offensive-iot

Name: offensive-iot
Author: SnailSploit

2.8kstars447forks

How to install offensive-iot?

snailsploit/claude-red/offensive-iot

$npx -y skills add SnailSploit/Claude-Red --skill offensive-iot

Installs into the current project.

Summary

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage,

Files · 1

View on GitHub

SKILL.md

1	# IoT & Embedded — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Recon the device physically — identify SoC, flash, debug interfaces, radios
6	2. Get the firmware — vendor download, OTA capture, hardware dump, or chip-off
7	3. Unpack and analyze — filesystems, services, secrets, default creds, vuln components
8	4. Establish runtime access — UART shell, telnet/SSH default creds, exploit chain
9	5. Pivot — to companion app, cloud API, neighboring devices via mesh / wireless
10
11	---
12
13	## Hardware Reconnaissance
14
15	### PCB Inspection
16
17	- ID the SoC by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.)
18	- ID flash (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND)
19	- Find debug headers: TX/RX/GND/VCC pads (UART), 4–10 pin (JTAG), 4 pin (SWD)
20	- Find test points labeled `TX`, `RX`, `TCK`, `TMS`, `TDO`, `TDI`, `RST`, `BOOT`
21
22	### Tools
23
24	\| Tool \| Use \|
25	\|------\|-----\|
26	\| Multimeter \| Identify GND, VCC rails before connecting \|
27	\| Logic analyzer (Saleae, DSLogic) \| Find UART baud, SPI clock, identify protocols \|
28	\| USB-UART (FT232, CP2102) \| UART console \|
29	\| Bus Pirate / Glasgow \| UART, SPI, I2C, JTAG generic \|
30	\| J-Link / Black Magic Probe \| JTAG / SWD MCU debugging \|
31	\| CH341A programmer \| Cheap SPI flash dumper \|
32	\| XGecu T48 \| Modern universal programmer (NAND/eMMC/SPI) \|
33	\| ChipQuik / hot-air \| Chip-off desolder \|
34
35	### UART Discovery
36
37	```bash
38	# Find baud rate
39	for b in 9600 19200 38400 57600 115200 230400 460800 921600; do
40	echo "=== $b ==="
41	timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log
42	done
43	grep -l -E "U-Boot\|Linux\|Bootloader\|console\|login" uart_*.log
44	```
45
46	Look for: U-Boot console (often `Hit any key` countdown), Linux init messages, root shell on console, login prompt.
47
48	### Bootloader Console Drop
49
50	```
51	# At U-Boot countdown, mash space or key listed
52	Hit any key to stop autoboot: 0
53	=> printenv # full env, often includes boot args
54	=> setenv bootargs ${bootargs} init=/bin/sh
55	=> boot # Linux comes up to root shell, no login
56	```
57
58	If U-Boot is locked, try:
59	- `CONFIG_DELAY_AUTOBOOT_KEYED` keyword (vendor-specific)
60	- `Ctrl+C` / `Ctrl+B` / specific magic strings
61	- Glitch the U-Boot version-check / signature-check (see Fault Injection)
62
63	---
64
65	## Flash Dumping
66
67	### SPI NOR (most common consumer IoT)
68
69	```bash
70	# In-circuit dump (hold SoC in reset to avoid bus contention)
71	flashrom -p ch341a_spi -r firmware.bin
72
73	# Verify
74	file firmware.bin && binwalk firmware.bin
75	```
76
77	If the SoC fights you: desolder the SPI chip, dump in socket, re-solder.
78
79	### eMMC / NAND
80
81	eMMC is desolder-then-read: BGA-153/169 to SD adapter (cheap eBay), use a USB SD reader.
82
83	NAND requires bit-flipping and ECC handling — `nanddump`/`yaffshiv`/`ubireader` post-extraction.
84
85	### OTA Capture
86
87	Many devices fetch firmware over HTTP(S). MITM the device:
88
89	```bash
90	# Captive AP + transparent proxy
91	sudo create_ap wlan0 eth0 IoTLab
92	mitmproxy --mode transparent --showhost --ssl-insecure
93	# Or for non-SNI / pinning, use bettercap with custom DNS
94	```
95
96	Capture the URL, download directly, dissect.
97
98	---
99
100	## Firmware Analysis
101
102	### Initial Triage
103
104	```bash
105	binwalk -Me firmware.bin # Extract recursively
106	binwalk -E firmware.bin # Entropy plot — flat = encrypted/compressed
107	strings firmware.bin \| grep -iE "(passwd\|key\|token\|admin\|http\|ssid)"
108	```
109
110	### Filesystem Mounting
111
112	```bash
113	# SquashFS (most consumer Linux IoT)
114	unsquashfs -d rootfs squashfs.bin
115
116	# JFFS2 / UBIFS (NAND-backed)
117	jefferson jffs2.bin -d rootfs
118	ubireader_extract_files ubi.bin -o rootfs
119	```
120
121	### Embedded-Linux Quick Wins
122
123	```bash
124	# Hardcoded credentials and keys
125	grep -RIE "(BEGIN (RSA \|DSA \|EC )?PRIVATE KEY\|api[_-]?key\|secret\|token\|passwd\|root:[^*])" rootfs/
126	find rootfs -name ".pem" -o -name ".key" -o -name "shadow"
127
128	# Telnet/SSH default creds
129	cat rootfs/etc/passwd rootfs/etc/shadow
130	grep -r "telnetd" rootfs/etc/init.d
131	grep -r "dropbear\\|sshd" rootfs/
132
133	# Setuid binaries
134	find rootfs -perm -4000 -type f
135
136	# Vulnerable busybox / dropbear / openssl versions
137	rootfs/bin/busybox 2>&1 \| head -1
138	strings rootfs/sbin/dropbear \| grep "Dropbear v"
139	strings rootfs/usr/lib/libssl* \| grep "OpenSSL "
140
141	# Web a

People who liked this also viewed

6 picks

Type

offensive-iot

2.8kstars447forks

View on GitHub

How to install offensive-iot?

snailsploit/claude-red/offensive-iot

$npx -y skills add SnailSploit/Claude-Red --skill offensive-iot

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# IoT & Embedded — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Recon the device physically — identify SoC, flash, debug interfaces, radios
6	2. Get the firmware — vendor download, OTA capture, hardware dump, or chip-off
7	3. Unpack and analyze — filesystems, services, secrets, default creds, vuln components
8	4. Establish runtime access — UART shell, telnet/SSH default creds, exploit chain
9	5. Pivot — to companion app, cloud API, neighboring devices via mesh / wireless
10
11	---
12
13	## Hardware Reconnaissance
14
15	### PCB Inspection
16
17	- ID the SoC by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.)
18	- ID flash (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND)
19	- Find debug headers: TX/RX/GND/VCC pads (UART), 4–10 pin (JTAG), 4 pin (SWD)
20	- Find test points labeled `TX`, `RX`, `TCK`, `TMS`, `TDO`, `TDI`, `RST`, `BOOT`
21
22	### Tools
23
24	\| Tool \| Use \|
25	\|------\|-----\|
26	\| Multimeter \| Identify GND, VCC rails before connecting \|
27	\| Logic analyzer (Saleae, DSLogic) \| Find UART baud, SPI clock, identify protocols \|
28	\| USB-UART (FT232, CP2102) \| UART console \|
29	\| Bus Pirate / Glasgow \| UART, SPI, I2C, JTAG generic \|
30	\| J-Link / Black Magic Probe \| JTAG / SWD MCU debugging \|
31	\| CH341A programmer \| Cheap SPI flash dumper \|
32	\| XGecu T48 \| Modern universal programmer (NAND/eMMC/SPI) \|
33	\| ChipQuik / hot-air \| Chip-off desolder \|
34
35	### UART Discovery
36
37	```bash
38	# Find baud rate
39	for b in 9600 19200 38400 57600 115200 230400 460800 921600; do
40	echo "=== $b ==="
41	timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log
42	done
43	grep -l -E "U-Boot\|Linux\|Bootloader\|console\|login" uart_*.log
44	```
45
46	Look for: U-Boot console (often `Hit any key` countdown), Linux init messages, root shell on console, login prompt.
47
48	### Bootloader Console Drop
49
50	```
51	# At U-Boot countdown, mash space or key listed
52	Hit any key to stop autoboot: 0
53	=> printenv # full env, often includes boot args
54	=> setenv bootargs ${bootargs} init=/bin/sh
55	=> boot # Linux comes up to root shell, no login
56	```
57
58	If U-Boot is locked, try:
59	- `CONFIG_DELAY_AUTOBOOT_KEYED` keyword (vendor-specific)
60	- `Ctrl+C` / `Ctrl+B` / specific magic strings
61	- Glitch the U-Boot version-check / signature-check (see Fault Injection)
62
63	---
64
65	## Flash Dumping
66
67	### SPI NOR (most common consumer IoT)
68
69	```bash
70	# In-circuit dump (hold SoC in reset to avoid bus contention)
71	flashrom -p ch341a_spi -r firmware.bin
72
73	# Verify
74	file firmware.bin && binwalk firmware.bin
75	```
76
77	If the SoC fights you: desolder the SPI chip, dump in socket, re-solder.
78
79	### eMMC / NAND
80
81	eMMC is desolder-then-read: BGA-153/169 to SD adapter (cheap eBay), use a USB SD reader.
82
83	NAND requires bit-flipping and ECC handling — `nanddump`/`yaffshiv`/`ubireader` post-extraction.
84
85	### OTA Capture
86
87	Many devices fetch firmware over HTTP(S). MITM the device:
88
89	```bash
90	# Captive AP + transparent proxy
91	sudo create_ap wlan0 eth0 IoTLab
92	mitmproxy --mode transparent --showhost --ssl-insecure
93	# Or for non-SNI / pinning, use bettercap with custom DNS
94	```
95
96	Capture the URL, download directly, dissect.
97
98	---
99
100	## Firmware Analysis
101
102	### Initial Triage
103
104	```bash
105	binwalk -Me firmware.bin # Extract recursively
106	binwalk -E firmware.bin # Entropy plot — flat = encrypted/compressed
107	strings firmware.bin \| grep -iE "(passwd\|key\|token\|admin\|http\|ssid)"
108	```
109
110	### Filesystem Mounting
111
112	```bash
113	# SquashFS (most consumer Linux IoT)
114	unsquashfs -d rootfs squashfs.bin
115
116	# JFFS2 / UBIFS (NAND-backed)
117	jefferson jffs2.bin -d rootfs
118	ubireader_extract_files ubi.bin -o rootfs
119	```
120
121	### Embedded-Linux Quick Wins
122
123	```bash
124	# Hardcoded credentials and keys
125	grep -RIE "(BEGIN (RSA \|DSA \|EC )?PRIVATE KEY\|api[_-]?key\|secret\|token\|passwd\|root:[^*])" rootfs/
126	find rootfs -name ".pem" -o -name ".key" -o -name "shadow"
127
128	# Telnet/SSH default creds
129	cat rootfs/etc/passwd rootfs/etc/shadow
130	grep -r "telnetd" rootfs/etc/init.d
131	grep -r "dropbear\\|sshd" rootfs/
132
133	# Setuid binaries
134	find rootfs -perm -4000 -type f
135
136	# Vulnerable busybox / dropbear / openssl versions
137	rootfs/bin/busybox 2>&1 \| head -1
138	strings rootfs/sbin/dropbear \| grep "Dropbear v"
139	strings rootfs/usr/lib/libssl* \| grep "OpenSSL "
140
141	# Web a

People who liked this also viewed

6 picks

Type