IoTSecurity101

IoTSecurity101 copied to clipboard

• A Collection for IoT Security Resources
• You are welcome to fork and contribute

Approach Methodology

• 1. Network
• 2. Web (Front & Backend and Web services)
• 3. Mobile App (Android & iOS)
• 4. Wireless Connectivity (Zigbee , WiFi , Bluetooth , etc)
• 5. Firmware Pentesting (OS of IoT Devices)
• 6. Hardware Hacking & Fault Injections & SCA Attacks
• 7. Storage Medium
• 8. I/O Ports

Contents

• IoT Security information

  • IoT Security Chat groups
  • Books
  • Blogs
  • Cheatsheets
  • Search Engines
  • CTF
  • Youtube
  • Exploitation Tools
  • IoT Pentesting OSes
  • IoT Vulnerabilites Checking Guides
  • IoT Labs
  • Awesome IoT Pentesting Guides

• Network

• Web IoT Message Protocols

  • MQTT
  • CoAP

• Mobile app

  • Mobile security (Android & iOS)

• Wireless Protocols

  • RADIO HACKING STARTING GUIDE
  • Cellular Hacking GSM BTS
  • Zigbee
  • Bluetooth

• Firmware

  • Reverse Engineering Tools
  • Online Assemblers
  • ARM
  • Pentesting Firmwares and emulating and analyzing
  • Firmware samples to pentest
  • Bootloader

• Hardware

  • IoT Hardware Intro
  • [IoT Hardware hacking Intro]
  • Required hardware to pentest IoT
  • Hardware interfaces
  • SPI
  • UART
  • JTAG
  • SideChannel Attacks & Glitching attacks

• Storage Medium

To seen Hacked devices

• https://blog.exploitee.rs/2018/10/
• https://www.exploitee.rs/
• https://forum.exploitee.rs/
• Your Lenovo Watch X Is Watching You & Sharing What It Learns
• Your Smart Scale is Leaking More than Your Weight: Privacy Issues in IoT
• Smart Bulb Offers Light, Color, Music, and… Data Exfiltration?
• Besder-IPCamera analysis
• Smart Lock
• Subaru Head Unit Jailbreak
• Jeep Hack
• Dropcam hacking
• Printer Hacking live sessions - gamozolabs

Chat groups for IoT Security

• IoTSecurity101 Telegram - https://t.me/iotsecurity1011
• IoTSecurity101 Reddit - https://www.reddit.com/r/IoTSecurity101/
• IoTSecurity101 Discord - https://discord.gg/EH9dxT9
• hardware hacking Telegram - https://t.me/hardwareHackingBrasil
• NForceIT(IoTSecurity) - https://t.me/iotsecuritygroup
• RFID Discord group - https://discord.gg/Z43TrcVyPr
• ICS Discord group - https://discord.com/invite/CmDDsFK

Books For IoT Pentesting

• The Firmware Handbook (Embedded Technology) 1st Edition by Jack Ganssle - 2004
• Hardware Hacking: Have Fun while Voiding your Warranty 1st Edition - 2004
• Linksys WRT54G Ultimate Hacking 1st Edition by Paul Asadoorian - 2007
• Applied Cyber Security and the Smart Grid: Implementing Security Controls into the Modern Power Infrastructure by Eric D. Knapp , Raj Samani -2013
• Hacking the Xbox-An Introduction to Reverse Engineering HACKING THE XBOX by Andrew “bunnie” Huang - Openbook - 2013
• Android Hacker's Handbook by Joshua J. Drake - 2014
• The Art of Pcb Reverse Engineering: Unravelling the Beauty of the Original Design - 2015
• Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts 1st Edition, by Nitesh Dhanjani - 2015
• Learning Linux Binary Analysis By Ryan "elfmaster" O'Neill - 2016
• Car hacker's handbook by Craig Smith - 2016
• IoT Penetration Testing Cookbook By Aaron Guzman , Aditya Gupta - 2017
• Inside Radio: An Attack and Defense Guide by Authors: Yang, Qing, Huang, Lin -2018
• Pentest Hardware - Openbook -2018
• Gray Hat Hacking: The Ethical Hacker's Handbook, Fifth Edition 5th Edition by by Daniel Regalado , Shon Harris , Allen Harper , Chris Eagle , Jonathan Ness , Branko Spasojevic , Ryan Linn , Stephen Sims - 2018
• The Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks Front Cover Jasper van Woudenberg, Colin O'Flynn - 2021
• Practical IoT Hacking-The Definitive Guide to Attacking the Internet of Things by Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Woods - 2021
• Internet of Things Security Encyclopedia - Openbook

Blogs for iotpentest

• https://payatu.com/blog/
• https://raelize.com/blog/
• http://jcjc-dev.com/
• https://w00tsec.blogspot.in/
• http://www.devttys0.com/
• https://wrongbaud.github.io/
• https://embeddedbits.org/
• https://www.rtl-sdr.com/
• https://keenlab.tencent.com/en/
• https://courk.cc/
• https://iotsecuritywiki.com/
• https://cybergibbons.com/
• http://firmware.re/
• http://blog.k3170makan.com/
• https://blog.tclaverie.eu/
• http://blog.besimaltinok.com/category/iot-pentest/
• https://ctrlu.net/
• http://iotpentest.com/
• https://blog.attify.com
• https://duo.com/decipher/
• http://www.sp3ctr3.me
• http://blog.0x42424242.in/
• https://dantheiotman.com/
• https://blog.danman.eu/
• https://quentinkaiser.be/
• https://blog.quarkslab.com
• https://blog.ice9.us/
• https://labs.f-secure.com/
• https://mg.lol/blog/
• https://cjhackerz.net/
• https://github.com/sponsors/bunnie/
• https://iotmyway.wordpress.com/
• https://www.synacktiv.com/publications.html
• http://blog.cr4.sh/
• https://ktln2.org/
• https://naehrdine.blogspot.com/

Awesome CheatSheets

• Hardware Hacking
• Nmap

Search Engines for IoT Openly devices

• Shodan
• FOFA
• Censys
• Zoomeye
• ONYPHE

CTF For IoT And Embeddded

• https://github.com/hackgnar/ble_ctf
• https://www.microcorruption.com/
• https://github.com/Riscure/Rhme-2016
• https://github.com/Riscure/Rhme-2017
• https://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
• https://github.com/scriptingxss/IoTGoat

YouTube Channels for IoT Pentesting

• Liveoverflow
• Binary Adventure
• EEVBlog
• JackkTutorials
• Craig Smith
• iotpentest [Mr-IoT]
• Besim ALTINOK - IoT - Hardware - Wireless
• Ghidra Ninja
• Cyber Gibbons
• Scanline
• Aaron Christophel

Vehicle Security Resources

• https://github.com/jaredthecoder/awesome-vehicle-security

IoT Vulnerabilites Checking Guides

• Reflecting upon OWASP TOP-10 IoT Vulnerabilities
• OWASP IoT Top 10 2018 Mapping Project
• Hardware toolkits for IoT security analysis

IoT Gateway Software

• Webthings by Mozilla - RaspberryPi

IoT Pentesting OSes

• Sigint OS- LTE IMSI Catcher
• Instatn-gnuradio OS - For Radio Signals Testing
• AttifyOS - IoT Pentest OS - by Aditya Gupta
• Ubutnu Best Host Linux for IoT's - Use LTS
• Internet of Things - Penetration Testing OS
• Dragon OS - DEBIAN LINUX WITH PREINSTALLED OPEN SOURCE SDR SOFTWARE
• EmbedOS - Embedded security testing virtual machine
• Skywave Linux- Software Defined Radio for Global Online Listening
• A Small, Scalable Open Source RTOS for IoT Embedded Devices
• ICS - Controlthings.io

Exploitation Tools

• Expliot - IoT Exploitation framework - by Aseemjakhar
• Routersploit (Exploitation Framework for Embedded Devices)
• IoTSecFuzz (comprehensive testing for IoT device)
• HomePwn - Swiss Army Knife for Pentesting of IoT Devices
• killerbee - Zigbee exploitation
• PRET - Printer Exploitation Toolkit
• HAL – The Hardware Analyzer
• FwAnalyzer (Firmware Analyzer)
• ISF(Industrial Security Exploitation Framework
• PENIOT: Penetration Testing Tool for IoT
• MQTT-PWN

Reverse Engineering Tools

• IDA Pro
• GDB
• Radare2 | cutter
• Ghidra

Introduction

• Introduction to IoT
• IoT Architecture
• IoT attack surface
• IoT Protocols Overview

IoT Web and message services

MQTT

• Introduction
• Hacking the IoT with MQTT
• thoughts about using IoT MQTT for V2V and Connected Car from CES 2014
• Nmap
• The Seven Best MQTT Client Tools
• A Guide to MQTT by Hacking a Doorbell to send Push Notifications
• Are smart homes vulnerable to hacking
• Deep Learning UDF for KSQL / ksqlDB for Streaming Anomaly Detection of MQTT IoT Sensor Data
• Authenticating & Authorizing Devices using MQTT with Auth0
• Development information for the MQTT with hardware
• Understanding the MQTT Protocol Packet Structure
• R7-2019-18: Multiple Hickory Smart Lock Vulnerabilities
• IoT Live Demo: 100.000 Connected Cars With Kubernetes, Kafka, MQTT, TensorFlow

Softwares

• Mosquitto-An open source MQTT broker
• HiveMQ
• MQTT Explorer
• MQTT proxy - IoXY
• MQTT Broker Security - 101
• Welcome to MQTT-PWN!

CoAP

• Introduction
• CoAP client Tools
• CoAP Pentest Tools
• Nmap - NSE for coap

RADIO HACKER QUICK START GUIDE

• SDR Notes - Radio IoT Protocols Overview
• Understanding Radio
• Introduction to Software Defined Radio
• Introduction Gnuradio companion
• Creating a flow graph in gunradiocompanion
• Analysing radio signals 433Mhz
• Recording specific radio signal
• Replay Attacks with raspberrypi -rpitx

Cellular Hacking GSM BTS

BTS

• Awesome-Cellular-Hacking
• what is base tranceiver station
• How to Build Your Own Rogue GSM BTS

GSM SS7 Pentesting

• Introduction to GSM Security
• GSM Security 2
• vulnerabilities in GSM security with USRP B200
• Security Testing 4G (LTE) Networks
• Case Study of SS7/SIGTRAN Assessment
• Telecom Signaling Exploitation Framework - SS7, GTP, Diameter & SIP
• ss7MAPer – A SS7 pen testing toolkit
• Introduction to SIGTRAN and SIGTRAN Licensing
• SS7 Network Architecture
• Introduction to SS7 Signaling
• Breaking LTE on Layer Two

Zigbee ALL Stuff

• Introduction and protocol Overview
• Hacking Zigbee Devices with Attify Zigbee Framework
• Hands-on with RZUSBstick
• ZigBee & Z-Wave Security Brief
• Hacking ZigBee Networks
• Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes
• Security Analysis of Zigbee Networks with Zigator and GNU Radio
• Low-Cost ZigBee Selective Jamming

SW TOOLS

• zigbear
• ZigDiggity
• Zigator
• Z3sec

Hardware Tools for Zigbee

• APIMOTE IEEE 802.15.4/ZIGBEE SNIFFING HARDWARE
• RaspBee-The Raspberry Pi Zigbee gateway
• USRP SDR 2
• ATUSB IEEE 802.15.4 USB Adapter
• nRF52840-Dongle

BLE Intro and SW-HW Tools to pentest

• Step By Step guide to BLE Understanding and Exploiting
• Traffic Engineering in a Bluetooth Piconet
• BLE Characteristics

Bluetooth and BLE Pentest Tools

• btproxy
• hcitool & bluez
• Testing With GATT Tool
• Cracking encryption
• bettercap
• BtleJuice Bluetooth Smart Man-in-the-Middle framework
• gattacker
• BTLEjack Bluetooth Low Energy Swiss army knife

Hardware for bluetooth hacking

• NRFCONNECT - 52840
• EDIMAX
• CSR 4.0
• ESP32 - Development and learning Bluetooth
• Ubertooth
• Sena 100

BLE Pentesting Tutorials

• Bluetooth vs BLE Basics
• Finding bugs in Bluetooth
• Intel Edison as Bluetooth LE — Exploit box
• How I Reverse Engineered and Exploited a Smart Massager
• My journey towards Reverse Engineering a Smart Band — Bluetooth-LE RE
• Bluetooth Smartlocks
• I hacked MiBand 3
• GATTacking Bluetooth Smart Devices
• blueooth beacon vulnerability
• Sweyntooth Vulnerabilties
• AIRDROP_LEAK - sniffs BLE traffic and displays status messages from Apple devices

Mobile security (Android & iOS)

• Android App Reverse Engineering 101
• Android Application pentesting book
• Android Pentest Video Course-TutorialsPoint
• IOS Pentesting
• OWASP Mobile Security Testing Guide
• Android Tamer - Android Tamer is a Virtual / Live Platform for Android Security professionals

Online Assemblers

• AZM Online Arm Assembler by Azeria
• Online Disassembler
• Compiler Explorer is an interactive online compiler which shows the assembly output of compiled C++, Rust, Go

ARM

• Azeria Labs
• ARM EXPLOITATION FOR IoT
• Damn Vulnerable ARM Router (DVAR)
• EXPLOIT.EDUCATION

Pentesting Firmwares and emulating and analyzing

• EMBA-An analyzer for embedded Linux firmware
• Firmware analysis and reversing
• IoT Security Verification Standard (ISVS)
• OWASP Firmware Security Testing Methodology
• Firmware emulation with QEMU
• Reversing ESP8266 Firmware
• Emulating Embedded Linux Devices with QEMU
• Emulating Embedded Linux Systems with QEMU
• Fuzzing Embedded Linux Devices
• Emulating ARM Router Firmware
• Reversing Firmware With Radare
• Samsung Firmware Magic - Unpacking and Decrypting
• Qiling & Binary Emulation for automatic unpacking
• Reverse engineering with #Ghidra: Breaking an embedded firmware encryption scheme
• Simulating and hunting firmware vulnerabilities with Qiling

Firmware samples to pentest

• Download From here by firmware.center

Bootloader

Dev

• Writing a Bootloader

Storage Medium

• HARDWARE HACKING 101: IDENTIFYING AND DUMPING EMMC FLASH
• EMMC DATA RECOVERY FROM DAMAGED SMARTPHONE
• Another bunch of Atricles for EMMC
• Unleash your smart-home devices: Vacuum Cleaning Robot Hacking

IoT hardware Overview and Hacking

• IoT Hardware Guide
• Intro To Hardware Hacking - Dumping Your First Firmware

Hardware Gadgets to pentest

• Bus Pirate
• EEPROM reader/SOIC Cable
• Jtagulator/Jtagenum
• Logic Analyzer
• The Shikra
• FaceDancer21 (USB Emulator/USB Fuzzer)
• RfCat
• Hak5Gear- Hak5FieldKits
• Ultra-Mini Bluetooth CSR 4.0 USB Dongle Adapter
• Attify Badge - UART, JTAG, SPI, I2C (w/ headers)

Attacking Hardware Interfaces

• An Introduction to Hardware Hacking
• Serial Terminal Basics
• Reverse Engineering Serial Ports
• REVERSE ENGINEERING ARCHITECTURE AND PINOUT OF CUSTOM ASICS
• ChipWhisperer - Hardware attacks
• Hardware hacking tutorial: Dumping and reversing firmware

SPI

• Reading FlashROMS - Youtube
• Dumping the firmware From Router using BUSPIRATE - SPI Dump
• How to Flash Chip of a Router With a Programmer | TP-Link Router Repair & MAC address change
• Extracting Flash Memory over SPI
• SPI-Blogs

UART

• Identifying UART interface
• onewire-over-uart
• Accessing sensor via UART
• Using UART to connect to a chinese IP cam
• A journey into IoT – Hardware hacking: UART
• UARTBruteForcer
• UART Connections and Dynamic analysis on Linksys e1000
• Accessing and Dumping Firmware Through UART

JTAG

• JTAG Explained (finally!)
• Buspirate JTAG Connections - Openocd

SideChannel Attacks and Glitching attacks

• Side channel attacks
• Attacks on Implementations of Secure Systems
• fuzzing, binary analysis, IoT security, and general exploitation
• NAND Glitching Attack
• Voltage Glitching Attack
• Espressif ESP32: Bypassing Encrypted Secure Boot(CVE-2020-13629)
• Voltage Glitching Attack using SySS iCEstick Glitcher
• Samy Kamkar - FPGA Glitching & Side Channel Attacks
• Hardware Power Glitch Attack (Fault Injection) - rhme2 Fiesta (FI 100)
• Breaking AES with ChipWhisperer - Piece of scake (Side Channel Analysis 100)
• https://www.youtube.com/watch?v=4urMITJKQQs&ab_channel=stacksmashing

Awesome IoT Pentesting Guides

• Shodan Pentesting Guide
• Car Hacking Practical Guide 101
• OWASP Firmware Security Testing Methodology
• awesome-bluetooth-security
• Firmware Pentest Guide

Vulnerable IoT and Hardware Applications

• IoT Goat : https://github.com/scriptingxss/IoTGoat

• IoT : https://github.com/Vulcainreo/DVID

• Safe : https://insinuator.net/2016/01/damn-vulnerable-safe/

• Router : https://github.com/praetorian-code/DVRF

• SCADA : https://www.slideshare.net/phdays/damn-vulnerable-chemical-process

• PI : https://whitedome.com.au/re4son/sticky-fingers-dv-pi/

• SS7 Network: https://www.blackhat.com/asia-17/arsenal.html#damn-vulnerable-ss7-network

• VoIP : https://www.vulnhub.com/entry/hacklab-vulnvoip,40/

follow the people

• Jilles
• Joe Fitz
• Aseem Jakhar
• Cybergibbons
• Jasper
• Dave Jones
• bunnie
• Ilya Shaposhnikov
• Mark C.
• A-a-ron Guzman
• Arun Mane
• Yashin Mehaboobe
• Arun Magesh