pentest-iot-ot

name

pentest-iot-ot

description

Embedded / IoT / OT / ICS penetration testing. Use when the user mentions IoT pentest, firmware analysis, OWASP FSTM, binwalk, squashfs, JFFS2, UBIFS, EMBA, FACT, Firmadyne, QEMU emulation, UART, JTAG, SWD, SPI flash, SOIC clip, CH341A, chip-off, JTAGulator, OpenOCD, glitching, ChipWhisperer, U-Boot, BLE GATT, Zigbee, LoRa, Z-Wave, NFC, sub-GHz, HackRF, URH, Modbus, DNP3, S7Comm, EtherNet/IP, BACnet, OPC UA, IEC 61850, Allen-Bradley, Siemens TIA, PLC, HMI, SCADA, engineering workstation, or ATT&CK ICS techniques.

Pentest — IoT / OT

Apply 10-iot-ot/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 10-iot-ot/00-overview.md first.

Phase order

1. 10-iot-ot/01-firmware-analysis.md — 9 stages of OWASP FSTM applied.
2. 10-iot-ot/02-hardware-attacks.md — UART, JTAG, SWD, SPI/I2C, chip-off, glitching, side-channel, bootloader.
3. 10-iot-ot/03-radio-rf.md — spectrum, modulation, replay, BLE, Zigbee, LoRa, Z-Wave, NFC, sub-GHz.
4. 10-iot-ot/04-iot-app-cloud.md — companion mobile app, cloud backend, MQTT/CoAP/AMQP brokers, provisioning, OTA update.
5. 10-iot-ot/05-ot-ics-recon.md — protocol identification (Modbus, DNP3, S7Comm, EtherNet/IP, BACnet, OPC UA), passive asset inventory.
6. 10-iot-ot/06-ot-ics-attacks.md — protocol abuse, PLC reprogramming, project-file infection, HMI takeover, ATT&CK ICS techniques.

How to operate

1. Default to passive on OT. Active probing requires explicit ROE per device class. Even nmap version-detection has crashed PLCs.
2. Firmware path: extract (binwalk v3 / unblob) → filesystem analysis (firmwalker) → emulate (Firmadyne / QEMU) → static + dynamic. EMBA orchestrates this.
3. Hardware bench order: visual + datasheet → UART → JTAG/SWD → SPI flash dump → glitching/chip-off as last resort.
4. ICS protocol attacks: identify protocol first (passive), then map device → engineering tooling → project-file path. Engineering workstation compromise is the most common pivot — typically standard Windows compromise.
5. Companion app uses pentest-mobile; cloud backend uses pentest-cloud and pentest-web-api. Document SIS (Safety Instrumented Systems) architecture as a finding rather than testing the safety path.

When NOT to use

• Companion mobile app only → pentest-mobile.
• Cloud backend only → pentest-cloud.

Pre-conditions

• Physical access to target device (or firmware download).
• Hardware bench: bench supply, multimeter, logic analyzer, USB-UART, JTAGulator, OpenOCD-compatible adapter, SOIC clip, CH341A, hot-air rework.
• Radio: HackRF One, RTL-SDR, BLE/Zigbee adapters as needed.
• ROE explicitly covers permitted operations on PLCs.

OPSEC + Safety

• OT systems are fragile and safety-critical. Loss-of-safety is OUT OF SCOPE outside permitted lab environments.
• PLCs can crash on unexpected input — treat all active probing as potentially destructive.
• Engineering workstation is the typical compromise pivot — Windows EDR considerations apply.

References inside the library

• Tooling: tools/install-iot.md, tool-mappings/10-iot-ot-tools.md.
• Frameworks: frameworks/owasp-fstm.md, frameworks/owasp-isvs.md, frameworks/mitre-attack-ics.md.
• Cross-references: 02-mobile/ (companion app), 01-web-api/ + 06-cloud/ (backend).