# Offensive Iot

IoT and embedded device security testing methodology.

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-iot -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-iot -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-iot -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-iot -g -a gemini-cli -y`

## Description

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# IoT & Embedded, Offensive Testing Methodology

## Quick Workflow

1. **Recon the device physically**, identify SoC, flash, debug interfaces, radios
2. **Get the firmware**, vendor download, OTA capture, hardware dump, or chip-off
3. **Unpack and analyze**, filesystems, services, secrets, default creds, vuln components
4. **Establish runtime access**, UART shell, telnet/SSH default creds, exploit chain
5. **Pivot**, to companion app, cloud API, neighboring devices via mesh / wireless

---

## Hardware Reconnaissance

### PCB Inspection

- ID the **SoC** by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.)
- ID **flash** (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND)
- Find **debug headers**: TX/RX/GND/VCC pads (UART), 4, 10 pin (JTAG), 4 pin (SWD)
- Find test points labeled `TX`, `RX`, `TCK`, `TMS`, `TDO`, `TDI`, `RST`, `BOOT`

### Tools

| Tool | Use |
|------|-----|
| Multimeter | Identify GND, VCC rails before connecting |
| Logic analyzer (Saleae, DSLogic) | Find UART baud, SPI clock, identify protocols |
| USB-UART (FT232, CP2102) | UART console |
| Bus Pirate / Glasgow | UART, SPI, I2C, JTAG generic |
| J-Link / Black Magic Probe | JTAG / SWD MCU debugging |
| CH341A programmer | Cheap SPI flash dumper |
| XGecu T48 | Modern universal programmer (NAND/eMMC/SPI) |
| ChipQuik / hot-air | Chip-off desolder |

### UART Discovery

```bash
# Find baud rate
for b in 9600 19200 38400 57600 115200 230400 460800 921600; do
  echo "=== $b ==="
  timeout 5 minicom -b $b -D /dev/ttyUSB0 -C uart_$b.log
done
grep -l -E "U-Boot|Linux|Bootloader|console|login" uart_*.log
```

Look for: U-Boot console (often `Hit any key` countdown), Linux init messages, root shell on console, login prompt.

### Bootloader Console Drop

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/iot/offensive-iot/SKILL.md