awesome-embedded-and-iot-security

Pentest framework like Metasploit but specialized for IoT

Full-featured static analysis framework including extraction of firmware, analysis utilizing different plug-ins and comparison of different firmware versions

Conference talk about FACT

FwAnalyzer

Analyze security of firmware based on customized rules. Intended as additional step in DevSecOps, similar to CI

HAL – The Hardware Analyzer

A comprehensive reverse engineering and manipulation framework for gate-level netlists

HomePWN

Swiss Army Knife for Pentesting of IoT Devices

Framework for automatisation of IoT layers security analysis: hardware, software and communication

Killerbee

Framework for Testing & Auditing ZigBee and IEEE 802.15.4 Networks

PRET

Printer Exploitation Toolkit

Routersploit

Framework dedicated to exploit embedded devices

Binwalk

Searches a binary for "interesting" stuff, as well as extracts arbitrary files

cwe_checker

Finds vulnerable patterns in binary executables - ELF support for x86, ARM, and MIPS, experimental bare-metal support

emba

Analyze Linux-based firmware of embedded devices

Firmadyne

Tries to emulate and pentest a firmware

Firmwalker

Searches extracted firmware images for interesting files and information

Firmware Slap

Discovering vulnerabilities in firmware through concolic analysis and function clustering

Software Reverse Engineering suite; handles arbitrary binaries, if you provide CPU architecture and endianness of the binary

Radare2

Software Reverse Engineering framework, also handles popular formats and arbitrary binaries, has an extensive command line toolset

Trommel

Searches extracted firmware images for interesting files and information

FACT Extractor

Detects container format automatically and executes the corresponding extraction tool

Firmware Mod Kit

Extraction tools for several container formats

Collection of tools for manipulating EPROM files (can convert lots of binary formats)

JTAGenum

Add JTAG capabilities to an Arduino

Free and Open On-Chip Debugging, In-System Programming and Boundary-Scan Testing

Cotopaxi

Set of tools for security testing of Internet of Things devices using specific network IoT protocols

dumpflash

Low-level NAND Flash dump and parsing utility

flashrom

Tool for detecting, reading, writing, verifying and erasing flash chips

Samsung Firmware Magic

Decrypt Samsung SSD firmware updates

Detects and interacts with hardware debug ports like and

Detects and interacts with hardware debug ports like UART and JTAG

Detects and interacts with hardware debug ports like UART and JTAG. Among other protocols

Detects JTAG Pinouts fast

Easy to use Logic Analyzer that support many protocols

Alternative to Saleae logic analyzers

Open source multi-tool hardware similar to the BusPirate but with NFC capabilities

Detects Glitch/Side-channel attacks

Glasgow

Tool for exploring and debugging different digital interfaces

J-Link offers USB powered JTAG debug probes for multiple different CPU cores

Open source 2.4 GHz wireless development platform suitable for Bluetooth experimentation

Easy to use Bluetooth Low Energy sniffer

ZigBee security research hardware for learning about and evaluating the security of IEEE 802.15.4/ZigBee systems. Killerbee compatible

Low Cost Battery Operated Wireless Arduino Board that can be turned into a IEEE 802.15.4 protocol sniffer

Cheapest SDR for beginners. It is a computer based radio scanner for receiving live radio signals frequencies from 500 kHz up to 1.75 GHz

Software Defined Radio peripheral capable of transmission or reception of radio signals from 1 MHz to 6 GHz (half-duplex)

Half-duplex sub-1 GHz wireless transceiver

Software Defined Radio peripheral capable of transmission or reception of radio signals from 100 KHz to 3.8 GHz (full-duplex)

Software Defined Radio peripheral capable of transmission or reception of radio signals from 47 MHz to 6 GHz (full-duplex)

Software Defined Radio peripheral capable of transmission or reception of radio signals from 70 MHz to 6 GHz (full-duplex)

Powerful general purpose RFID tool. From Low Frequency (125kHz) to High Frequency (13.56MHz) tags

Programmable, portable tool for NFC security analysis

Powerful 13.56MHz RFID / NFC platform. Read / write / crack / sniff / emulate

2020, Fotios Chantzis, Evangel Deirme, Ioannis Stais, Paulino Calderon, Beau Woods:

2020, Jasper van Woudenberg, Colin O'Flynn:

The Hacker's Hardware Toolkit: The best collection of hardware gadgets for Red Team hackers, Pentesters and security researchers

2019, Yago Hansen:

2019, Aditya Gupta:

2018, Mark Swarup Tehranipoor:

Pentesting Hardware - A Practical Handbook (DRAFT)

2018, Mark Carney:

2018, Qing Yang, Lin Huang

2017, Aditya Gupta, Aaron Guzman:

2017, Andrew Huang:

2016, Craig Smith:

2015, Keng Tiong Ng:

2015, Nitesh Dhanjan:

2015, Joshua Wright , Johnny Cache:

2014, Debdeep Mukhopadhyay:

2014, Jack Ganssle:

2013, Andrew Huang:

2020, Oser et al:

2019, Agarwal et al:

2019, Almakhdhub et al:

2019, Alrawi et al:

2019, Abbasi et al:

2019, Song et al:

2018, Muench et al:

2017, O'Meara et al:

2017, Jacob et al:

2017, Costin et al:

2016, Kammerstetter et al:

2016, Chen et al:

2016, Costin et al:

2015, Shoshitaishvili et al:

2015, Papp et al:

2014, Zaddach et al:

2014, Alimi et al:

2014, Costin et al:

2013, Davidson et al:

Conference talk presenting several real world examples on real bad implementations

Introduction to PS4's security

CSAW Embedded Security Challenge 2019

CSAW 2019 Embedded Security Challenge (ESC)

Microcorruption: Embedded Security CTF

Hardware Hacking 101

Workshop @ BSides Munich 2019

IoTGoat

IoTGoat is a deliberately insecure firmware based on OpenWrt

Rhme-2015

First riscure Hack me hardware CTF challenge

Rhme-2016

Riscure Hack me 2 is a low level hardware CTF challenge

Rhme-2017/2018

Riscure Hack Me 3 embedded hardware CTF 2017-2018

All things printer

Development best practices and list of hardware and software tools

IoT common vulnerabilities and attack surfaces

Default login credential database sorted by manufacturer

A Wiki/Archive of all things IC reversing

Miscellaneous ARM related Tutorials

A walkthrough covering UART and JTAG bypassing a protected login shell

Detailed tutorial about how to spot debug pads on a PCB

An in depth explanation of the UART protocol

A duo of hackers explaining their step by step approach to finding and exploiting vulnerabilities in embedded devices

Reverse engineering and hardware hacking of embedded devices