IoT Penetesting 101 && IoT security 101

Approach Methodology

1. Network
2. Web (Front & Backend and Web services)
3. Mobile App(Android & iOS)
4. Wireless Connectivity
5. Firmware Pentesting(Hardware or IoT device OS)
6. Hardware Level Approach

Contents

Books

• Android Hacker's Handbook
• Hacking the Xbox
• Car hacker's handbook
• IoT Penetration Testing Cookbook
• Abusing the Internet of Things
• Hardware Hacking: Have Fun while Voiding your Warranty
• Linksys WRT54G Ultimate Hacking
• Linux Binary Analysis
• Firmware

Blogs for iotpentest

1. http://iotpentest.com/
2. blog.attify.com
3. https://payatu.com/blog/
4. http://jcjc-dev.com/
5. https://w00tsec.blogspot.in/
6. http://www.devttys0.com/
7. https://www.rtl-sdr.com/
8. https://keenlab.tencent.com/en/

IoT security vulnerabilites checking guides

• Reflecting upon OWASP TOP-10 IoT Vulnerabilities

Exploitation Tools & OS

• Exploit - IoT Exploitation framework - by Aseemjakhar
• AttifyOS - IoT Pentest OS - by Aditya Gupta
• Ubutnu Best Host Linux for IoT's - Use LTS
• A Small, Scalable Open Source RTOS for IoT Embedded Devices

Reverse Enginnering Tools

• IDA Pro
• GDB
• Radare2

Introduction

• Introduction to IoT
• IoT Architecture
• IoT attack surface
• IoT Protocols Overview

IoT Protocols Pentesting

MQTT

• Introduction
• Reconnaisance
• Hacking the IoT with MQTT
• thoughts about using IoT MQTT for V2V and Connected Car from CES 2014
• Nmap
• The Seven Best MQTT Client Tools

CoAP

• Introduction
• CoAP client Tools
• CoAP Pentest Tools
• Nmap

Automobile

CanBus

• Introduction and protocol Overview
• PENTESTING VEHICLES WITH CANTOOLZ
• Building a Car Hacking Development Workbench: Part1

Radio IoT Protocols Overview

• Understanding Radio
• Signal Processing
• Software Defined Radio
• Gnuradio
• [Introduction to gnuradio concepts]
• Creating a flow graph
• Analysing radio signals
• Recording specific radio signal
• Replay Attacks

Zigbee

    Introduction and protocol Overview
    Reconnaissance (Active and Passive)
    Sniffing and Eavesdropping
    Replay attacks
    Hands-on with RZUSBstick and open source tools

BLE(http://www.diva-portal.org/smash/get/diva2:833159/FULLTEXT01.pdf)

- [Introduction and protocol Overview]
- [BLE Characteristics](https://devzone.nordicsemi.com/tutorials/b/bluetooth-low-energy/posts/ble-characteristics-a-beginners-tutorial0)
- Reconnaissance (Active and Passive) with HCI Tools
	- [btproxy](https://github.com/conorpp/btproxy)
	- [hcitool & bluez](https://www.pcsuggest.com/linux-bluetooth-setup-hcitool-bluez)
	- [Testing With GATT Tool](https://www.jaredwolff.com/blog/get-started-with-bluetooth-low-energy/)
- [Cracking encryption](https://github.com/mikeryan/crackle)

Mobile security (Android & iOS)

    [Android](https://www.packtpub.com/hardware-and-creative/learning-pentesting-android-devices)
    [IOS Pentesting](https://web.securityinnovation.com/hubfs/iOS%20Hacking%20Guide.pdf?)

ARM(https://azeria-labs.com/)

Firmware Pentest

- [Firmware analysis and reversing](https://www.youtube.com/watch?v=G0NNBloGIvs)
- [Firmware emulation with QEMU](https://www.youtube.com/watch?v=G0NNBloGIvs)

IoT hardware Overview

- [Introduction to hardware]
- [IoT Hardware Guide](https://www.postscapes.com/internet-of-things-hardware/)	

Hardware Tools

- [Bus Pirate](https://www.sparkfun.com/products/12942)
- [EEPROM readers](https://www.ebay.com/bhp/eeprom-reader)
- [Jtagulator / Jtagenum](https://www.adafruit.com/product/1550)
- [Logic Analyzer](https://www.saleae.com/)

Attacking Hardware Interfaces

 -	[Serial Terminal Basics](https://learn.sparkfun.com/tutorials/terminal-basics/all)
 -  [Reverse Engineering Serial Ports](http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/)

UART

 - [Identifying UART interface](https://www.mikroe.com/blog/uart-serial-communication)
 - [onewire-over-uart](https://github.com/dword1511/onewire-over-uart)
 - [Accessing sensor via UART](http://home.wlu.edu/~levys/courses/csci250s2017/SensorsSignalsSerialSockets.pdf)

JTAG

 - [Identifying JTAG interface](https://blog.senr.io/blog/jtag-explained)
 - [NAND Glitching Attack](http://www.brettlischalk.com/posts/nand-glitching-wink-hub-fo