offensive-iot

# IoT & Embedded — Offensive Testing Methodology ## Quick Workflow 1. **Recon the device physically** — identify SoC, flash, debug interfaces, radios 2. **Get the firmware** — vendor download, OTA capture, hardware dump, or chip-off 3. **Unpack and analyze** — filesystems, services, secrets, default creds, vuln components 4. **Establish runtime access** — UART shell, telnet/SSH default creds, exploit chain 5. **Pivot** — to companion app, cloud API, neighboring devices via mesh / wireless --- ## Hardware Reconnaissance ### PCB Inspection - ID the **SoC** by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.) - ID **flash** (8-pin SOIC = SPI NOR; BGA = eMMC; TSOP = NAND) - Find **debug headers**: TX/RX/GND/VCC pads (UART), 4–10 pin (JTAG), 4 pin (SWD) - Find test points labeled `TX`, `RX`, `TCK`, `TMS`, `TDO`, `TDI`, `RST`, `BOOT` ### Tools | Tool | Use | |------|-----| | Multimeter | Identify GND, VCC rails before connecting | | Logic analyzer (Saleae, DSLogic) | Find UART baud, SPI clock, identify protocols | | USB-UART (FT232, CP2102) | UART console | | Bus Pirate / Glasgow | UART, SPI, I2C, JTAG generic | | J-Link / Black Magic Probe | JTAG / SWD MCU debugging | | CH341A programmer | Cheap SPI flash dumper | | XGecu T48 | Modern universal programmer (NAND/eMMC/SPI) | | ChipQuik / hot-air | Chip-off desolder | ### UART Discovery ```bash # Find baud rate for b in 9600 19200 38400 57600 115200 230400 460800 921600; do echo "=== $b ===" ...