Offensive Iot
IoT and embedded device security testing methodology.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-iot -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Testing
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.
IoT & Embedded, Offensive Testing Methodology
Quick Workflow
- Recon the device physically, identify SoC, flash, debug interfaces, radios
- Get the firmware, vendor download, OTA capture, hardware dump, or chip-off
- Unpack and analyze, filesystems, services, secrets, default creds, vuln components
- Establish runtime access, UART shell, telnet/SSH default creds, exploit chain
- Pivot, to companion app, cloud API, neighboring devices via mesh / wireless
Hardware Reconnaissance
PCB Inspection
- ID the SoC by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.)
- ID flash (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND)
- Find debug headers: TX/RX/GND/VCC pads (UART), 4, 10 pin (JTAG), 4 pin (SWD)
- Find test points labeled
TX,RX,TCK,TMS,TDO,TDI,RST,BOOT
Tools
| Tool | Use |
|---|---|
| Multimeter | Identify GND, VCC rails before connecting |
| Logic analyzer (Saleae, DSLogic) | Find UART baud, SPI clock, identify protocols |
| USB-UART (FT232, CP2102) | UART console |
| Bus Pirate / Glasgow | UART, SPI, I2C, JTAG generic |
| J-Link / Black Magic Probe | JTAG / SWD MCU debugging |
| CH341A programmer | Cheap SPI flash dumper |
| XGecu T48 | Modern universal programmer (NAND/eMMC/SPI) |
| ChipQuik / hot-air | Chip-off desolder |
UART Discovery
# Find baud rate
for b in 9600 19200 38400 57600 115200 230400 460800 921600; do
echo "=== $b ==="
timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log
done
grep -l -E "U-Boot|Linux|Bootloader|console|login" uart_*.log
Look for: U-Boot console (often Hit any key countdown), Linux init messages, root shell on console, login prompt.
