iot-hunter

name	iot-hunter
description	IoT and embedded device security testing — firmware analysis, hardware interfaces, protocol exploitation. Use when testing IoT devices, extracting firmware, analyzing embedded systems, or finding hardware vulnerabilities. Use when working with iot hunter.
domain	cybersecurity
author	oyi77
license	Apache-2.0
subdomain	general-cybersecurity
tags	["cybersecurity","hunter","iot","security","testing","threat-defense","money","firmware","hardware","embedded"]
version	1.0.0

IoT Hunter

Overview

IoT and embedded devices are the fastest-growing attack surface in modern networks. Smart cameras, door locks, medical devices, industrial sensors, and home automation hubs ship with woefully inadequate security — hardcoded credentials, unencrypted storage, debug ports left open in production, and firmware that hasn't been reviewed since the prototype phase. This skill covers the full IoT security testing lifecycle: firmware extraction and reverse engineering, hardware interface probing (UART, JTAG, SPI, I2C), wireless protocol analysis (BLE, Zigbee, Z-Wave, Wi-Fi, MQTT, CoAP), and runtime manipulation to identify vulnerabilities that could lead to device compromise, privilege escalation, or network pivoting.

Capabilities:

• Firmware extraction and analysis (binwalk, firmware-mod-kit, unblob)
• Hardware debugging via UART/JTAG/SPI (bus pirate, J-Link, logic analyzer)
• Static and dynamic binary analysis (Ghidra, radare2, checksec)
• Wireless protocol auditing (BLE, Zigbee, Wi-Fi, LoRa)
• Application-layer protocol fuzzing (MQTT, CoAP, HTTP, RTSP, Modbus)
• Cryptographic material recovery (hardcoded keys, certs, flash extraction)
• Boot integrity and secure boot bypass assessment
• Physical interface identification (UART pinout, JTAG boundary scan)

When to Use

Trigger phrases:

• "iot hunter" / "firmware analysis" / "firmware extraction"
• "hardware hacking" / "JTAG debugging" / "UART console"
• "smart device security" / "medical device testing"
• "IoT penetration test" / "reverse engineer firmware"

Appropriate scenarios:

• Pre-launch security assessment of a new IoT product
• Post-purchase vulnerability analysis of consumer smart devices
• Medical device security evaluation (FDA pre-market submissions)
• Industrial IoT (IIoT) / SCADA sensor security testing
• Bug bounty hunting on IoT products
• Red team hardware-assisted initial access (rogue device deployment)

When NOT to Use

• When you lack physical access to the device (most hardware testing requires it)
• When the firmware is encrypted and you have no key extraction path
• For locked-down devices with active secure boot and signed firmware updates — testable but scope is narrower
• When you lack proper authorization for destructive or invasive testing
• On medical devices or safety-critical systems without proper lab isolation and liability coverage

Prerequisites

Hardware (recommended):

• USB UART adapter (CP2102 or CH340G, ~$5)
• JTAG adapter (Bus Pirate v3.6, J-Link EDU Mini)
• Logic analyzer (24MHz 8-channel Saleae clone, ~$15)
• SOP8/SOIC8 clip + flash programmer (CH341A, ~$10)
• Multimeter with continuity/voltage mode
• Screwdriver set, spudger, tweezers, hot air station (optional)

Software (Kali Linux / apt/pip):

• binwalk, firmware-mod-kit, unblob — firmware extraction
• Ghidra / radare2 — binary reverse engineering
• bettercap — BLE and Wi-Fi MITM testing
• wireshark / tshark — protocol capture and analysis
• python3 + scapy — protocol fuzzing and packet crafting
• aircrack-ng / hashcat — Wi-Fi PSK cracking (GPU on RTX 2060 SUPER)
• mqtt-malaria / mqtt-pwn — MQTT security testing
• flashrom / esptool — SPI flash reading (ESP chips)
• checksec (pwntools) — binary security mitigation detection
• nmap — network service discovery

Money-Making Overview

Target Buyer: IoT device manufacturers launching connected products, smart home companies doing pre-launch QA, medical device firms preparing for FDA/CE submissions, industrial automation vendors needing pen testing on sensors/gateways.

How You Make Money:

1. Firmware Security Assessment — Extract, unpack, and audit firmware for hardcoded credentials, backdoors, CVEs, and cryptographic leaks. Deliver finding-by-finding report with CVSS scores. ($2K-$5K/job)

2. Hardware Interface & Physical Testing — Identify and exploit UART, JTAG, SPI flash interfaces to gain root shell, dump firmware, extract keys, or bypass secure boot. ($3K-$8K/job)

3. Network Protocol & Wireless Assessment — Audit BLE, Zigbee, Wi-Fi, MQTT, CoAP for replay, cleartext, weak pairing, injection, missing auth. ($2K-$5K/job)

Service Tiers

Tier	Price	What They Get
Basic — Firmware Quick-Scan	$1,500	Automated binwalk + firmwalker + strings analysis of provided firmware; CVSS-scored findings for hardcoded creds, known CVEs, and exposed secrets. Report in 48 hours. No physical access.
Pro — Full IoT Assessment	$5,000	Physical device + full lab: firmware extraction, UART/JTAG probing, BLE/Wi-Fi sniffing, protocol fuzzing, root shell attempt. Detailed report with PoC videos, CVEs, remediation roadmap. Includes 30-day retest.
Enterprise — Embedded Security Partnership	$3,500/mo	Quarterly full assessments on up to 3 SKUs, continuous firmware monitoring (supply chain dep scanning), secure boot/SBoM review, code signing pipeline audit, on-call for zero-day disclosures.

Expected First Dollar: 2-4 weeks (acquire hardware tools, find client on Upwork or local IoT manufacturer outreach, deliver one Basic firmware scan)

First Action in 60 Minutes

The following script performs an automated firmware analysis pipeline: extract filesystem, search for credentials/keys/CVEs/backdoors, run entropy analysis to detect encrypted or compressed regions. Save as iot-firmware-analyze.sh.

#!/bin/bash
# iot-firmware-analyze.sh — IoT Firmware Analysis Pipeline
# Usage: ./iot-firmware-analyze.sh firmware.bin [output_dir]
# Deps: binwalk, strings, firmwalker, unblob, python3
# Install: sudo apt install binwalk python3-pip && pip3 install unblob

set -euo pipefail
[ $# -lt 1 ] && { echo "Usage: $0 <firmware.bin> [output_dir]"; exit 1; }

FIRMWARE="$1"
OUTDIR="${2:-iot-fw-analyze-$(date +%Y%m%d-%H%M%S)}"
[ ! -f "$FIRMWARE" ] && { echo "Error: firmware file not found"; exit 1; }
mkdir -p "$OUTDIR"/{extracted,reports}
echo "[*] Target: $FIRMWARE ($(du -h "$FIRMWARE" | cut -f1)) Output: $OUTDIR"

# Step 1: Entropy analysis (detects encryption/compression)
echo "[*] Step 1: Entropy analysis..."
python3 -c "
import struct, sys, math
with open('$FIRMWARE', 'rb') as f: data = f.read()
for i in range(0, len(data), 4096):
    block = data[i:i+4096]
    if len(block) < 64: continue
    e = 0.0
    for b in range(256):
        p = block.count(b) / len(block)
        if p > 0: e -= p * math.log2(p)
    bar = '#' * int(e/8*50) + '.' * (50 - int(e/8*50))
    print(f'  0x{i:08x} ({i//1024}K): {e:5.2f}/8.0 |{bar}|')
" > "$OUTDIR/reports/entropy.txt"
echo "  -> Entropy report saved"

# Step 2: binwalk scan
echo 
binwalk -B -M -n  >  2>/dev/null || 


 
 -v unblob &>/dev/null && unblob -e   2>/dev/null || 
binwalk -er -C   2>/dev/null || 


 
strings -n 8  > 
 

grep -ai  \
     >  2>/dev/null || 
 

grep -Eai   \
    | grep -E  >  2>/dev/null || 
 

grep -Eai   \
    >  2>/dev/null || 
grep -Eao   \
    | grep -v  >  2>/dev/null || 
grep -Eai   \
    >  2>/dev/null || 


 -v firmwalker &>/dev/null && firmwalker  \
     2>/dev/null &&   || 


 [ -d  ]; 
    find  - f - file {} \; >  2>/dev/null
    find  -name  -o -name  -o -name  \
        -o -name  2>/dev/null |  -50 >  || 
     
    find  -name  -o -name  -o -name  -o -name  \
        -o -name  -o -name  -o -name  2>/dev/null \
        >  || 
     



 
 
 
 -1 
 
 
 
 

Deliverable Format

The output is a structured IoT Security Assessment Report delivered as PDF + artifacts tarball. Save as iot-security-report.md per engagement.

# IoT Security Assessment Report

**Client:** [Company Name]  **Device:** [Product, model, firmware version]
**Assessment Date:** YYYY-MM-DD  **Assessor:** [Your name]
**Classification:** CONFIDENTIAL

---

## Executive Summary
[2-3 paragraph summary: what was tested, key findings, overall risk level,
top 3 remediation priorities. Written for C-level readers.]

**Risk Level:** [Critical / High / Medium / Low]
**Total Findings:** X (Y Critical, Z High, W Medium, V Low)

---

## 1. Firmware Analysis

### 1.1 Extraction Details
| Detail | Result |
|--------|--------|
| File type | [TRX / UBI / SquashFS / raw binary] |
| Extraction method | [binwalk -er / unblob / manual] |
| Filesystem type | [SquashFS / JFFS2 / UBIFS / CramFS / initramfs] |
| Root access default? | [Yes/No] |

### 1.2 Hardcoded Credentials & Secrets
| Service | Username | Password | Severity |
|---------|----------|----------|----------|
| SSH/Telnet root | [user] | [pass] | Critical |
| Web UI admin | [user] | [pass] | Critical |
| API token / PSK | [key id] | [value] | High |

- [ ] Private TLS keys found  [ ] API tokens / cloud keys found
- [ ] Pre-shared keys for BLE/Wi-Fi  [ ] Firmware signing keys discovered

### 1.3 Known Vulnerable Components
| Component | Version | CVE(s) | CVSS |
|-----------|---------|--------|------|
| BusyBox | [ver] | CVE-XXXX | 7.5 |
| OpenSSL | [ver] | CVE-XXXX | 9.8 |
| Dropbear | [ver] | CVE-XXXX | 5.3 |

### 1.4 Entropy Analysis
[Summary: encrypted/compressed regions flagged, hidden partitions identified]

---

## 2. Hardware Interface Testing

### 2.1 Physical Access Summary
| Interface | Present? | Access Obtained? | Notes |
|-----------|----------|------------------|-------|
| UART | Yes/No | Root shell / Boot log | TX/RX at [voltage]V, [baud] |
| JTAG/SWD | Yes/No | Boundary scan / Debug | Pins identified, locked? |
| SPI Flash | Yes/No | Dumped / Protected | [chip, size, protection] |
| I2C | Yes/No | Device enumeration | Addresses: [list] |

### 2.2 UART Console Findings
- Baud rate: [115200/57600/9600]  —  Root shell without auth: [Yes/No]
- Boot log leaked kernel pointers: [Yes/No]  —  U-Boot recovery shell: [Yes/No]


 JTAG unlocked? [Yes/No]  —  Secure boot bypass via debug? [Yes/No]
 Flash chip: [vendor, part, capacity]  —  Read-protection: [None/Level 1/Level 2]
 Partitions extracted: [list with sizes and content descriptions]

---




 GATT services: [N]  —  Pairing: [Just Works / Passkey / LE Secure]
 Write/notify without auth: [Yes/No]  —  Replay attack: [Yes/No]


 Encryption: [WPA2/WPA3/open]  —  PSK cracked: [Yes/No]
 WPS: [Enabled/Pixie Dust vulnerable]  —  Deauth attack: [Yes/No]


 Network key extracted: [Yes/No]  —  Unencrypted commands: [Yes/No]
 OTA unauthenticated: [Yes/No]  —  Permit-join persistent: [Yes/No]


| Port | Protocol | Service | Vulnerabilities |
|------|----------|---------|----------------|
| 22/tcp | SSH | Dropbear [ver] | Known CVE, default creds |
| 80/tcp | HTTP | lighttpd [ver] | Directory listing, XSS |
| 1883/tcp | MQTT | Mosquitto [ver] | Anonymous subscribe/publish |
| 554/tcp | RTSP | [service] | Unauthenticated stream |


 Anonymous connect: [Yes/No]  —  Subscribe  allowed: [Yes/No]
 Publish to command topics: [Yes/No]  —  TLS enforced: [Yes/No]


 MQTT invalid CONNECT: [Crash / No response / Correct]
 CoAP large payload: [Crash / No response / Correct]
 HTTP CRLF injection: [Vulnerable / Not vulnerable]

---



| ID | Finding | Severity | CVSS 3.1 | Status |
|----|---------|----------|----------|--------|
| FW-001 | Hardcoded root credentials | Critical | 9.8 | Unpatched |
| HW-001 | UART exposed, root shell no auth | Critical | 9.0 | Unpatched |
| NW-001 | MQTT anonymous subscribe | High | 7.5 | Unpatched |
| NW-002 | BLE Just Works pairing (MITM) | High | 6.5 | Unpatched |
| FW-002 | OpenSSL 1.0.2 known CVEs | High | 7.5 | Vendor notified |
| NW-003 | Telnet enabled on port 23 | High | 7.0 | Unpatched |

---



| Timeline | Actions |
|----------|--------|
|  | Remove hardcoded creds; lock UART console; add MQTT auth; patch OpenSSL/BusyBox/Dropbear; disable telnet |
|  | Blow JTAG fuses; implement secure boot + signed updates; BLE Secure Connections; TLS on all services |
|  | Hardware-backed secure element; firmware signing pipeline with revocation; bug bounty program; quarterly re-assessment |

---



 binwalk, unblob, firmwalker, Ghidra v11.1, Bus Pirate v3.6, Saleae logic analyzer, CH341A, bettercap, Wireshark, nRF Connect, aircrack-ng, hashcat (RTX 2060 SUPER ~500 KH/s WPA2), nmap, mqtt-malaria, scapy, checksec, pwntools, flashrom.

 
Contains: entropy.txt, binwalk-scan.txt, all-strings.txt, secrets-credentials.txt, private-keys.txt, cve-hints.txt, firmwalker.txt, ble-sniff.pcapng, mqtt.log, uart-console.log, flash-dump.bin, jtag-scan.txt, extracted-filetypes.txt, config-files.txt.

---

Anti-Rationalization Table

Rationalization	Reality
"IoT devices are cheap, not worth testing"	A $35 smart camera on your office network is a pivot point to the entire corporate LAN. Device cost is irrelevant — network access is priceless to an attacker.
"No one would hack my lightbulb"	IoT botnets (Mirai, 60+ variants) are built entirely from compromised lightbulbs, cameras, and routers. Your lightbulb is a node in someone's DDoS army.
"Firmware is just embedded software — no one finds bugs"	Real examples: hardcoded RSA keys in home routers, empty root passwords on medical infusion pumps, telnet backdoors in baby monitors. Every firmware dump reveals something.
"Physical access is required so it's not a real threat"	Attackers buy the same device off Amazon, dump firmware in their lab, build exploits, then weaponize them. A single exploited device sells for $500-$5000 on exploit markets.
"Our device uses encryption so it's secure"	Encryption at rest is useless when the key is stored in the same flash next to the encrypted data — which is exactly what most IoT devices do.
"Secure boot makes firmware attacks impossible"	Secure boot only checks the boot chain at startup. It doesn't protect against runtime exploits, side-channel key extraction, or flash desoldering.
"It's just a prototype, we'll harden it for production"	Production firmware is almost always the prototype with minimum changes. Hardcoded debug creds and open UARTs persist to retail units in 80% of assessments.
"Our cloud API validates everything — the device itself doesn't matter"	A compromised device sends fabricated sensor data and ignores cloud commands. The device validates firmware, controls actuators, and stores local state — cloud is not a substitute.

Workflow / Process

Phase 1: Reconnaissance & Information Gathering

1. Device teardown — Remove casing, photograph PCB, identify ICs and pinouts (datasheet lookup)
2. Identify debug interfaces — Probe PCB for UART (TX/RX/GND), JTAG (TCK/TMS/TDI/TDO), SWD (SWDIO/SWCLK), SPI flash pads
3. Determine flash type — Serial NOR/NAND, SPI, eMMC, or raw NAND; identify chip markings
4. Network discovery — Connect device to isolated network, nmap for open ports and services
5. Wireless discovery — Scan BLE advertisements, Zigbee channels, Wi-Fi AP/station modes
6. Firmware acquisition — Download from manufacturer, capture OTA update, dump from SPI/JTAG, or MITM mobile companion app
7. Firmware enumeration — binwalk signature scan, entropy analysis, filesystem extraction

Phase 2: Firmware Reverse Engineering

1. Filesystem extraction — Unpack SquashFS, JFFS2, UBIFS, CramFS, initramfs, or proprietary formats
2. Credential hunting — Search for hardcoded passwords, API keys, tokens, certificates, pre-shared keys
3. Vulnerability scanning — Version-check all bundled libraries (OpenSSL, Dropbear, BusyBox, curl) against CVE databases
4. Binary analysis — Load ELF/ARM/MIPS/RISC-V binaries into Ghidra; check for insecure sprintf, system(), exec()
5. Backdoor detection — Look for hidden telnetd, debug endpoints, vendor backdoors, hardcoded upgrade URLs
6. Firmware signing check — Validate firmware update signature scheme and public key storage location

Phase 3: Hardware Interfacing

1. UART console access — Connect USB-UART adapter at 115200/57600/9600 baud; sweep common rates; try default creds; interrupt U-Boot for recovery shell
2. JTAG/SWD probing — Scan JTAG chain with bus pirate or J-Link; if IDCODE readable, attempt boundary scan, flash read, register dump
3. SPI flash dumping — Attach SOP8/SOIC8 clip to CH341A; dump flash (verify with second read); analyze partition layout
4. Side-channel opportunities — Power analysis for timing attacks; EMF probing for key extraction (advanced)
5. Voltage/clock glitching — Fault injection on secure boot (requires oscilloscope + pulse generator — advanced)
6. RTC/NVRAM inspection — Read battery-backed memory for stored credentials, session tokens, pairing data

Phase 4: Wireless & Protocol Testing

1. BLE — Enumerate GATT services/characteristics with bettercap/nRF Connect; test read/write without auth; observe pairing for MITM; capture packets for offline analysis
2. Wi-Fi — WPA2 handshake capture with airodump-ng + PSK cracking on RTX 2060 SUPER (~500 KH/s); WPS Pixie Dust; deauth to force reconnect
3. Zigbee/Z-Wave — Capture network key during pairing; replay commands; scan for open permit-join windows
4. MQTT/CoAP — Subscribe to topics without auth; publish to command topics; fuzz payload fields; check TLS enforcement
5. HTTP/HTTPS — Fuzz web interface; test LFI/RFI, command injection, CSRF, session hijacking, default creds
6. Mobile app API — Intercept companion app with Burp Suite; test pairing APIs, device ID enumeration

Phase 5: Exploitation & Reporting

1. Develop PoC — Write exploits (Python+scapy for network, Bash for UART, Python for MQTT, C for local priv esc)
2. Document CVSS — Score each finding using CVSS 3.1 with attack vector, complexity, privileges, scope
3. Generate report — Compile executive summary, technical findings, remediation roadmap, artifacts archive
4. Remediation retest — After vendor patch window, retest to confirm fixes (Pro tier)

Tools

• Firmware extraction & analysis: binwalk, unblob, firmware-mod-kit, JeFF (JFFS2 extractor), ubi_reader
• Binary analysis: Ghidra, radare2, objdump, readelf, checksec (pwntools)
• Strings & pattern matching: strings, grep/ripgrep, firmwalker, binblade
• Hardware probing: Bus Pirate v3.6, Segger J-Link, Saleae logic analyzer, CH341A SPI programmer, USB-serial (CP2102/FT232)
• Wireless/BLE: bettercap, bluepy, nRF Connect, gatttool, Wireshark, Ubertooth One
• Wi-Fi: aircrack-ng suite, hashcat (RTX 2060 SUPER), hcxdumptool, Wifite
• Zigbee: zigbee2mqtt, Killerbee, TI CC2531 sniffer, Z-Fuzz
• Protocol testing: mqtt-malaria, mqtt-pwn, scapy, Burp Suite Community Edition
• Flash analysis: flashrom, esptool (ESP chips), nanddump
• Password cracking: hashcat (GPU on RTX 2060 SUPER), John the Ripper
• Python libs: scapy, bluepy, pyserial, intelhex, pyelftools

Environment Setup

# Core tools
sudo apt install -y binwalk firmware-mod-kit python3-pip radare2 nmap wireshark aircrack-ng hashcat bluez
pip3 install unblob cstruct pyserial bluepy scapy paho-mqtt mqtt-malaria intelhex
# Ghidra: download from ghidra-sre.org — the NSA decompiler, essential for binary RE

Verification

• Firmware extracted to filesystem (verified with file / ls)
• Credentials and secrets catalogued (hardcoded, default, embedded)
• Known vulnerable library versions cross-referenced with CVE database
• UART console accessed (or reason documented why not possible)
• Wireless protocols captured and analyzed (BLE, Wi-Fi, Zigbee)
• Open network ports enumerated and service versions identified
• Each finding has confirmed PoC (not theoretical)
• CVSS 3.1 base score calculated for every vulnerability
• Selected high-severity findings reproduced on a second unit (if available)
• Remediation recommendations include short-term and long-term options
• Report generated with executive summary and technical detail
• Artifacts packaged for client delivery (tarball with reports and captures)