmware encryption scheme
- Simulating and hunting firmware vulnerabilities with Qiling
Firmware samples to pentest
Symlinks Attacks
Secureboot
Dev
Hacking
- Pwn the ESP32 Secure Boot
- Pwn the ESP32 Forever: Flash Encryption and Sec. Boot Keys Extraction
- Amlogic S905 SoC: bypassing the (not so) Secure Boot to dump the BootROM / another-link
- Defeating Secure Boot with Symlink Attacks
- PS4 Aux Hax 5 & PSVR Secure Boot Hacking with Keys by Fail0verflow!
- ECLYPSIUM DISCOVERS MULTIPLE VULNERABILITIES AFFECTING 129 DELL MODELS VIA DELL REMOTE OS RECOVERY AND FIRMWARE UPDATE CAPABILITIES
- Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347)
Storage Medium
EMMC HACKING
- HARDWARE HACKING 101: IDENTIFYING AND DUMPING EMMC FLASH
- EMMC DATA RECOVERY FROM DAMAGED SMARTPHONE
- Another bunch of Atricles for EMMC
- Unleash your smart-home devices: Vacuum Cleaning Robot Hacking
- Hands-On IoT Hacking: Rapid7 at DEF CON 30 IoT Village, Part 1
Payment Device Security
ATM Hacking
- Introduction to ATM Penetration Testing
- Pwning ATMs For Fun and Profit
- Jackpotting Automated Teller Machines Redux By Barnaby Jack
IoT hardware Overview and Hacking
Hardware Gadgets to pentest
- Bus Pirate
- EEPROM reader/SOIC Cable
- Jtagulator/Jtagenum
- Logic Analyzer
- The Shikra
- FaceDancer21 (USB Emulator/USB Fuzzer)
- RfCat
- Hak5Gear- Hak5FieldKits
- Ultra-Mini Bluetooth CSR 4.0 USB Dongle Adapter
- Attify Badge - UART, JTAG, SPI, I2C (w/ headers)
Attacking Hardware Interfaces
- An Introduction to Hardware Hacking
- Serial Terminal Basics
- Reverse Engineering Serial Ports
- REVERSE ENGINEERING ARCHITECTURE AND PINOUT OF CUSTOM ASICS
- ChipWhisperer - Hardware attacks
- Hardware hacking tutorial: Dumping and reversing firmware
SPI
- Reading FlashROMS - Youtube
- Dumping the firmware From Router using BUSPIRATE - SPI Dump
- How to Flash Chip of a Router With a Programmer | TP-Link Router Repair & MAC address change
- Extracting Flash Memory over SPI
- Extracting Firmware from Embedded Devices (SPI NOR Flash)
- SPI-Blogs
UART
- Identifying UART interface
- onewire-over-uart
- Accessing sensor via UART
- Using UART to connect to a chinese IP cam
- A journey into IoT – Hardware hacking: UART
- UARTBruteForcer
- UART Connections and Dynamic analysis on Linksys e1000
- Accessing and Dumping Firmware Through UART
- UART Exploiter
JTAG
- HARDWARE HACKING 101: INTRODUCTION TO JTAG
- How To Find The JTAG Interface - Hardware Hacking Tutorial
- Buspirate JTAG Connections - Openocd
- Extracting Firmware from External Memory via JTAG
- Analyzing JTAG
- The hitchhacker’s guide to iPhone Lightning & JTAG hacking
SideChannel Attacks
- Side channel attacks
- Attacks on Implementations of Secure Systems
- fuzzing, binary analysis, IoT security, and general exploitation
- Espressif ESP32: Bypassing Encrypted Secure Boot(CVE-2020-13629)
- Breaking AES with ChipWhisperer - Piece of scake (Side Channel Analysis 100)
- Researchers use Rowhammer bit flips to steal 2048-bit crypto key
Glitching attacks
- NAND Glitching Attack
- Tutorial CW305-4 Voltage Glitching with Crowbars
- Voltage Glitching Attack using SySS iCEstick Glitcher
- Samy Kamkar - FPGA Glitching & Side Channel Attacks
- Hardware Power Glitch Attack (Fault Injection) - rhme2 Fiesta (FI 100)
- Keys in flash - Glitching AES keys from an Arduino / ATmega with a camera flash
- Implementing Practical Electrical Glitching Attacks
Awesome IoT Pentesting Guides
- Shodan Pentesting Guide
- Car Hacking Practical Guide 101
- OWASP Firmware Security Testing Methodology
- Awesome-bluetooth-security
Fuzzing Things
- OWASP Fuzzing Info
- Fuzzing_ICS_protocols
- Fuzzowski - the Network Protocol Fuzzer that we will want to use
- Fuzz Testing of Application Reliability
- FIRM-AFL : High-Throughput Greybox Fuzzing of IoT Firmware via Augmented Process Emulation
- Snipuzz : Black-box Fuzzing of IoT Firmware via Message Snippet Inference
- [fuzzing-iot-binaries] - part1 / part2
FlipperZero
Custom firmwares
- Flipper Zero Unleashed Firmware : https://github.com/DarkFlippers/unleashed-firmware
- RogueMaster Flipper Zero Firmware : https://github.com/RogueMaster/flipperzero-firmware-wPlugins
Interesting research
- CVE-2022-40363 : Exploiting Flipper Zero’s NFC file loader
Flipperzero101
Cool Hacks
ICS
Automotive
Vulnerable IoT and Hardware Applications
-
IoT Goat : https://github.com/OWASP/IoTGoat
-
IoT-vulhub : https://vulntotal-team.github.io/IoT-vulhub/#%E5%AE%89%E8%A3%85
-
SCADA : https://www.slideshare.net/phdays/damn-vulnerable-chemical-process
-
SS7 Network: https://www.blackhat.com/asia-17/arsenal.html#damn-vulnerable-ss7-network
-
Hardware Hacking 101 : https://github.com/rdomanski/hardware_hacking
-
RHME-2015 : https://github.com/Riscure/RHme-2015
-
RHME-2016 : https://github.com/Riscure/Rhme-2016
-
RHME-2017 : https://github.com/Riscure/Rhme-2017