菜单
IoT network service and protocol vulnerability analysis. Use when analyzing network-facing services (UPnP, MQTT, CoAP, Telnet, RTSP), scanning device ports, testing network service implementations, or analyzing protocol-level vulnerabilities in IoT devices.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Authentication bypass vulnerability hunting in IoT firmware. Use when analyzing login mechanisms, session management, access control, or authentication logic in web interfaces, APIs, or network services of embedded devices. Triggers on auth bypass, login bypass, session hijacking, or access control analysis tasks.
U-Boot and embedded bootloader security analysis — environment variable attacks, secure boot bypass, boot sequence exploitation, and firmware integrity verification
Buffer overflow vulnerability hunting in IoT embedded binaries. Use when reverse-engineering ARM/MIPS/x86 binaries for stack-based or heap-based overflow vulnerabilities, analyzing unsafe memory operations (strcpy, sprintf, gets, memcpy), checking binary protections (NX, ASLR, canary), or building overflow PoCs for embedded targets.
Command injection vulnerability hunting in IoT firmware. Use when analyzing CGI binaries, web server handlers, SOAP/UPnP interfaces, or any user-input-to-system-call path in embedded devices. Triggers on searching for OS command injection (CWE-78), argument injection (CWE-88), or code injection in firmware binaries and scripts.
Cryptographic weakness and insecure crypto implementation hunting in IoT firmware. Use when analyzing encryption implementations, TLS/SSL configurations, key management, random number generation, or any cryptographic operations in embedded device firmware. Triggers on crypto analysis, weak encryption, insecure TLS, or key management tasks.
Firmware decryption, deobfuscation, and unpacking for encrypted IoT firmware images. Use when firmware entropy analysis reveals encrypted/obfuscated content, when binwalk extraction fails due to encryption, when decrypting vendor-specific firmware encryption (D-Link, Netgear, TP-Link, Hikvision, Dahua, ZTE), or when reversing custom XOR/AES/DES encryption applied to firmware update files.
| name | iot-network-analysis |
| description | IoT network service and protocol vulnerability analysis. Use when analyzing network-facing services (UPnP, MQTT, CoAP, Telnet, RTSP), scanning device ports, testing network service implementations, or analyzing protocol-level vulnerabilities in IoT devices. |
Analyze network services and protocol implementations in IoT devices for security weaknesses.
# Full port scan
nmap -sV -sC -p- <device_ip> -oN scan_results.txt
# UDP scan (UPnP, CoAP, SNMP)
nmap -sU -p 161,1900,5353,5683 <device_ip>
# Identify service versions
nmap -sV --version-intensity 5 <device_ip>
# Discover UPnP devices
gssdp-discover --timeout=3
# Get device description
curl http://<device>:49152/rootDesc.xml
# List SOAP actions (attack surface)
curl http://<device>:49152/rootDesc.xml | grep -i "action\|service"
UPnP vulnerabilities:
# Subscribe to all topics (no auth)
mosquitto_sub -h <device_ip> -t "#" -v
# Check for anonymous access
mosquitto_pub -h <device_ip> -t "test" -m "probe"
# Common IoT MQTT topics
# device/+/status, device/+/command, home/+/set
MQTT vulnerabilities:
# Check for open telnet
nmap -p 23,2323 --script telnet-brute <device_ip>
# Hidden telnet (common in cameras)
nmap -p 9527,23456 <device_ip>
# Probe RTSP streams
nmap --script rtsp-url-brute -p 554 <device_ip>
# Common RTSP paths
curl rtsp://<device_ip>/live/ch0
curl rtsp://<device_ip>/Streaming/Channels/1
curl rtsp://admin:admin@<device_ip>/cam/realmonitor
# CoAP discovery
coap-client -m get coap://<device_ip>/.well-known/core
# Read resources
coap-client -m get coap://<device_ip>/sensor/temperature
# Community string bruteforce
snmpwalk -v2c -c public <device_ip>
snmpwalk -v2c -c private <device_ip>
# Get system info
snmpget -v2c -c public <device_ip> 1.3.6.1.2.1.1.1.0
| Issue | Impact | Check |
|---|---|---|
| Unauth'd service access | Full device control | Try connecting without credentials |
| Plaintext protocols | Credential sniffing | Check for HTTP (not HTTPS), Telnet, unencrypted MQTT |
| Verbose error messages | Information leak | Send malformed requests |
| Missing rate limiting | Brute force | Attempt rapid login attempts |
| Default SNMP community | Full read/write | Try "public"/"private" strings |