offensive-iot

Firmware can be obtained via vendor download portals, OTA traffic capture with mitmproxy, in-circuit SPI flash dumping with flashrom and a CH341A programmer, or chip-off extraction for eMMC and NAND. After acquisition, use binwalk -Me to recursively extract the filesystem.

Connect a USB-UART adapter to the TX/RX/GND pads and iterate through common baud rates (9600 to 921600) with minicom, logging each session. Grep the logs for strings like U-Boot, Linux, or login to identify the correct rate.

For BLE, use bettercap for reconnaissance and gatttool for GATT enumeration and characteristic reads/writes. For Zigbee, use a CC2531 or Sonoff dongle with KillerBee tools like zbdump and zbreplay for sniffing and replay attacks.

Common bypass paths include downgrading to an older signed image with known kernel CVEs, exploiting missing anti-rollback fuses, extracting signing keys from OTP memory, or using voltage/clock glitching with tools like ChipWhisperer to corrupt the signature check.

Many brokers allow anonymous connections without topic ACLs, so subscribing to the wildcard topic '#' with mosquitto_sub reveals all messages including secrets and sensor data. Attackers can also publish commands to control topics without authentication.

Static firmware analysis misses runtime-only behaviors, encrypted OTA payloads, and cloud-side logic. A complete assessment also requires runtime exploitation, companion app decompilation with apktool or jadx, and cloud API testing for IDOR and device-claim flaws.