V33RU / Iotsecurity101

Approach Methodology

• 1. Network
• 2. Web (Front & Backend and Web services)
• 3. Mobile App (Android & iOS)
• 4. Wireless Connectivity (Zigbee , WiFi , Bluetooth , etc)
• 5. Firmware Pentesting (OS of IoT Devices)
• 6. Hardware Hacking & Fault Injections & SCA Attacks
• 7. Storage Medium
• 8. I/O Ports

Contents

• IoT Security information

  • IoT Security Chat groups
  • Books
  • Blogs
  • Cheatsheets
  • Search Engines
  • CTF
  • Youtube
  • Exploitation Tools
  • IoT Pentesting OSes
  • IoT Vulnerabilites Checking Guides

• Network

• Web

• Mobile app

• Wireless Protocols

  • RADIO HACKING STARTING GUIDE

  • Cellular Hacking & GSM & BTS

  • BTS

  • [GSM & SS7 Pentesting](GSM & SS7 Pentesting)

  • Bluetooth

• firmware

• Firmware

• Hardware

  • IoT Hardware Intro
  • [IoT Hardware hacking Intro]
  • Required hardware to pentest IoT
  • Hardware interfaces
  • SPI
  • UART
  • JTAG
  • SideChannel Attacks & Glitching attacks

• Storage Medium

• I/O Ports

To seen Hacked devices

• https://blog.exploitee.rs/2018/10/
• https://www.exploitee.rs/
• https://forum.exploitee.rs/
• Your Lenovo Watch X Is Watching You & Sharing What It Learns
• Your Smart Scale is Leaking More than Your Weight: Privacy Issues in IoT
• Smart Bulb Offers Light, Color, Music, and… Data Exfiltration?
• Besder-IPCamera analysis
• Smart Lock
• Subaru Head Unit Jailbreak
• Jeep Hack
• Dropcam hacking

Chat groups for IoT Security

• https://t.me/iotsecurity1011
• https://www.reddit.com/r/IoTSecurity101/
• https://t.me/hardwareHackingBrasil
• https://t.me/joinchat/JAMxOg5YzdkGjcF3HmNgQw
• https://discord.gg/EH9dxT9

Books For IoT Pentesting

• Android Hacker's Handbook
• Hacking the Xbox - Openbook
• Car hacker's handbook
• IoT Penetration Testing Cookbook
• Abusing the Internet of Things
• Hardware Hacking: Have Fun while Voiding your Warranty
• Linksys WRT54G Ultimate Hacking
• Linux Binary Analysis
• The Firmware Handbook
• Hardware Hacking Handbook
• inside radio attack and defense
• Pentest Hardware - Openbook
• The Art of Pcb Reverse Engineering
• Internet of Things Security Encyclopedia - Openbook
• Applied Cyber Security and the Smart Grid-ICS
• Gray Hat Hacking: The Ethical Hacker's Handbook, Fifth Edition
• Practical IoT Hacking

Blogs for iotpentest

• https://payatu.com/blog/
• http://jcjc-dev.com/
• https://w00tsec.blogspot.in/
• http://www.devttys0.com/
• https://wrongbaud.github.io/
• https://embeddedbits.org/
• https://www.rtl-sdr.com/
• https://keenlab.tencent.com/en/
• https://courk.cc/
• https://iotsecuritywiki.com/
• https://cybergibbons.com/
• http://firmware.re/
• http://blog.k3170makan.com/
• https://blog.tclaverie.eu/
• http://blog.besimaltinok.com/category/iot-pentest/
• https://ctrlu.net/
• http://iotpentest.com/
• https://blog.attify.com
• https://duo.com/decipher/
• http://www.sp3ctr3.me
• http://blog.0x42424242.in/
• https://dantheiotman.com/
• https://blog.danman.eu/
• https://quentinkaiser.be/
• https://blog.quarkslab.com
• https://blog.ice9.us/
• https://labs.f-secure.com/
• https://mg.lol/blog/
• https://cjhackerz.net/
• https://github.com/sponsors/bunnie/
• https://iotmyway.wordpress.com/
• https://www.synacktiv.com/publications.html

Awesome CheatSheets

• Hardware Hacking
• Nmap

Search Engines for IoT Openly devices

• Shodan
• FOFA
• Censys
• Zoomeye
• ONYPHE

CTF For IoT And Embeddded

• https://github.com/hackgnar/ble_ctf
• https://www.microcorruption.com/
• https://github.com/Riscure/Rhme-2016
• https://github.com/Riscure/Rhme-2017
• https://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
• https://github.com/scriptingxss/IoTGoat

YouTube Channels for IoT Pentesting

• Liveoverflow
• Binary Adventure
• EEVBlog
• JackkTutorials
• Craig Smith
• iotpentest [Mr-IoT]
• Besim ALTINOK - IoT - Hardware - Wireless
• Ghidra Ninja
• Cyber Gibbons
• Scanline

Vehicle Security Resources

• https://github.com/jaredthecoder/awesome-vehicle-security

IoT Vulnerabilites Checking Guides

• Reflecting upon OWASP TOP-10 IoT Vulnerabilities
• OWASP IoT Top 10 2018 Mapping Project
• Firmware Pentest Guide
• Hardware toolkits for IoT security analysis

IoT Gateway Software

• Webthings by Mozilla - RaspberryPi

IoT Pentesting OSes

• Sigint OS- LTE IMSI Catcher
• Instatn-gnuradio OS - For Radio Signals Testing
• AttifyOS - IoT Pentest OS - by Aditya Gupta
• Ubutnu Best Host Linux for IoT's - Use LTS
• Internet of Things - Penetration Testing OS
• Dragon OS - DEBIAN LINUX WITH PREINSTALLED OPEN SOURCE SDR SOFTWARE
• EmbedOS - Embedded security testing virtual machine
• Skywave Linux- Software Defined Radio for Global Online Listening
• A Small, Scalable Open Source RTOS for IoT Embedded Devices
• ICS - Controlthings.io

Exploitation Tools

• Expliot - IoT Exploitation framework - by Aseemjakhar
• Routersploit (Exploitation Framework for Embedded Devices)
• IoTSecFuzz (comprehensive testing for IoT device)
• HomePwn - Swiss Army Knife for Pentesting of IoT Devices
• killerbee - Zigbee exploitation
• PRET - Printer Exploitation Toolkit
• HAL – The Hardware Analyzer
• FwAnalyzer (Firmware Analyzer)
• ISF(Industrial Security Exploitation Framework
• PENIOT: Penetration Testing Tool for IoT
• MQTT-PWN

Reverse Engineering Tools

• IDA Pro
• GDB
• Radare2 | cutter
• Ghidra

Introduction

• Introduction to IoT
• IoT Architecture
• IoT attack surface
• IoT Protocols Overview

IoT Web and message services

MQTT

• Introduction
• Hacking the IoT with MQTT
• thoughts about using IoT MQTT for V2V and Connected Car from CES 2014
• Nmap
• The Seven Best MQTT Client Tools
• A Guide to MQTT by Hacking a Doorbell to send Push Notifications
• Are smart homes vulnerable to hacking
• Deep Learning UDF for KSQL / ksqlDB for Streaming Anomaly Detection of MQTT IoT Sensor Data
• Authenticating & Authorizing Devices using MQTT with Auth0
• Development information for the MQTT with hardware
• Understanding the MQTT Protocol Packet Structure
• R7-2019-18: Multiple Hickory Smart Lock Vulnerabilities
• IoT Live Demo: 100.000 Connected Cars With Kubernetes, Kafka, MQTT, TensorFlow

Softwares

• Mosquitto-An open source MQTT broker
• HiveMQ
• MQTT Explorer
• MQTT proxy - IoXY
• MQTT Broker Security - 101
• Welcome to MQTT-PWN!

CoAP

• Introduction
• CoAP client Tools
• CoAP Pentest Tools
• Nmap - NSE for coap

Automobile ★ and ★ Car ★ Hacking ★ stuff

★ CANBUS

• Introduction and protocol Overview
• PENTESTING VEHICLES WITH CANTOOLZ
• Building a Car Hacking Development Workbench: Part1
• CANToolz - Black-box CAN network analysis framework
• PLAYING WITH CAN BUS

RADIO HACKER QUICK START GUIDE

• SDR Notes - Radio IoT Protocols Overview
• Understanding Radio
• Introduction to Software Defined Radio
• Introduction Gnuradio companion
• Creating a flow graph in gunradiocompanion
• Analysing radio signals 433Mhz
• Recording specific radio signal
• Replay Attacks with raspberrypi -rpitx

Cellular Hacking & GSM & BTS

BTS

• Awesome-Cellular-Hacking
• what is base tranceiver station
• How to Build Your Own Rogue GSM BTS

GSM & SS7 Pentesting

• Introduction to GSM Security
• GSM Security 2
• vulnerabilities in GSM security with USRP B200
• Security Testing 4G (LTE) Networks
• Case Study of SS7/SIGTRAN Assessment
• Telecom Signaling Exploitation Framework - SS7, GTP, Diameter & SIP
• ss7MAPer – A SS7 pen testing toolkit
• Introduction to SIGTRAN and SIGTRAN Licensing
• SS7 Network Architecture
• Introduction to SS7 Signaling
• Breaking LTE on Layer Two

Zigbee & Zwave

• Introduction and protocol Overview
• Hacking Zigbee Devices with Attify Zigbee Framework
• Hands-on with RZUSBstick
• ZigBee & Z-Wave Security Brief

BLE Intro and SW-HW Tools to pentest

• Step By Step guide to BLE Understanding and Exploiting
• Traffic Engineering in a Bluetooth Piconet
• BLE Characteristics

Bluetooth and BLE Pentest Tools

• btproxy
• hcitool & bluez
• Testing With GATT Tool
• Cracking encryption
• bettercap
• BtleJuice Bluetooth Smart Man-in-the-Middle framework
• gattacker
• BTLEjack Bluetooth Low Energy Swiss army knife

Hardware for bluetooth hacking

• NRFCONNECT - 52840
• EDIMAX
• CSR 4.0
• ESP32 - Development and learning Bluetooth
• Ubertooth
• Sena 100

BLE Pentesting Tutorials

• Bluetooth vs BLE Basics
• Intel Edison as Bluetooth LE — Exploit box
• How I Reverse Engineered and Exploited a Smart Massager
• My journey towards Reverse Engineering a Smart Band — Bluetooth-LE RE
• Bluetooth Smartlocks
• I hacked MiBand 3
• GATTacking Bluetooth Smart Devices
• blueooth beacon vulnerability
• Sweyntooth Vulnerabilties

Mobile security (Android & iOS)

• Android App Reverse Engineering 101
• Android Application pentesting book
• Android Pentest Video Course-TutorialsPoint
• IOS Pentesting
• OWASP Mobile Security Testing Guide
• Android Tamer - Android Tamer is a Virtual / Live Platform for Android Security professionals

Online Assemblers

• AZM Online Arm Assembler by Azeria
• Online Disassembler
• Compiler Explorer is an interactive online compiler which shows the assembly output of compiled C++, Rust, Go

ARM

• Azeria Labs
• ARM EXPLOITATION FOR IoT
• Damn Vulnerable ARM Router (DVAR)
• EXPLOIT.EDUCATION

Pentesting Firmwares and emulating and analyzing

• Firmware analysis and reversing
• Firmware emulation with QEMU
• Reversing ESP8266 Firmware
• Emulating Embedded Linux Devices with QEMU
• Emulating Embedded Linux Systems with QEMU
• Fuzzing Embedded Linux Devices
• Emulating ARM Router Firmware
• Reversing Firmware With Radare
• Samsung Firmware Magic
• Qiling & Binary Emulation for automatic unpacking
• Reverse engineering with #Ghidra: Breaking an embedded firmware encryption scheme
• Simulating and hunting firmware vulnerabilities with Qiling

Firmware samples to pentest

• Download From here by firmware.center

Storage Medium

• HARDWARE HACKING 101: IDENTIFYING AND DUMPING EMMC FLASH
• EMMC DATA RECOVERY FROM DAMAGED SMARTPHONE
• Another bunch of Atricles for EMMC
• Unleash your smart-home devices: Vacuum Cleaning Robot Hacking

IoT hardware Overview and Hacking

• IoT Hardware Guide

Hardware Gadgets to pentest

• Bus Pirate
• EEPROM reader/SOIC Cable
• Jtagulator/Jtagenum
• Logic Analyzer
• The Shikra
• FaceDancer21 (USB Emulator/USB Fuzzer)
• RfCat
• Hak5Gear- Hak5FieldKits
• Ultra-Mini Bluetooth CSR 4.0 USB Dongle Adapter
• Attify Badge - UART, JTAG, SPI, I2C (w/ headers)

Attacking Hardware Interfaces

• Serial Terminal Basics
• Reverse Engineering Serial Ports
• REVERSE ENGINEERING ARCHITECTURE AND PINOUT OF CUSTOM ASICS
• ChipWhisperer - Hardware attacks

SPI

• Reading FlashROMS
• Dumping the firmware From Router using BUSPIRATE - SPI Dump
• How to Flash Chip of a Router With a Programmer | TP-Link Router Repair & MAC address change

UART

• Identifying UART interface
• onewire-over-uart
• Accessing sensor via UART
• Using UART to connect to a chinese IP cam
• A journey into IoT – Hardware hacking: UART
• UARTBruteForcer
• UART Connections and Dynamic analysis on Linksys e1000

JTAG

• JTAG Explained (finally!)

SideChannel Attacks & Glitching attacks

• Side channel attacks
• Attacks on Implementations of Secure Systems
• fuzzing, binary analysis, IoT security, and general exploitation
• NAND Glitching Attack
• Voltage Glitching Attack
• Espressif ESP32: Bypassing Encrypted Secure Boot(CVE-2020-13629)
• Voltage Glitching Attack using SySS iCEstick Glitcher
• Samy Kamkar - FPGA Glitching & Side Channel Attacks
• Breaking AES with ChipWhisperer - Piece of scake (Side Channel Analysis 100)
• https://www.youtube.com/watch?v=4urMITJKQQs&ab_channel=stacksmashing

Awesome IoT Pentesting Guides

• Shodan Pentesting Guide
• Car Hacking Practical Guide 101
• OWASP Firmware Security Testing Methodology

Vulnerable IoT and Hardware Applications

• IoT Goat : https://github.com/scriptingxss/IoTGoat

• IoT : https://github.com/Vulcainreo/DVID

• Safe : https://insinuator.net/2016/01/damn-vulnerable-safe/

• Router : https://github.com/praetorian-code/DVRF

• SCADA : https://www.slideshare.net/phdays/damn-vulnerable-chemical-process

• PI : https://whitedome.com.au/re4son/sticky-fingers-dv-pi/

• SS7 Network: https://www.blackhat.com/asia-17/arsenal.html#damn-vulnerable-ss7-network

• VoIP : https://www.vulnhub.com/entry/hacklab-vulnvoip,40/

Additional Resources:

follow the people

• Jilles
• Joe Fitz
• Aseem Jakhar
• Cybergibbons
• Jasper
• Dave Jones
• bunnie
• Ilya Shaposhnikov
• Mark C.
• A-a-ron Guzman
• Arun Mane
• Yashin Mehaboobe
• Arun Magesh